Healthcare Cybersecurity

AHA: Law Enforcement Needs Resources to Help Prevent Healthcare Cyberattacks

Posted by HIPAA Journal

The American Hospital Association (AHA) has urged congress to provide law enforcement agencies with appropriate resources to help with the prevention of healthcare industry cyberattacks and assist with investigations into attacks.

The AHA provided a statement for an AHA House Energy and Commerce Subcommittee on Oversight and Investigations hearing on public-private partnerships for healthcare cybersecurity. In the statement the AHA praising the efforts made by hospitals and health systems to improve data security and prevent cyberattacks.

The AHA explained that the vast majority of hospitals and health systems take the current cybersecurity challenges very seriously and have responded by investing heavily in cybersecurity protections to prevent cybercriminals from gaining access to networks and sensitive data.

The AHA said those efforts include the use of encryption to prevent the theft of PHI, making and testing data backups, conducting annual threat assessments and identifying potential vulnerabilities with extensive penetration testing. Hospitals and health systems are also increasingly conducting tabletop exercises and simulations to assess their disaster recovery and breach response plans.

A recent survey conducted on AHA members confirmed that 80% of hospitals have now implemented intrusion detection systems. 80% of hospitals also now use encryption on their wireless networks, removable media, and mobile devices. More than 90% of hospitals ensure pass codes are required to access mobile devices and have implemented policies that require the use of strong passwords. 90% of hospitals also conduct annual risk analyses and infrastructure security assessments.

However, even with these precautions, healthcare cyberattacks are inevitable and occasionally they will succeed. The AHA explains that collaboration is needed to tackle the threat. Many hospitals and health systems are now participating in threat intelligence sharing on a national level, via private sector programs such as those run by the Healthcare and Public Health Information Sharing and Analysis Center (NH-ISAC) and Health Information Trust Alliance (HITRUST).

The AHA explained that those information sharing programs have been effective and should receive continued support to ensure they can develop and provide actionable information and tools to assist the healthcare industry prevent cyberattacks. However, further work is required in this area.

Healthcare organizations need to be provided with more actionable information on the latest cybersecurity threats. They need to be advised of the steps they need to take to secure their networks against new threats. At present, healthcare organizations are being given large volumes of generalized information, which can be difficult to interpret. Without tailored cyber threat information, it is very easy for healthcare organizations to get distracted and suffer information overload.

The AHA also points out that the healthcare industry is heavily regulated and healthcare organizations are required to comply with the HIPAA Security Rule. The HIPAA Security Rule requires covered entities to implement a range of measures to safeguard protected health information.

The AHA says that even when healthcare organizations implement best practices and comply with HIPAA Rules, cyberattacks may still occur. However, it was pointed out that data breaches and cyberattacks do not necessarily mean that HIPAA Rules have been violated. Healthcare organizations should therefore receive appropriate assistance and should not be blamed when attacks succeed and neither should they be presumed to be at fault.

Help should be provided with the investigation of breaches and any lessons that are learned should be shared with other healthcare organizations to prevent others from falling victim to similar attacks. The AHA says the victims of these attacks should be given appropriate support and resources, while the attackers should be identified and prosecuted.

The AHA says Congress should also ensure that law enforcement and other agencies get the resources they need to help prevent healthcare cyberattacks and to thoroughly investigate attacks when they do occur.

The post AHA: Law Enforcement Needs Resources to Help Prevent Healthcare Cyberattacks appeared first on HIPAA Journal.

Healthcare Organizations Warned of Risk of Man-In-The-Middle Attacks

Posted by HIPAA Journal

In its April cybersecurity newsletter, the Department of Health and Human Services’ Office for Civil Rights advised covered entities and their business associates to use the Secure Hypertext Transport Protocol (HTTPS) to ensure protected health information is not left unsecured.

While HTTPS has been adopted by many covered entities to protect communications from man-in-the-middle attacks, OCR has relayed a recent warning from the United States Computer Emergency Readiness Team (US-CERT) about vulnerabilities that may be introduced by the use of products that inspect HTTPS traffic.

The use of HTTPS inspection products increases security as it allows healthcare providers to detect malware and unsafe connections. Unsafe connections could potentially result in communications being intercepted, data being accessed or manipulated, or malicious code being run. However, OCR warns that certain HTTPS inspection products fail to correctly verify web servers’ certificates or do not pass on error messages and warnings to clients.

