Healthcare Cybersecurity

McCombs School of Business Offers Nation’s First Healthcare-Specific Professional Cybersecurity Certification Program

Posted by HIPAA Journal

The University of Texas at Austin McCombs School of Business has launched a unique healthcare-specific professional cybersecurity certificate program. The professional leadership and educational program is the first healthcare oriented cybersecurity certification program to be offered in the United States.

The Leadership in Healthcare Privacy and Security Risk Management program aligns with the NICE Cybersecurity Workforce Framework and will equip individuals with the knowledge and leadership skills they will need to effectively manage cyber risks faced by the healthcare industry.

Figures from the (ISC)² Global Information Security Workforce Study indicate the cybersecurity workforce gap is growing and there will be 1.8 million unfilled cybersecurity positions in 2022. The new certification program will help to address that shortfall in trained cybersecurity personnel, which is hampering many healthcare organizations’ efforts to address privacy and security risks.

The new course was developed in collaboration with the cybersecurity industry, healthcare privacy and security experts, and government agencies and is focused on risk management in the healthcare industry. The course aims to teach the necessary cybersecurity, risk assessment, and problem-solving skills to meet the needs of healthcare providers, vendors serving the healthcare industry, and government agencies.

The 8-week course will equip students with problem solving competencies and provide them with experience of healthcare security technologies through practical exercises and case studies. Tuition will be provided by experienced healthcare technology educators and cross-sector privacy and security experts. The course comprises of multiple thematic modules to provide students with core healthcare and privacy & security knowledge, processes to ensure organizational safety and security, policies and governance in healthcare entities, enterprise risk management and leadership in healthcare, along with practical applications of healthcare privacy and security.

The program will be constantly updated based on feedback from members of the privacy and cybersecurity industry on real-world cyber threats to ensure the program remains current and relevant.

The new program has been endorsed by the Texas Hospital Association, CynergisTek, and Clearwater Compliance. “What is unique about this curriculum is that they have integrated cybersecurity knowledge so that graduates of this program not only prepare themselves for a career in healthcare by learning practical skills, but they learn about where cybersecurity is important and why they need to understand it to be successful,” said Mac McMillan, co-founder and CEO of CynergisTek, Inc. “These are the type of visionary programs we need more of if we are going to close this gap in cybersecurity skills.”

The course is aimed at experienced professionals in cybersecurity, health IT, risk management, clinical professions, and information technology who are looking to move into non-technical leadership positions in healthcare privacy and security. The program will commence in July 2020.

The post McCombs School of Business Offers Nation’s First Healthcare-Specific Professional Cybersecurity Certification Program appeared first on HIPAA Journal.

Pulse Connect, GlobalProtect, Fortigate VPN Vulnerabilities Being Actively Exploited by APT Actors

Posted by HIPAA Journal

Vulnerabilities in popular VPN products from Pulse Secure, FortiGuard, and Palo Alto are being actively exploited by advanced persistent threat (APT) actors to gain access to vulnerable VPNs and internal networks.

The DHS’ Cybersecurity and Infrastructure Security Agency (CISA) and other cybersecurity agencies issued security advisories about multiple vulnerabilities in VPN products over the summer of 2019; however, many organizations have been slow to take action. Weaponized exploits for the vulnerabilities have now been developed and are being used by APT actors and exploit code is freely available online on GitHub and the Metasploit framework.

On October 1, 2019, the UK’s National Cyber Security Centre issued a warning about the vulnerabilities following several attacks on government agencies, the military, businesses, and the education and healthcare sectors. The National Security Agency (NSA) also issued a security advisory about the vulnerabilities along with mitigations on October 7.

The vulnerabilities are present in outdated versions of the Pulse Secure VPN (CVE-2019-11508 and CVE-2019-11538), the Palo Alto GlobalProtect VPN (CVE-2019-1579), and the Fortinet Fortigate VPN (CVE 2018-13379, CVE-2018-13382, CVE-2018-13383).

No mention was made about the APT actors responsible for the attacks, although there have been reports that the Chinese APT group APT5 has been conducting attacks on Pulse Secure and Fortinet VPNs.

The weaponized exploits allow APT actors to retrieve arbitrary files, including those containing authentication credentials. Those credentials can then be used to gain access to vulnerable VPNs, change configurations, remotely execute code, hijack encrypted traffic sessions, and connect to other network infrastructure.

