$150K Fine for Unpatched Software: Don’t Let This Happen to YOUR Healthcare Organization

History

Anchorage Community Mental Health Services (ACMHS) failed to take basic risk assessment and, in March, 2012, was infected with malware. This malware compromised the systems of mental health providers, specifically their information technology resources. This could have been prevented if they followed a policy they adopted in 2005. Affecting that big of a population calls for action, that of which they did not take. Now, the ACMHS is being fined for a large sum because they did not take action.

What Prevention Methods Should They Have Taken

It is actually a simple fix, abide by policy and update your systems. Susan A. Miller, an independent HIPAA and healthcare attorney, stated “This is a wake-up call that people should be looking very closely at the security risk assessment tools available from ONC and OCR, as well as NIST [National Institute of Standards and Technology].” She goes on to state “the lesson here is that when a software patch or update is sent by a vendor, they should be applied immediately.”

About Managing Risk

If managing all risks were simple, we wouldn’t have policies in place to abide by. Miller makes a great point by noting all patches should be applied and that technology security should be looked at regularly. Networks and servers also have security issues that need to take looked at. Some can happen because of employees.

Along with the fine, ACMHS is also advised to train all employees on proper security procedures and practices, within the facility. This isn’t the first case, other problems have come across major health institutions in the past.

What You Can Take from This

Monitoring your network is always a priority, but it doesn’t mean you have the time to manage it. Managing a network is the same as managing a business; keeping up to date, employees notified, on top of threats and analyzing data. Here are some actions you can take: