Cybersecurity training doesn’t always have to mean another long meeting. 

A five-minute conversation during a staff meeting, morning huddle, or shift change can help employees think through the kinds of situations they may actually face, and reinforce what to do before they’re under pressure. 

For Week 2 of Cybersecurity Awareness Month, here are four quick discussions you can use with your healthcare team. 

How to use them: Read the scenario, ask the questions, and close with the takeaway. That’s it. 

Huddle 1: The “Urgent” IT Request 

The Scenario 

You receive a call from someone who says they’re with IT. 

They know your name and where you work. They tell you there’s a security problem with your account and you need to reset your password immediately using a link they send you. 

Ask Your Team 

• What would make you suspicious? 

• What should you do before following the caller’s instructions? 

• How would you verify that the request is legitimate? 

The Takeaway 

Attackers often create urgency so you’ll act before you have time to question the request. 

If someone unexpectedly asks you to reset a password, change a security setting, provide a code, or take another sensitive action, stop and verify the request through a contact or process you already trust. 

The habit: Pause. Verify. Then act. 

Huddle 2: The Login You Didn’t Start 

The Scenario 

Your phone asks you to approve a multifactor authentication request. 

You aren’t logging into anything. 

A few minutes later, another request appears. 

Ask Your Team 

• What could be happening? 

• Should you approve the request just to make the notifications stop? 

• What should you do next? 

The Takeaway 

An unexpected MFA request can mean someone else is trying to access your account. 

Deny the request and report it according to your organization’s procedures. 

Never approve a login you didn’t initiate or share authentication codes with someone who contacts you unexpectedly. 

The habit: If you didn’t start it, don’t approve it. 

Huddle 3: “Just Text It to Me” 

The Scenario 

A coworker needs patient information quickly and says: 

“Just text it to my personal phone. It’ll be faster.” 

Everyone is busy, and the request seems harmless. 

Ask Your Team 

• What should you consider before sending the information? 

• Is convenience enough reason to use a different tool? 

• What should you do if you aren’t sure whether a communication method is approved? 

The Takeaway 

When patient information is involved, the fastest option isn’t always the right one. 

Use the tools and processes your organization has approved. If you’re unsure, ask before creating your own workaround. 

The habit: Before you send, check where it’s going. 

Huddle 4: The EHR Is Down 

The Scenario 

You arrive at work and can’t access the EHR. 

Other employees are having the same problem. Patients are arriving, phones are ringing, and everyone needs to keep working. 

Ask Your Team 

• What should you do first? 

• Do you know where your organization’s downtime procedures are? 

• What should you avoid doing while systems are unavailable? 

The Takeaway 

Cybersecurity isn’t only about preventing incidents. It’s also about knowing what to do when technology isn’t available. 

Follow your organization’s downtime and incident-response procedures rather than creating unapproved workarounds. 

The habit: Know the plan before you need it. 

Five Minutes Can Reinforce a Habit 

The goal of these conversations isn’t to turn every employee into a cybersecurity expert. 

It’s to make good decisions easier to recognize and repeat. 

That takes more than one annual training session. 

HIPAA Secure Now’s PHIshMD Ongoing Training Program helps healthcare organizations reinforce cybersecurity habits throughout the year with weekly bite-sized training, simulated phishing, and ongoing visibility into employee risk. 

Keep cybersecurity training going all year.
Learn More About PHIsh MD Training

Next week: We’ll turn the focus to healthcare leaders with a practical cybersecurity checkup to help you ask: Are the fundamentals actually working across your organization? 

The post 4 Five-Minute Cyber Huddles for Healthcare Teams appeared first on HIPAA Secure Now!.

Healthcare employees are being targeted. 

Recent reporting from Cybersecurity Dive highlights increased social-engineering activity against healthcare and pharmaceutical organizations. Attackers are using phone calls, phishing sites, and urgent requests to convince employees to reset passwords, change multifactor authentication settings, or give up credentials. 

In fact, Health-ISAC reported that more than a dozen member organizations had been hit by social-engineering attacks in just a few months. 