The flaws are serious and require immediate action to prevent exploitation. The NSA security advisory urges all organizations using any of the above products to check to make sure they are running the latest versions of VPN operating systems and to upgrade immediately if they are not.

The NSA advisory also provides information on actions to take to check whether the flaws have already been exploited and steps to take if an attack is discovered. If a threat actor has already exploited one of the vulnerabilities and has obtained credentials, upgrading to the latest version of the OS will not prevent those credentials from being used.

The NSA therefore advises all entities running vulnerable VPN versions to reset credentials after the upgrade and before reconnection to the external network as a precaution, since it may be difficult to identify an historic attack from log files.

User, administrator, and service account credentials should be reset, and VPN server keys and certificates should be immediately revoked and regenerated. If a compromise is suspected, accounts should be reviewed to determine whether the attacker has created any new accounts.

The NSA has also provided recommendations for public-facing VPN deployment and long-term hardening controls.

The post Pulse Connect, GlobalProtect, Fortigate VPN Vulnerabilities Being Actively Exploited by APT Actors appeared first on HIPAA Journal.

An Internal Security Operations Center Cuts Data Breach Costs by More Than Half

Posted by HIPAA Journal

A recent survey conducted by B2B International on behalf of Kaspersky Lab has revealed the average cost of an enterprise-level data breach has risen to $1.41 million from $1.23 million in 2018.

The increased risk of a data breach and the increasing remediation costs has prompted enterprises to invest more heavily in cybersecurity. When the Kaspersky Global Corporate IT Security Risks Survey was last conducted in 2018, average IT security budgets were $8.9 million. In 2019, budgets had increased to an average of $18.9 million.

The biggest costs from a data breach were found to be damage to the company’s credit rating and increased insurance costs, followed by the cost of hiring external security consultants, loss of business, brand repair, additional wages for internal staff, compensation, and financial penalties and regulatory fines.

While there are several things enterprises can do to cut data breach costs, the appointment of a dedicated Data Protection Officer (DPO) and deploying an internal Security Operations Center (SOC) are the two most important for reducing cyberattack-related costs.

A DPO is responsible for creating and implementing a data protection strategy and monitoring and managing compliance issues. 34% of enterprises that had a dedicated DPO said security incidents at their company did not result in financial losses, compared to 20% of businesses overall.

The average data breach cost at an organization with an internal SOC was $675,000 – Less than half the cost of a breach at an organization without an internal SOC. The equivalent cost at large SMBs (500+ employees) was $129,000. With an internal SOC in place to monitor and respond to security incidents, the cost of a data breach was reduced to $106,000.

The survey revealed outsourcing security to managed service providers can result in increased data breach costs, at least for enterprises. 23% of businesses that used an MSP for security experienced data breach costs in the range of $100,000 to $249,000, compared to 19% of businesses with an in-house IT security team.

Appointing a DPO and setting up an internal SOC can help to reduce the likelihood of a data breach occurring, but it does not mean all data breaches will be prevented. With these key personnel in place, when a breach does occur the company will be prepared and will be able to respond quickly and efficiently, which will keep the costs to a minimum.

Recruiting a DPO, hiring staff for an internal SOC, and purchasing the necessary tools to support those personnel can be a time consuming and costly process, but the survey shows investment in key internal security personnel is certainly worthwhile and can significantly reduce the costs of data breaches. 61% of enterprises and SMBs in the United States are planning on increasing investment in specialized IT staff in the next 12 months.

The post An Internal Security Operations Center Cuts Data Breach Costs by More Than Half appeared first on HIPAA Journal.

Cybercriminals Switching from Business Email Compromise to Vendor Email Compromise Attacks

Posted by HIPAA Journal

The number of ransomware attacks in the United States has increased sharply in 2019, but business email compromise (BEC) attacks have similarly increased. Symantec found an average of 6,029 businesses were targeted by BEC emails in the past 12 months and figures from the FBI indicate attacked entities lost $1,297,803,489 to the scams in 2018.

BEC attacks involve gaining access to business email accounts and using them for further attacks on the organization. Some BEC attacks are concerned with obtaining sensitive data such as W-2 forms for use in tax fraud, although mostly the attackers attempt to use the accounts to arrange fraudulent wire transfers. Access is gained to the CEO or other executives’ email accounts and messages are sent to the payroll department to reroute payments or to request wire transfers to attacker-controlled accounts.

