Maine House Unanimously Passes Bill to Strengthen Cybersecurity at Maine Hospitals

Posted by Steve Alder

The Maine House of Representatives has voted unanimously to advance a bill that seeks to strengthen cybersecurity at Maine hospitals to prevent cyberattacks and ensure continuity of care following cyber intrusions. The bill faces further votes in the House and Senate in the coming days.

The bill was proposed by Rep. Julie McCabe (D-Lewiston), a member of the Health and Human Services Committee, following two cyberattacks last year that impacted five Maine hospitals –  Covenant Health’s St. Mary’s Hospital in Lewiston, St. Joseph’s Hospital in Bangor, and Central Maine Medical Center’s hospitals in Lewiston, Bridgton, and Rumford. The Covenant Health ransomware attack alone affected 478,188 individuals, and along with the cyberattack on Central Maine Medical Center, around one-third of state residents were affected.

Those cyberattacks had a negative impact on patient care, crippling basic communication services, exposing serious breakdowns in hospitals’ protocols, and causing major disruption to patient care that lasted for weeks, including disruptions to preventative care and cancer care. “Cyberattacks pose a serious risk to our already-fragile health care system,” said McCabe. “We’ve already seen how a cyberattack can impact Maine hospitals and leave patients in dire straits. This legislation will help ensure that our hospitals are prepared to deal with these types of incidents, respond promptly and effectively to patient needs, and protect sensitive information.”

The bill – LD 2103 – requires hospitals to adopt measures to prevent and respond to cybersecurity incidents, and also includes provisions requiring workplace safety measures to protect patients, visitors, and employees from aggressive and violent behavior. According to the Occupational Safety and Health Administration (OSHA), healthcare workers are 4-5 times as likely to suffer injuries due to violence as employees in all other sectors. The bill requires hospitals to have a process in place to receive and record incidents and threats of violence and prohibits representatives or employees of a hospital from interfering with a person making a report.

All hospitals will be required to have a cybersecurity plan consistent with cybersecurity best practices established by the U.S. Department of Homeland Security (DHS), Cybersecurity and Infrastructure Security Agency (CISA), Department of Commerce, National Institute of Standards and Technology (NIST), and the Healthcare and Public Health Sector Coordinating Council (HSCC).

The cybersecurity plan must be consistent with HIPAA and be reviewed at least annually. At a minimum, the plan must include provisions to ensure timely notifications to law enforcement, state regulators, patients, and employees about cybersecurity intrusions. All hospitals must have a backup communication response provision to ensure continuity of care for patients in the event of a disruption of hospital computer systems due to a cybersecurity intrusion. That includes a compliant process for patients who experience challenges accessing medical care, a system to triage patients within 48 hours of submitting a complaint about emergent symptoms, and timely management of complaints related to prescriptions.

There is a provision to ensure the triage of all hospital services in the event of disruption to computer systems, including procedures for diverting hospital services, and written agreements with other hospitals to facilitate the continuity of care for patients during any disruption due to a cybersecurity incident. Hospitals must have a written security incident response plan documenting how hospital employees are to report suspected or known security incidents, including how the hospital will respond clinically, and provisions for internal and external communications. Hospitals must also have a system for ensuring that all manually charted medical information is incorporated into electronic medical records in a timely manner.

Cybersecurity training for hospital employees and board members is required at least annually, and incident response and downtime procedures must be reviewed, tested, and updated, as necessary, at least once a year. Further, following any cybersecurity incident, hospitals are required to review the response and take steps to improve procedures for responding to future cybersecurity incidents.

The post Maine House Unanimously Passes Bill to Strengthen Cybersecurity at Maine Hospitals appeared first on The HIPAA Journal.

Trump Administration Proposes 12.5% Cut to HHS Budget for FY 2027

Posted by Steve Alder

The HHS’ Office for Civil Rights (OCR) has long been seeking an increase to its budget to support its HIPAA enforcement activities; however, that is looking unlikely as the Trump Administration is seeking to cut funding for the Department of Health and Human Services (HHS) in 2027.