In order for HTTPS inspection to occur, network traffic must be decrypted, inspected, and then re-encrypted. To do that the HTTPS inspection product must install trusted certificates on clients’ devices to avoid triggering warnings. However, this could potentially mean the healthcare organization would be unable to verify web servers’ certificates. It would be possible to verify the connection between the healthcare organization and its inspection tool, but not between the healthcare organization and the web server. Some HTTPS inspection products do not allow verification of the entire certificate chain.

If the full certification chain is not properly verified, an organization could be exposed to man-in-the-middle attacks. OCR advises covered entities to follow the advice of US-CERT and verify that their HTTPS inspection product properly validates certificate chains and passes any warnings on to clients. They should also ensure that any HTTPS inspection product is properly installed, otherwise it may decrease security and introduce new vulnerabilities.

The HIPAA Security Rule requires covered entities to conduct regular risk analyses. OCR points out that HTTPS inspection tools should be included in those risk analyses and covered entities should weigh up the advantages and disadvantages of using those products.

Covered entities are advised to refer to NIST publications on securing end-to-end communications, in particular with regards to the configuration and use of TSL/SSL implementations and encryption processes to secure electronically transmitted PHI.

US-CERT offers advice to healthcare organizations on how they can reduce the risk of man-in-the-middle attacks and suggests organizations should:

  • Update Transport Layer Security and Secure Socket Layer (TLS/SSL) to TLS 1.1 or higher and ensure SSL 1,2 and 3.x are disabled.
  • Utilize Certificate Pinning
  • Implement DNS-based Authentication of Named Entities (DANE)
  • Use Network Notary Servers

The post Healthcare Organizations Warned of Risk of Man-In-The-Middle Attacks appeared first on HIPAA Journal.

Small Business Cybersecurity Bill Heads to Senate

Posted by HIPAA Journal

New legislation to help small businesses protect their data and digital assets has been approved by the Senate Commerce, Science and Transportation Committee this week. The new bill, which was introduced by Sen. Brian Schatz (D-Hawaii) last week, will now head to the U.S Senate.

The legislation – the MAIN STREET (Making Information Available Now to Strengthen Trust and Resilience and Enhance Enterprise Technology) Cybersecurity Act will require the National Institute of Standards and Technology (NIST) to develop new guidance specifically for small businesses to help them protect themselves against cyberattacks.

New NIST guidance should include basic cybersecurity measures that can be adopted to improve resilience against cyberattacks and mitigate basic security risks.

Guidance and security frameworks have been developed by NIST to help larger organizations protect their assets and data, although for smaller businesses with limited knowledge of cybersecurity and a lack of trained staff and resources they can be difficult to adopt.

What is needed is specific guidance for small businesses that can easily be adopted to improve cybersecurity defences. If the new legislation is passed, NIST would be required to develop simplified guidance specifically tailored to the needs of small businesses.

Many small business owners do not believe they are at risk because of the size of their organization. Yet, breaches at small to mid-sized businesses are all too common. In the past two years, cyberattacks on small businesses have significantly increased.

A 2016 survey conducted by Keeper Security – 2016 State of SMB Cybersecurity – suggests half of small businesses experienced a breach in the past 12 months. The main threats are phishing and social engineering attacks on employees, although the survey revealed numerous vulnerabilities exist which could all too easily be exploited by cybercriminals.  The survey, which was conducted on 600 SMB IT leaders revealed only 14% of those businesses had cybersecurity defenses that were considered to be very effective.

When it comes to preventing cyberattacks and improving cybersecurity defenses many small businesses – including small healthcare organization – do not know where to start. Many small businesses do not have a dedicated IT person and are unaware of what is required to prevent cyberattacks. Cybersecurity guidance is sorely needed.

If passed, the new legislation would require NIST to suggest commonly used, off-the-shelf products that can be easily implemented in a cost-effective manner to mitigate common cybersecurity risks.

Sen. Maria Cantwell, D-Wash, one of the bill’s five sponsors, said “By creating a simple, voluntary cybersecurity framework for small businesses, the Main Street Cybersecurity Act will help them protect their data.”

The post Small Business Cybersecurity Bill Heads to Senate appeared first on HIPAA Journal.