This week, Agari has published details of new research that reveals a new BEC attack trend: Vendor email compromise attacks.  As with other types of BEC attacks, they involve highly realistic emails requesting payment of invoices, but the victim of the attack is not the company whose email accounts have been compromised. Those accounts are used to attack the company’s customers.

The vendor email compromise attacks start with a spear phishing email targeting the CEO or CFO. Once credentials have been obtained, the account is accessed, and mail forwarding rules are added. A copy of every received and sent email is then forwarded to the attacker, unbeknown to the account holder.

Over a period of weeks or months, the emails are studied and the attackers learn about customer billing cycles and typical invoice amounts. The attackers study the format of the emails, obtain the relevant logos, and use this information to create highly realistic fake invoices for the right amount at the right time.

The invoice requests are sent just a few days before payment would usually be made. The only thing that distinguishes a genuine and fraudulent request is a change to the usual bank account.

The attacks are often conducted on small to medium sized businesses such as those that provide materials or services to larger companies.  Each compromised email account could be used to send fraudulent invoices to many of the company’s customers, increasing the potential payout. The incredibly realistic requests are also less likely to arouse suspicion. “The context, the timing, the communication from the supposed vendor, the invoice itself – all look completely legitimate… that’s why this type of attack is extremely effective,” explained Agari.

These attacks are difficult for employees to identify as all the typical signs of fraudulent emails are lacking. There are no spelling mistakes, the grammar is perfect, and the emails are sent from genuine – not spoofed – email accounts.

Agari has been tracking the activity of one cybercriminal gang that is using this new tactic. The group, which Agari calls Silent Starling, has conducted more than 500 known attacks since the start of 2018 which have involved around 700 compromised employee email accounts. Many other cybercriminal gangs are using the same tactics.

“We expect VEC to be the largest threat for organizations worldwide over the course of the next 12-18 months,” warned Agari. “As cybercriminals evolve this attack modality, these scams will proliferate.”

The post Cybercriminals Switching from Business Email Compromise to Vendor Email Compromise Attacks appeared first on HIPAA Journal.

FBI Issues Updated Ransomware Guidance: Extent of U.S. Ransomware Epidemic Revealed

Posted by HIPAA Journal

A recent report from New Zealand-based cybersecurity firm Emsisoft has revealed the extent to which ransomware is being used to attack government entities, healthcare organizations and school districts in the United States. In the first 9 months of 2019, the firm has identified 621 reported ransomware attacks in the United States.

Ransomware attacks can have devastating consequences. This week, a healthcare provider announced that it will be permanently closing its doors as a result of a ransomware attack due to extensive damage to its systems and the permanent loss of patient data. This is the second healthcare provider known to have been forced out of business due to a ransomware attack this year.

Even when recovery is possible – by paying the ransom or restoring files from backups – the attacks cause major disruption and result in substantial losses. A ransomware attack on DCH health system forced its three hospitals to temporarily close to all but critical patients while systems were restored. Attacks on municipalities have resulted in essential services grinding to a halt, police departments have lost access to records systems, and schools have been forced to send children home and, in one case, delay the start of the school year.

The cost of the attacks is considerable. Lake City in Florida paid a ransom demand of $460,000 and Riviera Beach in Florida paid $600,000 for the keys to unlock the encryption. Those payments were high, but they are just a fraction of the total cost of the attack.

If the decision is taken not to pay the attackers, the costs can be considerably higher. The city of Baltimore was issued with a ransom demand of $76,000 which it refused to pay. The cost of mitigating the attack has been estimated at $18.2 million. The costs may even be higher still. Last month, the Danish hearing aid manufacturer Demant experienced a suspected ransomware attack and recently told its investors that the bill is likely to be between $80 million and $95 million.

When attacks take place, it may be possible to restore files without paying a ransom. Emsisoft has developed workarounds for certain types of ransomware attack and free decryptors are available for some ransomware variants through the NoMoreRansom project. However, in most cases attacked entities only have three choices: Accept file loss, restore files from backups, or pay the ransom.

FBI Updates its Ransowmare Guidance

The recent attacks have prompted the FBI’s Internet Crime Complaint Center (IC3) to update its advice on ransomware. The FBI has long maintained the view that paying a ransom is never advisable. The attackers may not hold valid keys to unlock the encryption or may choose not to supply them and issue further demands after an initial payment is made.