Cybersecurity Awareness Month is a good opportunity to reinforce a simple idea: employees don’t have to be cybersecurity experts to make it harder for attackers. 

They need to know what to look for, when to slow down, and when to speak up. 

To make that easier, here are four messages healthcare organizations can copy, customize, and share with employees throughout October. 

Before sending: Add your organization’s IT/security contact or reporting process where indicated. 

Message 1: Pause. Verify. Then Act. 

Suggested subject: Before you act, take a second look 

Cybercriminals are getting better at making their requests look and sound legitimate. 

An email may appear to come from a vendor you know. A caller may claim to be from IT. A message may warn you about an urgent problem with your account. 

That urgency is a reason to slow down. 

If someone unexpectedly asks you to click a link, reset a password, approve a login, provide information, or change a security setting: 

• Pause before taking action. 

• Verify the request using a contact or process you already trust. 

• Don’t use a phone number or link provided in a suspicious message. 

• Report anything that doesn’t feel right to your IT/Security or your organization’s preferred reporting method. 

You don’t have to determine whether something is a cyberattack. 

If something seems unusual, stop and verify. 

Message 2: Didn’t Start the Login? Don’t Approve It. 

Suggested subject: One easy rule for unexpected login requests 

Have you ever received a multifactor authentication (MFA) request when you weren’t trying to log in? 

Don’t approve it just to make it go away. 

An unexpected login or MFA request can mean someone else is trying to access your account. 

If it happens: 

• Deny the request. 

• Never share authentication codes with someone else. 

• Don’t reset your password or MFA settings because an unexpected caller asks you to. 

• Report the activity to IT/Security or your organization’s preferred reporting method. 

MFA adds an important layer of protection, but it still depends on us paying attention. 

If you didn’t start the login, don’t approve it. 

Message 3: Keep Patient Information Where It Belongs. 

Suggested subject: Before you send it, check where it’s going 

Healthcare moves quickly, and sometimes the fastest way to get something done can seem like the easiest option. 

When patient information is involved, take an extra moment. 

Before you send, upload, text, or share information, ask yourself: 

• Am I using a tool approved by our organization? 

• Am I sending this to the right person? 

• Does this person need this information? 

• Do I need to share all of it? 

This applies to email, text messages, file-sharing tools, cloud applications, mobile devices, and other technology we use at work. 

If you’re not sure whether a tool or method is approved, check with IT/Security Administrator before using it. 

A quick check can help keep patient information where it belongs. 

Message 4: See Something? Say Something. 

Suggested subject: You don’t have to be sure before you report it 

Something doesn’t seem right. 

Maybe you clicked a link and realized afterward that it looked suspicious. You received an unexpected login notification. Someone called asking you to reset your password. Or a system suddenly isn’t behaving normally. 

Please tell us. 

You don’t have to investigate it yourself, and you don’t have to be certain it’s a cyberattack before reporting it. 

Contact IT/Security Administrator as soon as you notice something unusual. 

And if you clicked something you shouldn’t have? Tell us that too. 

The sooner we know, the sooner we can investigate and take action if needed. 

When in doubt, speak up. 

Keep the Conversation Going All Year 

Cybersecurity Awareness Month is a great reason to put these conversations front and center. But attackers don’t limit their efforts to October, and cybersecurity training shouldn’t be limited to one annual event. 

HIPAA Secure Now helps healthcare organizations keep cybersecurity and HIPAA top of mind throughout the year with ongoing workforce training designed to reinforce important habits before employees need them. 

Build a workforce that keeps learning all year.
Learn More About HIPAA Secure Now Training

Next week: We’ll share five-minute cyber huddles healthcare leaders and managers can use to turn these reminders into quick conversations with their teams. 

The post Cybersecurity Awareness Month: 4 Ready-to-Send Messages for Your Healthcare Workforce appeared first on HIPAA Secure Now!.

Cybersecurity Awareness Month starts today, and for healthcare organizations, the timing matters. 

Recent warnings from Health-ISAC have highlighted social-engineering attacks targeting healthcare employees through tactics like voice phishing, impersonation websites, and urgent requests to reset passwords or change security settings. 