Congress Advised to Offer Incentives to Improve Healthcare Threat Intelligence Sharing

Posted by HIPAA Journal

With the healthcare industry under a sustained attack and the cyber threat landscape constantly evolving, law enforcement, the government, and private industry need to collaborate to counter the threat of cyberattacks. Cybercrime cannot be effectively tackled by organizations acting in isolation.

The sharing of threat information is essential in the fight against cybercrime. Dissemination of this information makes it easier for law enforcement and government agencies to combat cybercrime. Accessing that information also allows healthcare entities to to take timely action to address vulnerabilities before they are exploited.

Government and law enforcement agencies are educating healthcare organizations on the importance of sharing threat intelligence, although currently too few entities are sharing threat information.

At a Congressional Energy and Commerce Committee hearing this week, cybersecurity experts made suggestions on how congress can improve threat information sharing and improve healthcare cybersecurity.

At the hearing, Denise Anderson, president of the National Health Information Sharing and Analysis Center (NH-ISAC), explained that failing to take action to combat cybersecurity threats is putting patient safety at risk. In some cases, this could be a life or death matter for affected patients.

Ransomware can prevent patients’ health records from being accessed by healthcare providers; however, Anderson explained that data manipulation could be an even bigger problem. If cybercriminals were to change medical records, they could then demand a ransom from the healthcare provider to divulge which records had been changed. Data manipulation could result in patients being incorrectly diagnosed or provided with the wrong medications. That could have fatal consequences.

The healthcare industry has many small to medium-sized healthcare organizations that lack the capital and resources to deal with cybersecurity issues. They cannot keep up with the practices that are required to keep patients’ data secured. Many are faced with a choice – purchase essential medical equipment or a new cybersecurity tool. There is little incentive to choose the latter.

Cybersecurity Incidents Often Go Unreported

The number of cybersecurity threats has increased significantly in recent years, as has the number of reported healthcare data breaches, yet those reported breaches are just a fraction of the security incidents that are now plaguing the healthcare industry. Many cybersecurity threats and security incidents go unreported.

Evidence gathered from normal security monitoring suggests there are far more breaches occurring than current data breach reports suggest. Terry Rice, vice president of IT risk management and chief information security officer at Merc, suggested that while laws are in place that require healthcare organizations to report security incidents, current disclosure laws have limited requirements for reporting incidents and many organizations are not submitting or delaying incident reports.

Threat Information Sharing is Critical

While it is important for further efforts to be made to educate the healthcare industry on the importance of sharing threat information, education alone is unlikely to solve the problem. Sharing threat information carries a cost that many small healthcare providers simply cannot afford.

Anderson suggests that while there are clear benefits to participating in information sharing efforts, threat intelligence sharing should not be mandatory. Healthcare organizations should be given a choice. However, healthcare organizations can be encouraged to share information if they are offered financial incentives for doing so.

She also suggested ISACs should be offered tax breaks, that information shared through ISACs should be protected, and that organizations that share threat intelligence should be provided with better legal protections.

Congress was also advised to create permanent cybersecurity liaisons and leaders. Those individuals should be experienced cybersecurity professionals that are aware of the threats, vulnerabilities and cybersecurity issues faced by the healthcare industry.

Michael McNeil, global product security and services officer for Royal Phillips pointed out that cyberattacks on medical devices pose a serious threat to patients and potentially place patients’ lives at risk.

He suggested medical device manufacturers should be included in conversations about cybersecurity and should ensure security is considered at every stage of the manufacturing process. Device manufacturers must also address cybersecurity issues at every stage of the product lifecycle, not just until their devices come to market.

Device manufacturers also need to collaborate and agree to a set of standards that can be adopted to improve cybersecurity. There should be regulatory requirements covering cybersecurity for device manufacturers.

The post Congress Advised to Offer Incentives to Improve Healthcare Threat Intelligence Sharing appeared first on HIPAA Journal.

Large Hospitals and Teaching-Focused Hospitals Face Greater Risk of Data Breaches

Posted by HIPAA Journal

A study recently published in JAMA Internal Medicine examined recent healthcare data breach trends to determine which types of hospitals are the most susceptible to data breaches.

The researchers analyzed breach reports submitted to the Department of Health and Human Services’ Office for Civil Rights between October 21, 2009 and December 31, 2016. During that time, 216 hospitals reported 257 breaches of more than 500 patient records.