Data can be corrupted during the encryption process which may make it impossible to recover some or all of the encrypted data. The FBI also says, “Paying ransoms emboldens criminals to target other organizations and provides an alluring and lucrative enterprise to other criminals.”

That said, the latest ransomware guidance has seen the FBI slightly soften its stance on paying ransoms, saying “the FBI understands that when businesses are faced with an inability to function, executives will evaluate all options to protect their shareholders, employees, and customers.” In some cases, paying the ransom demand may be the best option.

What the recent attacks have clearly demonstrated is that it is essential to ensure that valid backups of all critical data are made to keep attacked entities’ options open. It is no use creating backups and storing them on networked devices, as those backups are likely to also be encrypted. Multiple backup copies should be created and at least one backup copy should be stored on a non-networked device that is not connected to the internet. It is also essential to test backups to make sure files can be recovered in the event of disaster. If backups are corrupted, paying the ransom may be the only option.

The post FBI Issues Updated Ransomware Guidance: Extent of U.S. Ransomware Epidemic Revealed appeared first on HIPAA Journal.

URGENT/11 Cybersecurity Vulnerabilities in Medical Devices Prompt FDA Warning

Posted by HIPAA Journal

Security researchers at Armis have identified 11 vulnerabilities in the Interpeak IPnet TCP/IP Stack, a third-party software component used in hospital networks and certain medical devices.

The vulnerabilities were reported to the DHS Cybersecurity and Infrastructure Security Agency (CISA) prompting an ICE medical advisory and a Food and Drug Administration (FDA) Safety Communication warning patients, healthcare providers, facility staff and manufacturers about the flaws.

The FDA alert – named URGENT/11 – explains that the vulnerabilities could be remotely exploited by a threat actor allowing full control to be taken of a vulnerable medical device. An attacker could change the functions of the device, access sensitive information, cause logical flaws or denial of service attack that could stop the device from working.

While there have been no reports of the flaws being exploited in the wild, the FDA warns that the software required to exploit the flaws is publicly available.

Interpeak IPnet TCP/IP Stack supports network communications between computers, and while it is no longer supported by the original developer, some device manufactures are licensed to use the component in their software applications, systems, and equipment without support.

The FDA warns that the vulnerable component is in use in some versions of the following operating systems:

  • VxWorks (by Wind River)
  • Operating System Embedded (OSE) (by ENEA)
  • INTEGRITY (by Green Hills)
  • ThreadX (by Microsoft)
  • ITRON (by TRON Forum)
  • ZebOS (by IP Infusion)

Certain Beckton Dickinson (BD), Drager, GE Healthcare, Philips Healthcare, and Spacelabs products are also affected by the flaws. Each of those companies has released security advisories about the affected products.

WindRiver holds the license for IPnet and has released patches to mitigate the vulnerabilities. If it is not possible to upgrade to the latest version of the OSE, other mitigating controls can be implemented to reduce the risk of exploitation. WindRiver should be contacted for details of possible compensating controls.

The flaws are detailed in the ICS-CERT Medical Advisory (ICSMA-19-274-01). The FDA has released recommendations for device manufacturers, healthcare providers, healthcare facility staff, patients and caregivers, which can be viewed on this link.

Healthcare providers have been advised to work with their device manufacturers to determine which devices are vulnerable and find out about the steps that need to be taken to secure the devices. They have also been advised to inform patients using vulnerable devices to immediately report any suspected operational or functional changes to their medical devices.

9 of the vulnerabilities are classed as high severity with a CVSS v3 score of between 7.0 and 10, three of which have a score of 9.8. In order of severity, the CVE numbers are: CVE-2019-12256, CVE-2019-12255, CVE-2019-12260, CVE-2019-12257, CVE-2019-12261, CVE-2019-12263, CVE-2019-12258, CVE-2019-12259, CVE-2019-12262, CVE-2019-12264, and CVE-2019-12265.

The post URGENT/11 Cybersecurity Vulnerabilities in Medical Devices Prompt FDA Warning appeared first on HIPAA Journal.

Sen. Rand Paul Introduces National Patient Identifier Repeal Act

Posted by HIPAA Journal

Sen. Rand Paul, M.D., (R-Kentucky) has introduced a new bill that attempts to have the national patient identifier provision of HIPAA permanently removed due to privacy concerns over the implementation of such a system.

