California Seeks to Implement AI Guardrails for Mental Health Treatment

Posted by Steve Alder

A bill has been unanimously passed by the California Senate that seeks to establish common-sense guardrails for artificial intelligence (AI) use in mental health treatment. The bill, SB-903 Mental health professionals: artificial intelligence, was authored by Senator Steve Padilla and seeks to protect individuals seeking therapy or psychotherapy services in the state of California. The bill was passed by the Assembly with a vote of 71-4, and now awaits the signature of the state governor.

AI tools are being rapidly adopted by healthcare providers to automate routine clinical and administrative tasks and improve operational efficiency. The Trump administration is keen to expand its use further and is pressing ahead with plans to integrate AI more fully into medical care, including deploying AI agents for conducting therapy sessions and prescribing medications to patients under Medicare.

While the capabilities of AI have advanced considerably in recent years, mental health experts have voiced concerns about patient safety. AI algorithms may be able to accurately diagnose a mental health condition, but they are still capable of error, and in mental health, errors can have grave consequences. The bill seeks to ensure patient safety by requiring oversight by licensed mental health professionals and requiring patients to consent to the use of AI tools.

“Thousands of the professionals caring for patients across California are all urging Governor Newsom with one voice, “Sign this bill’,” said Senator Padilla. “The Trump administration is listening to tech companies who want to put unlicensed chatbots in front of vulnerable patients to make a profit. California should be listening to the licensed clinicians who spent years training to do this work safely.”

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

If signed into law by Governor Gavin Newsom, individuals, corporations, or entities that provide or facilitate psychotherapy services may only use AI tools to assist in providing administrative support services or supplementary support for psychotherapy services. AI tools or systems may not be used to conduct therapy sessions. If AI tools are used for making therapeutic decisions, therapeutic recommendations, assessment results, diagnoses, or treatment plans; detecting emotional states or mental stress; performing triage or screening; or directly interacting with patients or clients in any form of psychotherapeutic communication (unless FDA-approved and compliant with HIPAA), their output must be reviewed and approved by a licensed professional.

The bill prohibits advertising or otherwise purporting to offer psychotherapy services when they are provided through the use of companion chatbots, including claiming that a companion chatbot is a therapist or provides therapy. If AI tools are used to record or transcribe psychotherapeutic communications, psychotherapy sessions, or triage or screening, then the patient or their legally authorized representative must be informed about the specific purpose for which AI is being used, and must provide (revocable) consent.

The post California Seeks to Implement AI Guardrails for Mental Health Treatment appeared first on The HIPAA Journal.

77% of Ransomware Groups Are Targeting the Healthcare Sector

Posted by Steve Alder

A new analysis of ransomware activity reveals broad, consistent targeting pressure across the United States. Ransomware activity is not limited to any specific industry, with all sectors attacked to varying degrees. The analysis was conducted by the AI-driven cybersecurity and threat intelligence platform provider Anomali, with the findings published in its US Ransomware Industry Targeting Report. Anomali observed ransomware targeting across 8 industry sectors by 200 distinct ransomware entities, with its analysis showing that technology was the most targeted sector, followed by manufacturing and healthcare.

Anomali looked at ransomware targeting across eight industry sectors – technology, manufacturing, healthcare, financial services, government public services, construction, education, and energy. There was in excess of 50% observed targeting presence in all eight sectors, with technology companies targeted by 172 of the 200 ransomware entities (86%), followed by manufacturing with 166 (83%), and healthcare in third place with 154 (77%).

The healthcare sector has long been an attractive target for ransomware groups as it is a high-pressure extortion environment combining patient care, protected health information, insurance, payments, and clinical operations, which provides multiple points of leverage for extortion. The healthcare industry is reliant on continuous access to patient data, and any attack that prevents access creates a significant safety risk. There is pressure on victims to recover rapidly, which increases the likelihood of a ransom being paid. Further, a sprawling attack surface, including legacy systems and devices that cannot be patched, makes attacks easier than in many other sectors.

While there are many potential entry points, the most common are unpatched VPNs, firewalls, edge devices, and other internet-facing applications, and these are likely to remain the most high-value entry points into healthcare environments. Internet-facing exposure should be closed before ransomware groups are able to exploit it, focusing on VPNs, firewalls, edge devices, backup platforms, RMM tools, and externally reachable applications.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

Anomali recommends treating identity as the primary ransomware boundary and ensuring that phishing-resistant multifactor authentication is implemented for remote access, administrators, SSO, VPN, and privileged service accounts. Exposed RDP should be removed, reviews should be conducted to identify stale accounts, and there should be continuous monitoring for credential exposure and anomalous logins.

File encryption causes significant disruption to healthcare operations, so a rapid recovery is essential. Offline, immutable backups should be created for all critical systems and data, and restoration procedures should be tested under ransomware conditions. Anomali has seen evidence that EDR evasion is becoming a common part of the affiliate playbook and predicts increased use of EDR-killing tools by adversaries over the coming year. Anomali recommends enabling EDR tamper protections, preserving centralized logs, and monitoring PowerShell, RMM, and exfiltration behavior, and rehearsing legal, communications, regulatory, and law-enforcement decisions before an extortion deadline.

“Healthcare organizations face an especially difficult ransomware threat because attackers know that patient care cannot simply pause while systems are restored. As ransomware groups broaden their targeting and reuse the same tactics across industries, healthcare leaders need real-time threat intelligence that helps them identify emerging activity earlier, prioritize the risks most likely to affect their environment and respond before an intrusion disrupts patient care,” Patrick Holt, head of product at Anomali, told the HIPAA Journal.

The post 77% of Ransomware Groups Are Targeting the Healthcare Sector appeared first on The HIPAA Journal.