33 hospitals experienced more than one data breach during that time frame. Four hospitals – Brigham and Women’s Hospital, Cook County Health & Hospitals System, Mount Sinai Medical Center and St. Vincent Hospital and Healthcare Inc – experienced three data breaches. Two hospitals – Montefiore Medical Center and University of Rochester Medical Center & Affiliates – experienced four data breaches.

The researchers determined the size of the acute care hospitals by linking the facilities to their Medicare cost reports submitted to the Centers for Medicare and Medicaid Services in the 2014 fiscal year. 141 acute care hospitals were linked to CMS cost reports. Unlinked hospitals included those run by the Department of Veteran Affairs and military hospitals and long term care hospitals.

The study revealed that larger hospitals were statistically more likely to experience a data breach. More than one third of hospitals (37%) that had experienced a data breach are classed as major teaching hospitals.

Linked hospitals had a median of 262 beds, while an analysis of 2852 acute care hospitals that had not reported a data breach had a median of 134 beds. 265 (9%) of those unbreached hospitals were major teaching hospitals.

The researchers found that both the size of hospitals and their teaching status were positively associated with the risk of experiencing data breaches.

The researchers used multivariable and regression analyses to compare the 141 linked acute care hospitals with other hospitals to determine why they faced a higher risk of experiencing data breaches.

The researchers suggest the reason why larger hospitals and teaching hospitals experience more data breaches is due to having broader access to sensitive patient data. The more individuals who require access to data, the greater the risk of data breaches occurring. The report suggests “There is a fundamental trade-off between data security and data access.” When data are made available to a greater number of individuals for research and education purposes it makes “zero breach” an extremely challenging objective.

While investment in information technology such as EHRs has certainly made hospitals more efficient and has improved the provision of care to patients, it has also made security and privacy breaches more likely.

While many hospitals have invested heavily in cybersecurity defenses to reduce the risk of data breaches, the breach reports submitted to the Department of Health and Human Services’ Office for Civil Rights clearly show that healthcare data breaches are increasing in frequency.

The fast-evolving threat landscape requires hospitals to invest in cybersecurity defenses to mitigate data breach risk and hospitals must continuously evaluate data security risks and apply best data security practices to prevent breaches from occurring; however, it is difficult for hospitals to determine which technologies and best practices are the most effective at preventing data breaches.

Lead author of the study, Ge Bai, an assistant professor at John Hopkins Business School said, “More research is needed to identify effective and evidence-based data security practices to guide hospitals’ risk management efforts.”

The post Large Hospitals and Teaching-Focused Hospitals Face Greater Risk of Data Breaches appeared first on HIPAA Journal.

Dr. Donald Rucker Named New National Coordinator for Health IT

Posted by HIPAA Journal

Dr. Donald Rucker has been named as the new National Coordinator of the Department of Health and Human Services’ Office of the National Coordinator for Healthcare Information Technology.

Nether the Department of Health and Human Services nor the Office of the National Coordinator for Healthcare Information Technology has officially announced the new appointment, although Dr. Donald Rucker’s name now appears in the HHS directory as National Coordinator.

Donald Rucker will replace acting National Coordinator, Jon White, M.D., who took over the position following the resignation of Dr. Vindell Washington in January 2016. White is expected to return to his former position as deputy national coordinator.

Prior to joining the ONC, Donald Rucker was an adjunct professor at the Department of Biomedical Informatics at Ohio State University’s College of Medicine. Prior to that appointment, Rucker was Chief Medical Officer at Premise Health for a year and CMO at Siemens Healthcare USA for 13 years.

While at Siemens Healthcare USA, Rucker led the team that designed the computerized physician order entry workflow that won the 2003 HIMSS Nicholas Davies Award for the best hospital computer system in the United States.

Donald Rucker has previously served as Clinical Assistant Professor of Emergency Medicine at the University of Pennsylvania Health System and as an Emergency Department Physician at Beth Deaconess Medical Center in Boston. Rucker has also practiced emergency medicine at Kaiser Permanente in California and at University of Pennsylvania’s Penn Presbyterian and Pennsylvania Hospitals. Rucker also worked at Datamedic in 1988 where he co-developed the first Windows-based electronic medical record system.

Donald Rucker graduated in Chemistry at Harvard University and medicine at the University of Pennsylvania School of Medicine, and also holds an MBA and a Masters in Medical Computer Science from Stanford University

This will be Dr. Rucker’s first government position.

The post Dr. Donald Rucker Named New National Coordinator for Health IT appeared first on HIPAA Journal.