Today, HIPAA is best known for its healthcare data privacy and security regulations, but the national patient identifier system was proposed in the original HIPAA legislation of 1996 as a measure to facilitate data sharing and help reduce wastage in healthcare.

The provision called for the HHS to “adopt standards providing for a standard unique health identifier for each individual, employer, health plan, and healthcare provider for use in the health care system.” However, in 1998, former Congressman Ron Paul (R-Texas), Sen. Rand Paul’s father, introduced a proposal which called for a ban on funding the development and implementation of such a system. The ban was introduced into the Congressional budget for 1999 and has been written into all Congressional budgets ever since.

This year there was hope that the ban would finally be removed following a June amendment to the House of Representative’s appropriation bill for fiscal year 2020. The amendment received strong bipartisan support and it was hoped that the Senate would follow the House’s lead and have the ban finally lifted. However, on September 18, 2019, the Senate appropriations subcommittee’s proposed budget bill for fiscal year 2020 included the same language as previous years and, as it stands, the ban looks set to remain in place for at least another year.

Sen. Rand Paul’s National Patient Identifier Repeal Act seeks to repeal the HIPAA provision, which Sen Paul believes will place the privacy of Americans at risk. He considers the provision to be dangerous, as it would allow a government-issued ID number to be linked with the private medical histories of every man, woman, and child in America.

It is for the very same reason that dozens of healthcare industry stakeholder groups want the national patient identifier introduced, as without such an identifier, it is difficult to accurately match medical records with the correct patient. Those seeking to have the ban lifted believe it will improve the accuracy of health information exchange and improve security and patient safety.

Sen. Paul disagrees, as he believes the potential privacy risks are too great. “As a physician, I know firsthand how the doctor-patient relationship relies on trust and privacy, which will be thrown into jeopardy by a national patient ID,” explained Sen. Paul. “Considering how unfortunately familiar our world has become with devastating security breaches and the dangers of the growing surveillance state, it is simply unacceptable for government to centralize some of Americans’ most personal information.”

Industry associations such as the College of Healthcare Information Management Executives (CHIME) have stepped up efforts to have the ban lifted due to the difficulties matching medical records with patients.

CHIME CEO, Russ Branzell explained that Congress has already approved a healthcare identifier for Medicare beneficiaries, but a national identifier is also required. “The patient identification conversation is one about saving lives and unlocking the potential for technology to revolutionize healthcare while cutting costs.” He has called Sen. Paul’s views on the national patient identifier “antiquated and from some bygone era.”

While many industry associations share Branzell’s view, Sen. Paul’s bill has received support from certain privacy advocacy groups, including the Citizen’s Council for Health Freedom. Advocates of the removal of the HIPAA provision believes the centralization of patient information would greatly increase the risk of security breaches and could allow hackers to steal individuals’ lifelong healthcare records and such a system would allow unprecedented tracking of Americans through their healthcare records.

The post Sen. Rand Paul Introduces National Patient Identifier Repeal Act appeared first on HIPAA Journal.

Senator Demands Answers Over Exposure of Medical Images in Unsecured PACS

Posted by HIPAA Journal

Sen. Mark Warner (D-Virginia) has written to TridentUSA demanding answers about a breach of sensitive medical images at one of its affiliates, MobileXUSA.

Sen. Warner is the co-founder of the Senate Cybersecurity Caucus, which was set up as bipartisan educational resource to help the Senate engage more effectively on cybersecurity policy issues. As part of the SCC’s efforts to improve cybersecurity in healthcare, in June Sen. Warner asked NIST to develop a secure file sharing framework and wrote to healthcare stakeholder groups in February requesting they share best practices and the methods they used to reduce cybersecurity risk and improve healthcare data security.

The latest letter was sent a few days after ProPublica published a report of an investigation into unsecured Picture Archiving and Communications Systems (PACS). PACS are used by hospitals and other healthcare organizations for viewing, storing, processing, and transmitting medical images such as MRIs, CT scans, and X-Rays. The report revealed more than 303 medical images of approximately 5 million Americans had been left exposed on the Internet due to PACS security failures. Those medical images were stored on 187 U.S. servers, including those used by MobileXUSA.

In the letter, Sen. Warner said “It appears that the information held by MobileXUSA was made accessible due to sloppy cybersecurity practices – no software vulnerabilities were involved, and no explicit hacking was required [to access the images].”

