New HIPAA Guidance Tackles Ransomware Epidemic In Healthcare
HHS addresses ransomware infections in wake of healthcare attacks.
![](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltc94608acf452fd67/655cf371ab171e040a838b2a/329050_DR23_Graphics_Website_V5_Default_Image_v1.png?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
It took ransomware infections that brought two major hospital systems to their knees earlier this year to demonstrate how dangerous malware can be for healthcare organizations. Now the federal government has issued new guidance via the Healthcare Insurance Portability and Accountability Act (HIPAA) to address ransomware attacks.
The US Health and Human Services Office for Civil Rights this week issued guidelines for helping healthcare organizations understand, prevent, and prepare for ransomware attacks. It provides information on what ransomware is, how attacks work, how to spot it, how to quell damage, and of course how to protect data with regular backups. The guidance notes that existing HIPAA requirements basically cover ransomware attacks, and explains how a ransomware attack maps to those rules.
“The new guidance reinforces activities required by HIPAA that can help organizations prevent, detect, contain, and respond to threats,” Jocelyn Samuels, director of the Office of Civil Rights, wrote in a blog post. Among those practices: running a risk analysis of threats to electronic health information; training users to detect malware; limiting user access to electronic health records; and establishing a contingency plan including regular data backups, test restoration, and emergency operations.
“Organizations need to take steps to safeguard their data from ransomware attacks. HIPAA covered entities and business associates are required to develop and implement security incident procedures and response and reporting processes that are reasonable and appropriate to respond to malware and other security incidents,” Samuels said.
While having HIPAA address ransomware makes sense, some security experts say it’s no guarantee users won’t still fall for a phish or link in an email. “Any new guidance that can help healthcare organizations prevent, detect, contain, and respond to threats (especially ransomware) is obviously good guidance. However, will guidance solve the bigger problem of the unsuspecting click?” says Stephen Gates, chief research intelligence analyst at NSFOCUS.
“Ransomware," he says, "is not an exploit that takes advantage of a vulnerable application or operating system. Ransomware is a payload that takes advantage of vulnerable people and their clicks. Even the best guidelines can’t solve that problem.”
HIPAA’s guidance on ransomware is here.
About the Author
You May Also Like
Catch the Threat Before it Catches you: Proactive Ransomware Defense
September 5, 2024How to Evaluate Hybrid-Cloud Network Policies and Enhance Security
September 18, 2024DORA and PCI DSS 4.0: Scale Your Mainframe Security Strategy Among Evolving Regulations
September 26, 2024Harnessing the Power of Automation to Boost Enterprise Cybersecurity
October 3, 2024
[Virtual Event] The Essential Guide to Cloud Management
October 17, 2024Black Hat Europe - December 9-12 - Learn More
December 10, 2024SecTor - Canada's IT Security Conference Oct 22-24 - Learn More
October 22, 2024