IBM Report Shows Cybercriminals Have Switched Focus from Healthcare to the Financial Services

Posted by HIPAA Journal

IBM has released its 2017 IBM X-Force Threat Intelligence Index: An analysis of a particularly bad year for data breaches, cyberattacks, malware, and ransomware.

2015 may have been the year of ‘the mega data breach’ for the healthcare industry, although IBM gives 2016 that title. 2016 saw record-breaking numbers of records exposed across all industry sectors and some of the largest data breaches ever discovered.

While healthcare was the most targeted industry in 2015, in 2016 it was the financial services sector that claimed that unenviable title.

Across all industry sectors there was a 566% jump in compromised records in 2016, increasing from around 600 million records to more than 4 billion, with the breach at Yahoo accounting for 1.5 million of those. The total number of exposed or stolen reports in 2016 was more than the combined totals for 2014 and 2015.

Ransomware infections increased sharply in 2016. In the first quarter of the year, ransomware had raked in an estimated $209 million in payments. DDoS attacks also went big in 2016 as new botnets were developed. While DDoS attacks in excess of 300+ Gbps were a rarity in 2015, in 2016 they became the new norm. One attack on a French hosting company registered a colossal 1 Tbps.

2016 also saw record numbers of vulnerabilities disclosed, many of which were exploited. IBM recorded 10,197 disclosed vulnerabilities in 2016, the highest figure of any year since IBM started tracking vulnerabilities.

While the healthcare dropped out of the five most targeted industries, it does not mean the healthcare industry fared particularly well. There were more reported healthcare data breaches in 2016 than in any other year to date. IBM calculated there was an 88% fall in exposed or stolen healthcare records compared to the previous year. The mega healthcare data breaches of the year before did not occur, but there was an increase in smaller data breaches.

The percentage of healthcare data beaches caused by outsiders fell in 2015. Outsiders accounted for 29% of reported data breaches; however, attacks by malicious insiders and inadvertent actors were both up, accounting for 25% and 46% of attacks respectively. Inadvertent actors included systems compromised in phishing attacks, clickjacking, and infections via malicious email attachments.

The industry had the greatest percentage of insider attacks compared to attacks by outsiders out of the top five attacked industries. The reason provided by IBM was the healthcare industry is more susceptible than other industries to phishing attacks.

IBM reports that the majority of attacks on the healthcare industry involved SQLi and OS CMDi, which combined accounted for almost half of attacks (48%). This was followed by attacks classed by IBM as ‘Manipulate System Resources.’ Image File attacks were also popular with cybercriminals, accounting for 28% of attacks. These attacks involve the sending of malicious image files via spam email. The files contain malicious code that runs when the file is opened. Brute force attacks used against authentication mechanisms was the fourth most common attack method, accounting for 6% of attacks.

IBM notes in its report that spam email volume increased in 2016, with a major rise in spam email messages with malicious attachments.

As 2016 started, exploit kits were the method of attack of choice for many cybercriminals. Exploit kits are used to probe for security vulnerabilities that can be exploited to silently download malware and ransomware. As the year progressed exploit kit activity fell significantly. Cybercriminals turned to spam email as the malware and ransomware distribution method of choice. As exploit kit activity fell, spam email volume increased.

Spam email volume started to rise from around May 2016 reaching the highest level of the past two years by December. The volume of spam emails containing malicious email attachments also continued to increase steadily from the spring, with the highest percentages recorded in December.

Given the extent to which healthcare organizations are being targeted by cybercriminals and bombarded with spam, IBM suggests organizations should ensure they are applying security fundamentals, are learning best practices, studying threat intelligence reports and sharing their attack experiences and findings.

The post IBM Report Shows Cybercriminals Have Switched Focus from Healthcare to the Financial Services appeared first on HIPAA Journal.

FBI Warns Healthcare Industry About Anonymous FTP Server Cyberattacks

Posted by HIPAA Journal

The Federal Bureau of Investigation has issued a warning to healthcare organizations using File Transfer Protocol (FTP) servers. Medical and dental organizations have been advised to ensure FTP servers are configured to require users to be properly authenticated before access to stored data can be gained.

Many FTP servers are configured to allow anonymous access using a common username such as ‘FTP’ or ‘anonymous’. In some cases, a generic password is required, although security researchers have discovered that in many cases, FTP servers can be accessed without a password.