Sen. Warner said HIPAA requires security controls to be applied to keep sensitive data protected, including medial images stored in PACS, and that both TridentUSA and MobileXUSA have a duty under HIPAA to ensure their PACS are not publicly accessible and that proper controls are applied to prevent unauthorized access and data theft.

By October 9, 2019, Sen. Warner requires answers to questions about the cybersecurity practices at both companies to determine how medical images in the PACS were exposed and why the lack of security protections was not detected internally.

Specifically, Sen Warner wants to know about the audit and monitoring tools employed to analyze its HIPAA-mandated audit trails, whether systems that access the PACS and DICOM images comply with current standards and use access management controls, what identify and access management controls are applied for IP-addresses and port filters, if a VPN or SSL is required to communicate with the PACS, the frequency of vulnerability scans and internal HIPAA compliance audits, what server encryption processes are in use, and whether the companies have an internal security team or if security is outsourced.

PACS and the DICOM image format have been designed to facilitate the sharing of medical images within an organization and with authorized third parties, but it is the responsibility of each organization to ensure that those systems are secured to protect patient privacy.

Healthcare organizations can face many challenges securing their PACS without negatively impacting workflows. To help healthcare organizations secure their systems, NCCoE has recently released new NIST guidance for healthcare providers to help them secure the PACS ecosystem.

The post Senator Demands Answers Over Exposure of Medical Images in Unsecured PACS appeared first on HIPAA Journal.

IT Departments Slow to Modify and Block Access Rights When Employees Change Roles or Leave the Company

Posted by HIPAA Journal

A recent survey of IT professionals, conducted by IT firm Ivanti, has revealed access rights to digital resources are not always terminated promptly when employees change roles or leave the company. The latter is especially concerning as there is a high risk of data theft and sabotage of company systems by former employees. There have been many reported cases of former employees taking sensitive data to new employers and conducting malicious acts in cases of termination.

The survey was conducted online in the summer of 2019 on 400 individuals, 70% of whom were IT professionals. Questions were asked about setting up permissions for new employees, modifying access rights when roles change, and terminating access rights to company resources when employees are terminated, contracts end, or employees find alternative employment.

The respondents came from a broad range of industries including healthcare. 27% of respondents said they were required to comply with the Health Insurance Portability and Accountability Act (HIPAA), 25% were required to comply with the EU’s General Data Protection Regulation (GDPR), and 23% had to comply with the Sarbanes-Oxley Act (SOX)

While policies and procedures have been established to cover the entire process, the survey revealed issues onboarding new employees, modifying permissions, and terminating access rights.

85% of employees said they did not have access to all the resources they needed to complete their job duties when they first joined the company. Surveyed IT professionals confirmed that to be the case, with 38% saying it takes an average of 2-4 days to fully onboard new starters and 27% said it takes more than a week.

From a security and compliance perspective, modifying access rights to resources is of far greater importance but even though legislation such as HIPAA calls for prompt changes to be made to prevent unauthorized data access, access right changes are slow to be applied, if they are applied at all.

Only 55% of respondents were confident that access to unnecessary resources was removed when an employee’s role in the organization changed. 26% of IT professionals said it typically takes over a week to fully deprovision employees when they leave the company and only half of surveyed IT professionals were confident that access to critical systems and data had been blocked for the most recent employee to leave the company. When asked if they knew someone who still had access to a former employer’s systems or data, 52% said yes.

The biggest perceived risks of failing to fully deprovision a former employee were sensitive data leakage (38%), cyberattacks through an unmanaged account (26%), and malicious data theft (24%).

When asked about the reasons for the onboarding, amending, and offboarding issues, the main issue was poorly defined processes, cited as a problem by 24% of surveyed IT professionals. 23% said there were issues with automation and 10% said it was due to a lack of resources. More than half of IT professionals (54%) had to make changes manually, 37% used some automation, and just 9% said processes were fully automated and were applied as soon as HR makes a change.

Unless job roles and permissions are well defined and procedures properly documented, issues will occur and without a high degree of automation, there are bound to be delays offboarding employees, even though the delays expose companies to considerable risk and potential fines for noncompliance.

The post IT Departments Slow to Modify and Block Access Rights When Employees Change Roles or Leave the Company appeared first on HIPAA Journal.