It’s another reminder that cybersecurity isn’t only about technology. 

It’s also about the decisions people make every day. 

• An unexpected phone call. 
• An urgent email. 
• A login request. 

Patient information that needs to be shared quickly. 

October is a good opportunity to reinforce the habits that help employees make those decisions more securely. 

We’re making it easier to put Cybersecurity Awareness Month into action. 

Throughout October, HIPAA Secure Now will be sharing practical resources healthcare organizations can use with their teams: 

• Week 1: Ready-to-send cybersecurity messages for employees 
• Week 2: Five-minute cyber huddles for healthcare teams 
• Week 3: A cybersecurity checkup for healthcare leaders 
• Week 4: Incident response and downtime preparedness 

No complicated campaign. Just useful ideas and resources you can put to work. 

Cybersecurity Awareness Month may last 31 days, but the habits we reinforce now should last all year. 

Follow along throughout October for practical ways to keep cybersecurity conversations going with your workforce.

The post Cybersecurity Awareness Month Is Here. Let’s Put It to Work in Healthcare appeared first on HIPAA Secure Now!.

Most healthcare organizations hope they never have to put their incident response or disaster recovery plans into action. 

But hope is not a recovery strategy. 

When a cyberattack, system outage, natural disaster, or other disruption occurs, the middle of an incident is not the time to discover that responsibilities are unclear, backups cannot be restored quickly, or critical systems were never prioritized. 

That is one of the important themes behind the proposed changes to the HIPAA Security Rule. If finalized, the proposal would establish more specific expectations around how covered entities and business associates prepare for security incidents, respond when they occur, and restore critical systems afterward. 

The bigger takeaway for healthcare organizations is simple: having a plan on paper may no longer be enough. Organizations need to know whether that plan actually works. 

Incident Response: From Having a Policy to Being Prepared 

Under the current HIPAA Security Rule, organizations must have policies and procedures for identifying and responding to suspected or known security incidents, mitigating harmful effects when possible, and documenting incidents and their outcomes. 

The proposed HIPAA Security Rule would add more specific requirements around that process, including a written Security Incident Response Plan outlining how workforce members report suspected or known incidents and how the organization responds. 

It would also establish more detailed expectations around testing and revising those plans. 

That distinction matters. 

A written incident response plan can identify who should be contacted and what steps should be taken. Testing that plan helps determine whether employees know what to do, whether responsibilities are clear, and whether the process can work under the pressure of a real incident. 

Download Your Complimentary Incident Response Checklist

Disaster Recovery: What Needs to Come Back First? 

Incident response focuses on what happens when a security incident occurs. Disaster recovery asks another critical question: How quickly can your organization get back to normal operations? 

The current Security Rule requires a contingency plan that addresses areas such as backing up ePHI, restoring lost data, and continuing critical processes during an emergency. 

The proposed rule would make some of those expectations more specific:  

If finalized as proposed, organizations would need to establish written procedures for restoring certain critical electronic information systems and data within specified timeframes, including a proposed 72-hour restoration requirement for certain critical systems and data. 

Organizations would also need to analyze the criticality of their systems and technology assets. In practical terms, that means understanding which systems the organization depends on most and determining what needs to be restored first. 

For a healthcare organization, that exercise can extend beyond compliance. If several systems become unavailable at the same time, leaders should already know which ones are essential to patient care, operations, and the protection of ePHI. 

A Plan You Have Never Tested Is Still an Unknown 

It is easy to think of incident response and disaster recovery as documents that live inside a compliance program. Their real value becomes apparent when something goes wrong. 

Can employees recognize and report a potential security incident?  

Does everyone know who is responsible for responding? 

Can your organization restore critical data from its backups?  

Does your IT provider understand which systems need to be prioritized?  

Have you actually tested any of it? 

Those are valuable questions regardless of what ultimately happens with the proposed HIPAA Security Rule. 

The proposed changes are not final, and current HIPAA requirements remain in effect. But healthcare organizations can use this time to review their incident response and disaster recovery processes, identify gaps, coordinate with their IT providers, and test whether their plans work as expected. 

