Remote Desktop Tools are the Front Door in Healthcare, and Hackers are Walking Through

Posted by Steve Alder

There is some positive news from the data collected by cybersecurity firm SonicWall, as cyberattacks have declined by up to 57% in some sectors; however, the healthcare industry has seen the smallest decline out of all tracked verticals, registering just a 17% year-over-year decline, compared to -23% for professional services, -42% for education, -46% for retail and -57% for manufacturing. Healthcare is still persistently targeted by cyber actors, and the gap between healthcare and other sectors is growing, according to the SonicWall 2026 Healthcare Protect Brief.

There are more active ransomware groups (10) attacking healthcare organizations than any other sector, indicating the industry is being actively targeted rather than falling victim to spray-and-pray attacks, and in H1 2026, there were four times as many malware hits per firewall in healthcare as the next most attacked sector. UltraVNC buffer overflow attacks generated 13.3 million hits in just 5 months, as hackers primarily targeted remote desktop tools to attack healthcare organizations – no other vertical experienced remote desktop exploitation at that scale.

Healthcare organizations rely on remote desktop tools to support their distributed clinical environments, telemedicine platforms, and third-party vendor access. If remote access credentials are compromised, it gives threat actors a path to clinical systems and patient data, which can be exfiltrated and held to ransom. While network-level controls can limit data access, and multifactor authentication (MFA) can prevent compromised credentials from providing access, MFA is often not implemented, and a single set of credentials does not just unlock one application; they often grant access to the full network.

SonicWall also identified 243 unique attack methods targeting connected medical devices, with the Internet of Things (IoT) the fastest-growing and hardest-to-patch exposure. Healthcare organizations have a huge range of deployed connected devices, including infusion pumps, patient monitors, imaging systems and more, which means a huge attack surface to defend. Unfortunately, the attack surface is growing faster than security teams can govern it. IoT devices are often not routinely patched, cannot run endpoint agents, and often share network segments with clinical systems that contain protected health information.

“Healthcare does not have a cybersecurity problem. It has three of them,” explained Michael Crean, SonicWall SVP of Managed Services. Remote desktop tools without layered controls and MFA; a huge IoT footprint containing vulnerable devices; and targeted ransomware attacks. “Attackers have figured out how to use all of them at the same time.”

Hackers continue to target the sector as the returns are too reliable and the defenses too predictable. “What our research makes clear is that attackers have done the math. Hospitals cannot go dark, downtime is measured in patient outcomes, and the pressure to pay is unlike anything in any other sector. None of that changes until healthcare stops relying on security architectures built for a world that no longer exists, and starts treating Zero Trust not as a future initiative, but as the baseline they needed yesterday.”

The immediate steps recommended by SonicWall are to restrict UltraVNC and RDP to internal VLANS and ensure that MFA is implemented for all remote access, with no exceptions for vendors and no break-glass credentials. Connected medical IoT devices must be placed on isolated networks, away from clinical systems. Healthcare organizations need to implement application-level Zero Trust and ensure that legacy vulnerability exposure is addressed. SonicWall recommends conducting a comprehensive inventory of clinical middleware and IoT firmware and then ensuring that vulnerabilities are patched or devices isolated on a defined schedule.

The post Remote Desktop Tools are the Front Door in Healthcare, and Hackers are Walking Through appeared first on The HIPAA Journal.

HIPAA Compliance Software

Posted by Steve Alder

The purpose of HIPAA compliance software is to provide a framework to guide a HIPAA-covered entity or business associate through the process of becoming HIPAA-compliant and support continued compliance with HIPAA.

The best HIPAA compliance softwareHIPAA compliance software helps administrators, business owners, practice managers, and compliance officers, many of whom manage compliance alongside other responsibilities and without a formal background in healthcare regulation, navigate the nuances of HIPAA and ensure all applicable provisions of the HIPAA Privacy, Security, and Breach Notification Rules are satisfied. The software also proves a company has made a good faith effort to comply with HIPAA by maintaining full documentation of compliance activities.

This ensures that if a company is audited by the HHS’ Office for Civil Rights (OCR) or is investigated by OCR or state attorneys general over a data breach, the organization can demonstrate no aspect of HIPAA has been missed, all policies and procedures are in order, members of the workforce have received HIPAA training, and appropriate technical, physical, and administrative safeguards have been implemented and are being maintained. Additionally, the right compliance software will include support if an investigation does occur, not just documentation beforehand.