The Trump Administration has proposed $111.1 billion in discretionary funding for fiscal year 2027, a $15.8 billion (12.5%) cut in funding compared to FY 2026. One of the main casualties is the National Institutes of Health (NIH), which faces a $5 billion cut to its budget, plus $5 billion in cuts through consolidations and eliminations of programs across several sub agencies, including the Health Resources and Services Administration (HRSA), Substance Abuse and Mental Health Services Administration (SAMHSA), Centers for Disease Control and Prevention (CDC), and the Office of the Assistant Secretary for Health (OASH).

The Trump Administration is seeking to establish the Administration for a Healthy America (AHA), which, in part, will involve the elimination of programs that the Trump Administration says promote “radicalized DEI ideologies”, including programs that provide funding for youth LGBTQ services. The AHA was proposed last year, although Congress did not include funding to establish the new department in the budget.

While OCR does not appear to be facing any budget cuts, any increase to its budget to support its enforcement of HIPAA and the Part 2 regulations looks increasingly unlikely. OCR is already having to find funds from its existing budget to pay for an expanded workload, as OCR has been given the responsibility of enforcing the Part 2 regulations.

In a press call following the announcement of the Part 2 enforcement program, the OCR Director said the agency has sufficient resources to manage the additional Part 2 enforcement workload in fiscal year 2026, based on the expected volume of complaints and data breaches.

Since OCR started enforcing compliance with the Part 2 regulations in February and updated its data breach portal, there has been a major slowing of the publication of breach summaries on its “HIPAA Wall of Shame,” which had no breach reports added to the “under investigation” section after February 26, 2026, during the whole of March. Whether this is due to a lack of resources or a change in policy is unclear. OCR does appear to be working on closing investigations faster, as data breaches have been added to the archive section at an increased pace.

While the Trump Administration has proposed its budget with extensive funding cuts, it will be down to Congress to pass that budget, and there is likely to be some resistance to the proposed budgetary cuts at HHS, as was the case with the proposed budget for FY 2026. The Trump Administration sought to cut HHS funding last year; however, Congress actually increased the budget for the HHS in 2026.

The post Trump Administration Proposes 12.5% Cut to HHS Budget for FY 2027 appeared first on The HIPAA Journal.

Critical Flaws Identified in Progress Software ShareFile Service

Posted by Steve Alder

Two critical vulnerabilities have been identified in Progress Software’s ShareFile service. The flaws could potentially be chained by an unauthenticated remote attacker to make configuration changes and achieve remote code execution.

While there have been no known cases of the vulnerabilities being exploited in the wild to date, vulnerabilities in file sharing software are actively targeted by threat actors, so attempted exploitation is likely. In 2023, a zero-day vulnerability in Progress Software’s MOVEit file transfer software was mass exploited by the Clop ransomware group, which claimed hundreds of victims worldwide. To a lesser extent, vulnerabilities in Fortra’s GoAnywhere, Accellion FTA, and Cleo MFT were also mass exploited. Users are therefore encouraged to apply the security updates promptly to prevent exploitation.

The vulnerabilities affect ShareFile Storage Zones Controller v5 version deployments for customer-managed zones and include an authentication bypass flaw tracked as CVE-2026-2699 and a remote code execution flaw tracked as CVE-2026-2701.

According to Progress Software’s security alert, “These vulnerabilities allow an unauthenticated remote attacker to access on-prem storage zones controller’s configuration pages, potentially leading to changes in system configuration and remote code execution.” The authentication bypass flaw has a CVSS v3.1 base score of 9.8, and the RCE flaw has a CVSS base score of 9.1.

The vulnerabilities affect versions 0 through 5.12.3 and have been patched in version 5.12.4. The vulnerabilities do not exist in any v6 versions. Progress Software strongly recommends upgrading to a patched version of V6 as soon as possible to prevent exploitation. Any users of unsupported versions should ensure they upgrade to a supported and fixed version as soon as possible.

The vulnerabilities were identified by security researchers Sonny and Piotr Bazydlo of watchTowr, who reported them to Progress Software. According to Shadow Server, there are 334 Unique IPs associated with ShareFile in the United States.

The post Critical Flaws Identified in Progress Software ShareFile Service appeared first on The HIPAA Journal.