Because when an incident happens, the most valuable plan is not the one sitting in a binder. 

It is the one your organization is prepared to execute. 

The post When an Incident Happens, Will Your HIPAA Response Plan Actually Work? appeared first on HIPAA Secure Now!.

Your workforce is an important part of protecting electronic protected health information (ePHI). HIPAA already requires covered entities and business associates to train their workforce, maintain security policies, and control access to ePHI. A proposed update to the HIPAA Security Rule would make many of these requirements more specific. 

What Does HIPAA Require Today? 

The current Security Rule requires a security awareness and training program for all workforce members, including management. It also includes addressable provisions covering security updates, protection from malicious software, login monitoring, and password management. 

Organizations must maintain written Security Rule policies and procedures, update them when needed, and have procedures for ending access when a workforce member leaves. However, the current Security Rule does not set a specific annual training schedule, a deadline for training new workforce members, or a timeframe for removing access. 

What Would the Proposed Rule Change? 

If finalized as written, the proposed rule would establish clearer training content and deadlines. Covered entities and business associates would need to: 

• Provide role-based security training at least once every 12 months 

• Train new workforce members no later than 30 days after they first receive system access 

• Provide updated training within 30 days of a material policy or procedure change affecting someone’s role 

• Provide ongoing reminders/continuous trainings about security responsibilities and emerging threats 

• Document that training and reminders were provided 

The proposal would also require workforce security policies and procedures to be reviewed and tested annually. 

Training is only one part of workforce security. Under the proposal, system and facility access would need to be terminated as soon as possible, but no later than one hour after a workforce member’s employment or other arrangement ends. When that person had authorized access to systems maintained by another covered entity or business associate, that organization would generally need to be notified within 24 hours. 

These changes are not final, but organizations can begin preparing by reviewing their training, policies, documentation, and access-removal processes. 

The post HIPAA Workforce Security: What Could Change? appeared first on HIPAA Secure Now!.

Healthcare organizations depend on outside vendors for billing, cloud storage, IT support, legal services, and everyday operations. When a vendor accesses, processes, receives, maintains, or transmits protected health information (PHI) on your behalf, it generally is a business associate under HIPAA. 

That relationship creates responsibilities for both parties—and signing a Business Associate Agreement (BAA) is only the beginning. 

A BAA Is Essential, but It Is Not Vendor Management 

A BAA defines how a business associate may use and disclose PHI, requires appropriate safeguards, and addresses incident reporting and subcontractor responsibilities. However, a signed agreement does not prove that a vendor has effective security controls. 

Healthcare organizations need a repeatable process for managing vendors throughout the relationship: 

1. Identify and classify. Maintain an inventory of vendors, the services they provide, the PHI they handle, and any subcontractors they use. 
2. Evaluate risk. Review safeguards such as access controls, multifactor authentication, encryption, workforce training, incident response, backups, and vulnerability management before access begins. 
3. Set clear expectations. Ensure the BAA and service agreement address responsibilities, notification procedures, data return or destruction, and other requirements appropriate to the risk. 
4. Monitor the relationship. Reassess higher-risk vendors on a defined schedule and whenever services, ownership, access, or subcontractors change. 
5. Offboard securely. Remove accounts and integrations, recover assets, and confirm that PHI is returned or destroyed when required and feasible. 

Business associates must apply the same discipline to subcontractors that handle PHI on their behalf. Each additional party extends the chain of responsibility—and can increase exposure if oversight is weak. 

Effective vendor management is not paperwork for its own sake. It helps your organization know who has access to PHI, understand the risk, respond faster to incidents, and prevent former vendors from retaining unnecessary access or data. 

HIPAA Secure Now helps healthcare organizations assess risk, maintain policies and documentation, train employees, and keep compliance work moving throughout the year. 

Schedule a HIPAA compliance review to identify vendor-management gaps and prioritize your next steps. 

The post Business Associate and Vendor Management: A New Approach is Needed appeared first on HIPAA Secure Now!.