It should be noted that the use of HIPAA compliance software will not absolve companies of liability in every circumstance (i.e., in the event of an employee violating HIPAA), but regulators do take a covered entity’s or business associate’s good faith efforts to comply with HIPAA into account when deciding whether a financial penalty or other sanction is appropriate. A well-documented compliance program, consistently maintained, is the strongest protection available if OCR ever investigates.

Avoid Taking Shortcuts with HIPAA Compliance Software

Many compliance solutions only address specific elements of HIPAA compliance, such as the risk assessment. While HIPAA risk assessment software is a good place to start, it only covers one required provision of the HIPAA Security Rule.

Software that only covers specific aspects of HIPAA compliance will not help covered entities and business associates assess and demonstrate they are fully compliant. Even if covered entities and business associates are confident about their compliance programs, it is best to use a comprehensive software solution that covers all the required and addressable implementation specifications of HIPAA, the HITECH Act breach notification requirements, and even state laws.

A comprehensive compliance solution does not need to be the most expensive option available. For many organizations, the most practical choice is often a solution that covers everything required without unnecessary complexity, and makes the ongoing work of staying compliant as straightforward as possible.

Best HIPAA Compliance Software

The best HIPAA compliance software is a comprehensive compliance solution that walks users through setting up, implementing, and maintaining HIPAA policies and procedures, tracks staff training, and ensures all appropriate safeguards are implemented to meet HIPAA Privacy and Security Rule requirements.

The best HIPAA compliance softwareMany compliance software solutions include templates for policies and HIPAA documents such as business associate agreements. Templates vary significantly in how useful they actually are in practice. Some require the user to understand enough about HIPAA and their own organization to complete them correctly, which can be a significant ask for a practice manager without a compliance background. Others provide static, one-size-fits-all documents that may not accurately reflect how a specific practice operates. Documentation that does not represent what a practice actually does can work against an organization during an investigation. The best solutions generate documentation specific to the organization rather than requiring users to build it themselves.

The top HIPAA compliance solutions also help with the management of business associates. Business associates can be fined directly for HIPAA violations, but HIPAA covered entities also have a responsibility to ensure vendors are fully compliant. A HIPAA breach at a business associate will have many negative implications for a covered entity.

Some HIPAA compliance software solutions allow covered entities to send self-audits to business associates, monitor the results of the audits, and track and maintain business associate agreements.

A good compliance solution will track employee training, ensure it is completed on schedule, and maintain documentation of who completed what and when. That documentation is what matters during an investigation. Continuing education credits are sometimes offered as part of HIPAA training programs, but for most staff completing HIPAA training they serve no practical purpose and are unrelated to HIPAA compliance requirements. The measure of good training is not whether it earns credits. It is whether it was completed, documented, and whether that record holds up if OCR asks to see it.

Last but not least, even the best HIPAA compliance software solutions are not guaranteed to resolve all HIPAA compliance issues. If problems are experienced, support staff should be available to guide you through the compliance process and answer any questions you may have about HIPAA. When evaluating support, look beyond whether it exists and ask how quickly responses come, how it is accessed, and whether it is included in the cost of the software or available only at an additional charge.

Software Ease of Use

For practice managers and administrators who are not compliance specialists, ease of use is one of the most important and frequently underestimated factors in whether a software solution delivers on its promise.

Many software users might only log into their compliance platform once a month or less. A solution that is not intuitive, or requires a support call to complete routine tasks, adds friction that discourages consistent use. The best solutions make it clear what needs to be done, guide the user through it, and require minimal time to maintain once the initial setup is complete.

Initial setup may require a time investment depending on your starting point – so don’t let that scare you off. But a well-designed solution should be completable in a matter of hours and should not require prior compliance expertise to get started. After setup, ongoing maintenance should be light enough that compliance does not become a recurring burden on staff.

What Compliance Software Will and Will Not Do

No compliance software eliminates the need for human input entirely. The role of a good solution is to remove the expertise requirement, automate what can be automated, and reduce the time required for the work that remains.

Someone at the organization will still need to complete tasks, review documentation, and ensure the program stays current. The difference between a good solution and a poor one is how much time and knowledge that requires. In general, a well-implemented compliance program should not be a significant ongoing time commitment once it is properly set up.

Be cautious of any solution that implies compliance can be achieved with no effort or input from the organization. Compliance requires the organization to accurately represent itself. Software can guide and automate that process, but it cannot replace the engagement of the people who know the practice.

