Dan Bowden

ICYMI: HHS says hospitals impacted by Change Healthcare cyberattack can delegate breach notifications to UnitedHealth Group Three key points made in this update: 1) Covered entities affected by the Change Healthcare breach may delegate to Change Healthcare the tasks of providing the required HIPAA breach notifications on their behalf. 2) Only one entity – which could be the covered entity itself or Change Healthcare – needs to complete breach notifications to affected individuals, HHS, and where applicable the media. 3) If covered entities work with Change Healthcare to perform the required breach notifications in a manner consistent with the HITECH Act and HIPAA Breach Notification Rule, they would not have additional HIPAA breach notification obligations. See the HHS Cybersecurity Incident FAQs here: https://lnkd.in/ejEebTXK #healthcare #hipaa #cybersecurity #hhs #riskmanagement #risktolerance #riskassessment #criticalinfrastructure #hitrust #criticalcontrols #penetrationtesting #vulnerabilityassessment #vulnerabilitymanagement

1

What is Today's Cost ("Good Investment" ) for a CyberSecurity Program..? How about $22 Million..? Think this is (too) High..?? Then... Is $1 Billion too much..? How about $1.6BB..? The Costs of Change Healthcare (Ransomware) CyberSecurity Attack is now close to exceeding $1 Billion... (currently at $872 Million)... but projected to be between $1.35 - 1.6 BB when the while event is concluded. This includes the $22 Million Ransomware Payment to the AlphaV BlackCat criminal organization. This Cost will "eclipse that of Casino Group MGM, which didn't pay a ransom following an attack on its systems last year, and which faces recovery costs of $100 million to rebuild its systems and paying for the fallout...". 95% of Ransomware is Preventable.. CyberSecurity A-Team has an Industry-PROVEN Ransomware Methodology that will help prevent Companies from suffering a Ransomware Attack. Don't wait until it's Too Late..! (after you are Attacked) to contact them - www.CyberSecurity-A-Team .com #Ransomware #CyberSecurity-A-Team #Healthcare #MostVulnerable https://lnkd.in/g5B7fqEu

6

Bob Zukis and the Digital Directors Network (DDN) recently published a summary and full text of Glass, Lewis & Co.'s latest strengthening of their position on cyber governance for their members. If you're not a member of DDN, you should consider applying. Both ISS | Institutional Shareholder Services (ISS)and Glass Lewis, the two most prominent proxy advisory services in North America, had already taken measures to include disclosures and other similar requirements to the SEC's final cybersecurity disclosure requirements in their governance assessments of public companies. This latest Glass Lewis announcement raises the ante even more. As a public company, UnitedHealth Group will continue to be under scrutiny for their handling of the current matter. Lots to learn from this one. #riskmanagement #enterprisecyberriskmanagement #cyberriskmanagement #cyberriskilliteracy #cyberopportunitymanagement #cybersecurityvalue #boardcyberoversight #boardofdirectors

7

2 Comments

E-mail Bombing and Credential Harvesting... Not new, but if you haven't considered them as a risk, this is a good reminder to take a look at how they could impact your #healthcare organization. On Credential Harvesting: Do you require MFA for all remote access? How often do you require passwords to be changed (There are obviously pro's and con's to requiring frequent password changes - so context will matter here - MFA is critical in this discussion). NIST 800-63 might be a good read here too... #healthcare #HIPAA #Hitrust #privacy #security #cybersecurity #riskmanagement #incidentresponse #risktolerance #riskassessment #businesscontinuity #criticalinfrastructure #NIST80063 #authentication #identitymanagement #passwordsecurity #data breach

5

Does anyone believe that we know "the half of it" when it comes to the impact on patients due to Ascension's failed enterprise cyber risk management (ECRM) program? Anyone who's been a patient (that's all of us) knows how difficult it is to receive access to care, timely care, and quality care when the healthcare system is ostensibly operating at its best. In addition to patients not getting their prescriptions, having important diagnostic tests postponed, being treated without access to vitally important records, being diverted from ERs etc. etc., etc., I'm convinced there are deaths occurring. C'mon healthcare!@#! Top two root causes: 1. Risk illiteracy 2. Lack of C-suite/Board engagement #riskmanagement #enterprisecyberriskmanagement #cyberriskmanagement #cyberriskilliteracy #cyberopportunitymanagement #cybersecurityvalue #boardcyberoversight #boardofdirectors https://lnkd.in/esvF_ETP

18

3 Comments

Did you know these myths? Learn more about the importance of having great cybersecurity: https://lnkd.in/gur-Qx78 #cybersecurity #ITservices #bayarea

1

In 2024, boards should be taking cyber security seriously! It is an existential threat to many businesses, and needs to be met with appropriate focus and attention. However, there is a shortage of people with the experience, ability, and desire to take on the responsibility of a CISO role. We need to solve that. As an industry, we also need to provide the tools to make their job easier.

5

🗞️ In CyberScoop: "[T]he years of work to build up federal collaboration with industry are paying off, from the Joint Cyber Defense Collaborative to the National Risk Management Center — the 'proto' version of the JCDC, [Chris Krebs] said — to the National Security Agency’s Cybersecurity Collaboration Center. "'We’re starting to see that these things work with the resources and time into it, but it’s generating results and there’s no better evidence of the results, I think, than when Russia invaded Ukraine, and the ‘Shields Up’ campaign and the breadth to which that was able to change behavior in industry,' said Krebs, now chief intelligence and public policy officer at SentinelOne." To learn more, read the full article by Tim Starks: https://s1.ai/CS-Collab

43

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a security flaw impacting NextGen Healthcare Mirth Connect to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The flaw, tracked as CVE-2023-43208 (CVSS score: N/A), concerns a case of unauthenticated remote code execution arising from an incomplete

1