One common misconception about the HIPAA Security Rule is that an “addressable” safeguard is optional. That is not the case. 

Under the current Security Rule, when an implementation specification is designated as addressable, an organization must determine whether that safeguard is reasonable and appropriate for its environment. If it is not, the organization must document why and, when reasonable and appropriate, implement an equivalent alternative measure. 

The proposed HIPAA Security Rule changes could significantly reduce that flexibility. HHS has proposed eliminating the distinction between “required” and “addressable” implementation specifications, making the specifications required with limited exceptions. 

Why Is HHS Proposing This Change? 

During the recent NIST/HHS Safeguarding Health Information: Building Assurance Through HIPAA Security conference, one of the points discussed was that the Security Rule was originally designed with flexibility so organizations could adapt as technology evolved. 

Technology has certainly evolved. Many safeguards that may have once been difficult, costly, or impractical to implement are now considered fundamental security practices. 

Encryption is a good example. 

Years ago, encryption could be expensive or difficult to implement, particularly for a small healthcare organization. Depending on the organization’s circumstances, there may have been other reasonable and appropriate ways to protect electronic protected health information (ePHI). 

Today, encryption is widely available and often built directly into the technology healthcare organizations already use. What may have once required additional technology and resources has increasingly become a baseline safeguard for protecting sensitive information. 

The same evolution is happening across other areas of cybersecurity. As technology becomes more accessible and threats become more sophisticated, expectations for protecting ePHI are changing with them. 

What Does This Mean for Your Organization? 

The proposed HIPAA Security Rule has not been finalized, so the current Security Rule requirements remain in effect. 

However, healthcare organizations do not have to wait for a final rule to start preparing. 

Now is a good time to review the safeguards your organization currently treats as addressable. Understand which safeguards have been implemented, where alternative measures are being used, and whether those decisions still make sense based on today’s technology and cybersecurity risks. 

This review can also help identify areas that may require additional planning, budgeting, or support from your IT team or managed service provider. 

Even if the final rule differs from the current proposal, evaluating these safeguards today can help strengthen the protection of ePHI and put your organization in a better position to adapt as HIPAA requirements evolve. 

Preparing now means having more time to make thoughtful decisions instead of waiting until a compliance deadline is approaching. 

The post What Could the End of “Addressable” HIPAA Safeguards Mean for Healthcare Organizations? appeared first on HIPAA Secure Now!.

Healthcare cyberattacks continue to evolve, and federal regulators are responding with stronger proposed cybersecurity expectations. 

The U.S. Department of Health and Human Services (HHS) has proposed major updates to the HIPAA Security Rule, with July 2027 currently listed as an estimated final-action date on the federal regulatory agenda. That date is not guaranteed and may change, but the proposal gives healthcare organizations a clear signal about where cybersecurity expectations are heading. 

One area receiving greater attention is vulnerability management, including both automated vulnerability scanning and penetration testing. 

Vulnerability Scans vs. Penetration Tests 

While the two are related, they serve different purposes. 

Vulnerability scans use automated tools to identify known technical weaknesses, outdated software, missing patches, and configuration issues across systems and devices. 

Penetration tests go a step further. Qualified security professionals simulate real-world attacks to determine whether identified weaknesses can actually be exploited and how far an attacker could potentially move through the environment. 

Think of a vulnerability scan as finding unlocked doors. A penetration test evaluates what could happen if someone actually tried to walk through them. 

What Could Change Under the Proposed Rule? 

The current HIPAA Security Rule requires organizations to identify risks to electronic protected health information (ePHI) and implement reasonable safeguards, but it does not prescribe a specific vulnerability-scanning or penetration-testing schedule. 

If finalized as proposed, that would change. 

Covered entities and business associates could be required to: 

• Conduct automated vulnerability scans at least once every six months, or more frequently based on their risk analysis 

• Perform penetration testing on relevant electronic information systems at least once every 12 months, or more frequently when warranted 

• Use qualified individuals to perform penetration testing 

• Continuously monitor authoritative sources for newly identified vulnerabilities 

• Address identified vulnerabilities through established patch-management and risk-management processes 

How Healthcare Organizations Can Prepare Now 

Organizations do not need to wait for a final rule to strengthen these practices. 