Assessing Suitable HIPAA Compliance Software Vendors

Finding a suitable vendor of HIPAA compliance software can be a challenge. We suggest the following tips for finding a suitable software vendor to ensure the service provided for you is comprehensive and does not leave any unidentified gaps in your compliance efforts:

  • Avoid HIPAA training courses that promise compliance certification within a matter of minutes
  • Select vendors that offer compliance solutions tailored to your specific needs
  • Ensure somebody is available to answer any questions and guide you through the compliance process
  •  (and if that support is included in the cost)
  • Check the vendor offers a solution that supports continued compliance rather than simply providing a one-off assessment
  • Ask whether any customers have been through an OCR investigation while using the software and what the outcome was
  • Confirm how the software handles regulatory updates and how your documentation is updated when rules change
  • Research whether the vendor is endorsed by any medical associations or IT organizations

HIPAA Compliance Software Vs. HIPAA Compliant Software

The terms “HIPAA compliant software” and “HIPAA compliance software” are frequently used interchangeably by some software vendors, although the two terms mean something quite different.

“HIPAA compliance software” is more often than not an app or service that guides a business through its compliance efforts. This type of software can either help with specific elements of HIPAA compliance (i.e. HIPAA Security Rule risk assessments) or provide a total solution for every element of HIPAA compliance.

HIPAA compliant software is usually an app or service for healthcare organizations that includes all the necessary privacy and security safeguards to support HIPAA compliance – for instance, secure messaging solutions, hosting services, and secure cloud storage services. HIPAA compliant software does not guarantee compliance. It is the responsibility of users of the software solutions to ensure the software is used in a HIPAA-compliant manner.

If you are a vendor looking for information on how to make your software solution HIPAA compliant please click here.

 

 

Benefits of HIPAA Compliance Software–the hipaajournal.com

Summary

Finding the right compliance software is worth some due diligence. The consequences of getting it wrong are significant, and the ongoing cost of a quality solution is modest compared to the cost of an investigation, a fine, or a breach.

The right software will not make compliance effortless, but it will make it less effort. Look for a solution that covers everything required, generates documentation specific to your practice or business, keeps itself current as regulations change, and has a track record of supporting customers through real-world compliance situations.

For a more detailed framework to evaluate and compare specific solutions, download our free buyer’s guide.

Buyers Guide Best HIPAA Compliance SoftwareFree Buyer’s Guide

We have compiled a free buyer’s guide to choosing the best HIPAA compliance software. This includes a checklist for essential functionality, software specifications and business considerations. You can rate up to three different solutions for each area and compare your results. This guide to choosing compliance software can be downloaded by filling in the form on this page.

FAQs

Is HIPAA compliance software the same for covered entities and business associates?

HIPAA compliance software is not the same for covered entities and business associates. While both covered entities and business associates are required to comply with all “applicable” standards of the HIPAA Administrative Simplification Regulations, a covered entity would likely need more comprehensive guidance through the complexities of the HIPAA Privacy Rule. In addition, topics such as business associate management would most often be unique to covered entities.

What is the most important feature of HIPAA compliance software for covered entities?

The most important feature of HIPAA compliance software for covered entities depends on where gaps exist in their current program. For many practices the most pressing need is a complete, documented program they can stand behind if OCR ever investigates. A risk assessment is a required starting point, but the software should go well beyond that to cover all required elements of a HIPAA compliance program.

What is the most important feature of HIPAA compliance software for business associates?

The most important feature of HIPAA compliance software for business associates will again depend on whether gaps exist in the business associate’s compliance efforts and what they are. However, one of the most important benefits of HIPAA compliance software for business associates is understanding the role they play in handling patient data. Too often, business associates are unaware of the requirements they must follow when working with covered entities.

Is there any HIPAA software my organization should avoid?

With regards to HIPAA software your organization should avoid, be cautious of vendors who promise full compliance with no meaningful setup process or no documentation of how the program was built. Also be wary of training that requires no real engagement from staff. Anyone familiar with HIPAA will know that partial compliance is not compliance, so avoid vendors that offer compromise to the rule. Be equally cautious of solutions priced so low that it raises questions about what is actually included and who is available to help when a real situation arises

Where can I find out more about HIPAA compliance software?

The best HIPAA compliance softwareYou can find out more about HIPAA compliance software by clicking over to our page about the best HIPAA compliance software which covers requirements under (1) essential functionality, (2) software specifications and (3) business considerations.

What is the purpose of HIPAA compliance software?

The purpose of HIPAA compliance software is to provide a framework to guide HIPAA-covered entities and business associates through the process of becoming HIPAA-compliant and ensuring continued compliance with HIPAA and HITECH Act Rules. The software helps compliance officers navigate the nuances of HIPAA and ensures all applicable provisions of the HIPAA Privacy, Security, and Breach Notification Rules are satisfied.

