New HIPAA Guidance Tackles Ransomware Epidemic In Healthcare

HHS addresses ransomware infections in wake of healthcare attacks.

It took ransomware infections that brought two major hospital systems to their knees earlier this year to demonstrate how dangerous malware can be for healthcare organizations. Now the federal government has issued new guidance via the Healthcare Insurance Portability and Accountability Act (HIPAA) to address ransomware attacks.
The US Health and Human Services Office for Civil Rights this week issued guidelines for helping healthcare organizations understand, prevent, and prepare for ransomware attacks. It provides information on what ransomware is, how attacks work, how to spot it, how to quell damage, and of course how to protect data with regular backups. The guidance notes that existing HIPAA requirements basically cover ransomware attacks, and explains how a ransomware attack maps to those rules.
“The new guidance reinforces activities required by HIPAA that can help organizations prevent, detect, contain, and respond to threats,” Jocelyn Samuels, director of the Office of Civil Rights, wrote in
a blog post
. Among those practices: running a risk analysis of threats to electronic health information; training users to detect malware; limiting user access to electronic health records; and establishing a contingency plan including regular data backups, test restoration, and emergency operations.
“Organizations need to take steps to safeguard their data from ransomware attacks. HIPAA covered entities and business associates are required to develop and implement security incident procedures and response and reporting processes that are reasonable and appropriate to respond to malware and other security incidents,” Samuels said.
While having HIPAA address ransomware makes sense, some security experts say it’s no guarantee users won’t still fall for a phish or link in an email. “Any new guidance that can help healthcare organizations prevent, detect, contain, and respond to threats (especially ransomware) is obviously good guidance. However, will guidance solve the bigger problem of the unsuspecting click?” says Stephen Gates, chief research intelligence analyst at NSFOCUS.
“Ransomware, he says, is not an exploit that takes advantage of a vulnerable application or operating system. Ransomware is a payload that takes advantage of vulnerable people and their clicks. Even the best guidelines can’t solve that problem.”
HIPAA’s guidance on ransomware is
here
.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
New HIPAA Guidance Tackles Ransomware Epidemic In Healthcare