The FBI warning cites research conducted by the University of Michigan in 2015 that revealed more than 1 million FTP servers allowed anonymous access to stored data

The FBI warns that hackers are targeting these anonymous FTP servers to gain access to the protected health information of patients. PHI carries a high value on the black market as it can be used for identity theft and fraud.

Healthcare organizations could also be blackmailed if PHI is stolen. Last year, the hacker operating under the name TheDarkOverlord conducted a number of attacks on healthcare organizations. The protected health information of patients was stolen and organizations were threatened with the publication of data if a sizable ransom payment was not made. In some cases, patient data were published online when payment was not received.

There are reasons why IT departments require FTP servers to accept anonymous requests; however, if that is the case, those servers should not be used to store any protected health information of patients. If PHI must be stored on the servers, they cannot be configured to run in anonymous mode.

In anonymous mode, any information stored on the server can potentially be accessed by the public. Hacking skills would not be required. Default usernames are freely available on the Internet.

Even if PHI is not stored on the servers, healthcare organizations may still be at risk. Any sensitive data could be accessed and used against the organization, ransomware could be installed or the servers could be used by hackers and other cybercriminals to store illegal content or malicious tools.

In the alert, the FBI said “In general, any misconfigured or unsecured server operating on a business network on which sensitive data is stored or processed exposes the business to data theft and compromise by cyber criminals who can use the data for criminal purposes such as blackmail, identity theft or financial fraud.”

Large healthcare organizations may already have ensured their servers are not configured to allow anonymous access or that all sensitive information has been removed from those servers; however, that may not be the case for smaller healthcare organizations. Smaller medical and dental organizations are more likely to be placing patient data and other sensitive information at risk.

The FBI suggests all healthcare organizations should instruct their IT departments to check the configuration of their FTP servers to ensure they are not running in anonymous mode and to take immediate action to secure those servers and reduce risk if they are.

The post FBI Warns Healthcare Industry About Anonymous FTP Server Cyberattacks appeared first on HIPAA Journal.

SAFER Guides Updated by ONC: Ransomware Prevention and Mitigations Now Included

Posted by HIPAA Journal

The Department of Health and Human Services’ Office of the National Coordinator for Health Information Technology (ONC) has updated its SAFER Guides to include information to help healthcare providers protect against ransomware attacks and mitigate attacks should they occur.

The Safety Assurance Factors for Electronic Health Record Resilience (SAFER) Guides were first released in January 2014 to help healthcare providers improve the usability of their EHRs and address the risks that EHR technology can introduce. The SAFER Guides can also be used to reduce the potential for patients to suffer EHR-related harm.

The SAFER Guides cover a range of key focus areas and include evidence-based best practices that can be adopted by healthcare providers to improve the usability and safety of their EHRs. Over the past three years, technology has changed as have the threats faced by the healthcare industry.

The guides were therefore due an update to keep them useful and relevant. Prior to issuing the updated guides, ONC sought feedback from healthcare providers and developers of EHRs. The comments and recommendations received from the National Academy of Medicine, the National Quality Forum, the American Medical Informatics Association, the Electronic Health Record Association and other organizations have been used to develop new best practices that healthcare providers should adopt.

The SAFER Guides include checklists and recommendations for healthcare organizations along with note templates that can be used to improve the safety and usability of EHRs. ONC says the guides have been developed to help reduce data-related burdens.

The guides now cover ransomware prevention strategies and mitigations to reduce the impact of ransomware attacks, including how to manage downtime following ransomware attacks and how to respond when EHR systems are slow or inaccessible.

The updated SAFER Guides can help organizations with EHR contingency planning to ensure compliance with that aspect of the HIPAA Security Rule. The SAFER guides now include an EHR contingency planning self-assessment to help in this regard.

The guides also include a new recommendation to the Test Results and Follow-Up Reporting Guide to help healthcare organizations communicate abnormal results to patients. The update incudes advice ONC received from the National Academy of Medicine.

To date, more than 52,000 users have downloaded the SAFER Guides and many EHR developers are now using the guides to help their customers set up their EHR systems and improve both safety and usability.

ONC says the SAFER Guides are particularly useful for technical assistance providers to help smaller healthcare organizations improve care quality and participate in the Medicare Quality Payment Program.

The post SAFER Guides Updated by ONC: Ransomware Prevention and Mitigations Now Included appeared first on HIPAA Journal.