Start by reviewing which systems contain or interact with ePHI and determining whether they are currently included in regular vulnerability scanning. From there, work with your internal IT team or managed service provider (MSP) to establish testing schedules, assign responsibility for remediation, document findings, and verify that identified weaknesses are actually corrected. 

Penetration testing may also require outside expertise, particularly for smaller organizations without dedicated security personnel. 

The goal is not simply to complete another compliance task. These activities help healthcare organizations understand where weaknesses exist before an attacker finds them. 

Building these processes now can strengthen patient data protection today while making future compliance requirements easier to manage if the proposed rule is finalized. 

The post Beyond the Checkbox: Mastering Vulnerability Scans and Penetration Testing for the 2027 Proposed HIPAA Rules appeared first on HIPAA Secure Now!.

Healthcare organizations rely on an increasingly complex web of EHR platforms, cloud services, medical devices, applications, vendors, and business associates. But when it comes to HIPAA compliance, knowing where electronic protected health information (ePHI) is stored isn’t enough, you also need to understand how it moves. 

A comprehensive network map should document the systems and technology assets that interact with ePHI, while clearly illustrating how that information flows into, through, and out of the organization. This visibility is fundamental to an effective security risk analysis. After all, it is difficult to identify risks to ePHI when you don’t have a complete picture of the systems, connections, and third parties that may affect it. 

This is becoming even more important under HHS’s proposed updates to the HIPAA Security Rule. The proposed rule would explicitly require regulated entities to maintain a technology asset inventory and a network map illustrating the movement of ePHI, updating them at least annually and when environmental or operational changes may affect ePHI. 

For healthcare organizations, that means documenting more than servers and workstations. Cloud-hosted EHRs, backup providers, connected systems, remote environments, and relevant business associates may all need to be considered when mapping the ePHI ecosystem. 

Importantly, these Security Rule changes remain proposed, not final, and the current HIPAA Security Rule remains in effect. But organizations shouldn’t wait for a compliance deadline to gain visibility into their environments. 

A complete network and ePHI data-flow map isn’t just documentation, it’s the foundation for understanding risk and protecting patient information. 

The post Mapping ePHI: Why Network Visibility Is Essential for HIPAA Compliance appeared first on HIPAA Secure Now!.

Another proposed change to the HIPAA Security Rule involves network segmentation. While the term may sound technical, the concept is fairly straightforward. 

What is Network Segmentation? 

It is a security control that divides your network into separate areas. The goal is to limit how far an unauthorized user can go if they gain access to your organization’s systems. If someone gets through one door, you do not want them to suddenly have keys to every room in the building. If an attacker compromises one computer, account, or system, network segmentation can help prevent them from automatically reaching other systems that contain sensitive information, including electronic protected health information (ePHI). 

Where Do You Start? 

Before you can segment your network, you first need to understand where your PHI lives. 

• Is ePHI stored on your servers? 

• Is ePHI being sent or stored in email? 

• Is ePHI contained within your EMR or EHR? Do you have any legacy systems? 

• Is there any medical equipment that contain hard drives with ePHI? 

• Are employees storing PHI on workstations, laptops, smartphones, or shared drives? 

• Are there other applications or cloud systems that contain PHI? 

Once you understand where PHI is located, your IT team or managed service provider (MSP) can determine how those systems should be separated from other parts of your network. 

Why Does This Matter?  

Strong cybersecurity includes limiting the damage when something does happen. Without segmentation, an attacker who gains access to one part of your environment may be able to move through the network and access additional systems. With segmentation, you can create barriers that make that movement more difficult. An unauthorized user gaining access to one system should not automatically mean they have access to everything. Start by identifying where your PHI lives, then work with your IT provider to determine whether appropriate barriers exist between critical systems and the rest of your network. 

The post Network Segementation & The Proposed HIPAA Security Rule appeared first on HIPAA Secure Now!.