Monthly Tips Roundup

We’ve curated our weekly tips shared on LinkedIn every Tuesday into this monthly blog for your convenience.

It’s That Time of Year

The countdown for the end of the year has begun. I know, it’s hard to believe but we’re in the final quarter and need to organize what must get done for 2026.

• If you haven’t scheduled the annual HIPAA Security Risk Analysis (SRA), do this now! The SRA will give direction to areas within the organization that require attention for the Administrative, Physical and Technical Safeguards for HIPAA compliance.
• Review with your IT company where changes need to be made, specifically to ramp up security measures: vulnerability scans, two-factor or multi-factor (2FA, MFA) enabled for access to systems and applications containing ePHI, additional security licensing for Firewalls.
• Contact vendors that back up data for the business to review their backup protocols: frequency, retention and testing. Request a random file restore to ensure the backups are successful and there is no corruption.
• Review all policies and procedures required for the HIPAA Privacy and Security Rules. Revise if necessary and be certain to have staff sign off on what is expected of them. Add User Access, Change Management, Incident Response, Facility Access/Security Plans if needed.

Scary Cybersecurity Attacks

Some of the scariest and most impactful cybersecurity attacks in history paralyzed critical infrastructure, leaked massive amounts of sensitive data and proved how vulnerable modern digital life is.

The Arup Deepfake Video Heist 2024: Fraudsters used advanced real-time deepfake video and audio technology to impersonate a multinational firm’s chief financial officer during a video conference call. This tricked an employee into authorizing 15 separate transfers totaling $25 million.

University of Mississippi Medical Center Ransomware 2026: A crippling ransomware attack forced the complete shutdown of 35 clinic locations and electronic medical records systems, forcing doctors back to paper. Due to the attack there were widespread disruptions of urgent and elective surgeries and patient appointments statewide.

Change Healthcare 2024: The ALPHV/BlackCat ransomware group exploited a weak remote-access portal lacking multi-factor authentication. The attack paralyzed prescription processing, delayed hospital revenues by up to $100 million daily, exposed data for over 190 million people, and reportedly led to a $22 million ransom payment.

Colonial Pipeline 2021: The DarkSide ransomware gang compromised the IT network of the largest fuel pipeline in the United States. Colonial Pipeline proactively shut down operations to contain the threat, causing massive fuel shortages, long lines at gas stations, and widespread panic across the U.S. East Coast.

SolarWinds 2020: Hackers placed a hidden backdoor (named SUNBURST) into an ordinary software update from SolarWinds (IT management company). This was a sophisticated supply chain attack; trusted software updates turned into Trojan Horses for thousands of global agencies and high-level U.S. government agencies.

Cybersecurity Trends for 2026

According to the 2026 Study on Cyber Insecurity in Healthcare by Proofpoint and Ponemon Institute (https://lnkd.in/gwuSrPcn), 97% of U.S. healthcare organizations experienced at least one cyber attack in the past year, averaging 51 attacks per affected organization.

From Becker’s Hospital Review (https://lnkd.in/g4fFX3tT) 74% of healthcare organizations reported major attacks in 2026 resulting in disruptions to patient care including delayed surgeries, appointment cancellations and emergency diversions. Five healthcare vendors disclosed that breaches of their systems affected more than 1 million individuals. Their reported totals add up to more than 30 million, led by Oracle Health at nearly 20 million.

DON’T:

• Run outdated or end of life systems on the organization’s network. Patch, update and replace systems that threat actors can easily access right away.
• Use shared/generic user accounts (with little to no security measures) on systems and applications containing ePHI, including the Windows Operating System. Staff come and go and the password never changes, and most likely, the account never auto-locks after so many minutes of inactivity.
• Convince yourself that your organization will never be a target for a hack or data breach. All healthcare businesses small and large can be targeted with an attachment containing malware, ransomware attack or phishing email.

DO:

• Enable two-factor or multi-factor (2FA/MFA) authentication on systems and applications containing ePHI, especially when connecting remotely.
• Include an annual Vulnerability Scan or Penetration Test on the technical security currently used in the organization. These tools can detect known security flaws to safeguard the network, cloud assets and endpoints.
• Conduct regular security and cybersecurity awareness training, not just annually. Educate staff on known threats to the environment, as well as in their personal lives (smishing, quishing, email phishing).

October is Cybersecurity Awareness Month

Cybersecurity awareness should not only be the month of October but discussed, celebrated and applied all the time! Digital threats and safe online practices help organizations and individuals recognize risks, avoid attacks and protect data, including electronic Protected Health Information (ePHI).

Reminders:

1. Training in cybersecurity and security awareness must be conducted on a regular basis. Include updates and tips in monthly staff meetings or schedule educational email blasts to the whole organization quarterly.
2. Lengthen passwords (12-16 characters) for all systems and applications containing ePHI including the Windows Operating System. Use passphrases and don’t use the same password for all systems.
3. Enable two-factor authentication (2FA) or multi-factor authentication (MFA) whenever possible. Include this for systems that are cloud-/web-based, email accounts and all remote access into systems and applications containing ePHI.
4. Speak with your IT department to add annual vulnerability scans to check computers, networks and applications for security flaws, misconfigurations, open ports and weak protocols.
5. Immediately replace or update systems and devices that are end of life, as these are no longer supported with security measures and easy targets for hackers and threat actors.

Compliance Is Ongoing

HIPAA compliance isn’t a one-time checklist. It’s ongoing, programmatic in nature, and requires demonstrated reasonable diligence to stay in good standing with the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR). Anatomy IT can provide you peace of mind with our expert HIPAA compliance services. To learn more, contact us here.

Dawn Meglino is a certified HIPAA Compliance Specialist at Anatomy IT helping healthcare organizations navigate complex security and compliance requirements. She holds multiple cybersecurity and compliance certifications and regularly advises medical practices on breach prevention and HIPAA best practices.