How can HIPAA compliance software help during an investigation or audit by OCR inspectors?

HIPAA compliance software can help during an investigation or audit by OCR inspectors by providing full documentation of compliance efforts. The documentation demonstrates that the organization has made a good faith effort to comply with HIPAA, that all applicable policies and procedures are in order, and that workforce members have received training.

Does HIPAA compliance software absolve organizations of liability in the event of a data breach?

HIPAA compliance software does not absolve organizations of liability in the event of a data breach. It is a tool, and its effectiveness as a defense depends entirely on how well it has been used. A program that is set up carelessly or left out of date will not hold up in an investigation in the same way a well-maintained one will. However, an organization that has actively used its compliance software to build and maintain a complete, documented program is in a significantly stronger position when regulators investigate. The software creates the conditions for a good defense. The organization still has to use it properly.

What features should be included in the best software for HIPAA compliance?

The features that should be included in the best software for HIPAA compliance include features to help develop, implement, and maintain HIPAA policies and procedures, track staff training, ensure appropriate safeguards are implemented, and allow the customization of policies, procedures, and documentation. The best software for HIPAA compliance should also assist with the management of business associates and be supported by knowledgeable and available compliance experts.

Is there an officially recognized HIPAA compliance certification for software?

There is no official certification that declares an organization compliant. This is because HIPAA compliance is not a milestone you reach once a year, it is a program you constantly maintain. Some compliance providers offer badges or seals that organizations can display on their websites to signal a commitment to compliance practices. However, these carry no regulatory weight and do not constitute proof of compliance in an investigation.

Is there an officially recognized HIPAA certification for software vendors?

There is no officially recognized HIPAA certification for software products. A software vendor cannot be certified as HIPAA compliant in any official sense. If you are evaluating a software vendor or any third party that handles patient data on your behalf, the relevant document is a Business Associate Agreement, which does not certify that a vendor is HIPAA compliant, but it establishes their legal obligation to handle protected health information appropriately and creates accountability if they do not. Some vendors also hold a SOC 2 or HITRUST certification, which speaks to the security of their own systems and processes. This is a meaningful indicator of how a vendor manages data internally but it is distinct from HIPAA compliance and should never be treated as a substitute for a BAA.

 

The post HIPAA Compliance Software appeared first on The HIPAA Journal.

Okanogan Behavioral Healthcare Settles Class Action Data Breach Lawsuit

Posted by Steve Alder

Okanogan Behavioral Healthcare, a provider of holistic behavioral health services in Okanogan County, Washington, has agreed to settle a class action lawsuit stemming from a May 2024 data breach that affected 26,429 individuals.

A network intrusion was identified on May 15, 2024, and the forensic investigation determined that an unauthorized third party had access to its network from May 13, 2024, to May 15, 2024. Data exposed in the incident included client names, contact information, dates of birth, Social Security numbers, driver’s license numbers, other identification numbers, and medical information, including diagnosis and treatment information, and health insurance information. The affected individuals started to be notified on August 23, 2024.

A lawsuit was filed – Doe v. Okanogan Behavioral Healthcare – in the Superior Court of the State of Washington for the County of Okanogan in response to the data breach, alleging that the data breach was due to the failure of the defendant to implement reasonable and appropriate cybersecurity measures, and had they been implemented, the data breach could have been prevented. Okanogan Behavioral Healthcare denies wrongdoing and liability, and disagrees with all claims and contentions in the lawsuit; however, a settlement was agreed to avoid further litigation costs and the uncertainty of a trial and associated appeals.

Okanogan Behavioral Healthcare has agreed to cover attorneys’ fees and expenses, settlement notification and administration costs, and a service award for the class representative. Under the terms of the settlement, class members may submit a claim for reimbursement of losses due to the data breach and/or an alternative cash payment or credit monitoring services.

Claims may be submitted for reimbursement of documented, unreimbursed ordinary losses, up to a maximum of $300 per class member, and extraordinary losses up to a maximum of $5,000 per class member. A claim may also be submitted for an alternative cash payment, anticipated to be $50 per class member, or two years of credit monitoring services. The maximum claim is therefore $5,300 plus $50, or $5,300 plus credit monitoring services.

The deadline for objection to the settlement and exclusion is August 4, 2026. The deadline for submitting a claim is September 3, 2026, and the final approval hearing has been scheduled for September 3, 2026.

The post Okanogan Behavioral Healthcare Settles Class Action Data Breach Lawsuit appeared first on The HIPAA Journal.