TRANSMISSION ACTIVE

// FREQ: HEALTHCARE EPISODE: 019 STATUS: SECURE

019 Identity Attacks, Vendor Breaches, and Everything You Need to Know About HIPAA

Identity abuse has overtaken network exploits as the dominant breach vector across every industry in 2026 — and in healthcare, identity attacks and third-party vendor breaches together are now the leading causes of HIPAA-reportable breaches. This transmission delivers two missions in one episode: the cross-industry intel drop on the threat landscape every executive must understand, and the foundational HIPAA briefing every healthcare leader needs from the ground up. What HIPAA actually requires. The Privacy Rule and Security Rule distinction. The Covered Entity and Business Associate categories. The 2026 OCR enforcement reality including the four civil penalty tiers and the criminal exposure that can put executives in prison for up to ten years. And the three marching orders every healthcare leader must execute this week to close the gap between the threat and the framework.

JUMP POINTS //

00:23

Identity Abuse Has Overtaken Network Exploits

The dominant attack vector in 2026 is no longer threat actors hunting for unpatched systems — it’s threat actors walking through the front door with stolen credentials, hijacked sessions, bypassed MFA, and compromised OAuth flows. Every industry uses credentials. Healthcare issues them to thousands of clinical staff across hospitals, clinics, and remote care. The number of credentials in circulation has exploded — and AI agents are about to make it exponentially worse.

04:37

The Vendor Breach Pattern Compounding the Threat

The Oncology Institute breach. The ShareFile, Nextcloud, and OwnCloud cluster hitting aviation, defense, healthcare, utilities, telecom, legal, real estate, and government simultaneously. Identity abuse and vendor breaches are not two separate threats — they are the same threat operating at two layers. One vendor compromise can expose dozens of downstream organizations. Your security posture is now tied to the weakest vendor in your supply chain.

07:08

The Three Universal Marching Orders

Three actions every organization — healthcare, GovCon, finance, tech — must execute this week. Enforce MFA on every account including administrative ones. Run the credential hygiene audit against current HR rosters. Inventory your vendors and verify their credential management practices, not just their attestation reports.

09:25

What HIPAA Actually Is and Who It Applies To

The foundational walkthrough. HIPAA passed in 1996 for insurance portability. The Privacy Rule finalized in 2003. The Security Rule finalized in 2005. The three categories of Covered Entities — providers, health plans, and healthcare clearinghouses. The Business Associate definition that most executives underestimate. And what actually counts as Protected Health Information.

16:42

Privacy Rule vs Security Rule

The Privacy Rule is records management. The Security Rule is technology management. The Privacy Rule tells you what to protect and who gets to see it. The Security Rule tells you how to protect it once it’s in your systems. Administrative, physical, and technical safeguards mapped to operational controls.

19:59

HIPAA Enforcement in 2026

The Office for Civil Rights, the Breach Notification Rule, the 500-record reporting threshold, and the four civil penalty tiers — from $137 per violation at Tier 1 to over $2 million in annual caps at Tier 4. And the criminal exposure: up to ten years in prison for executives where intent to sell, transfer, or use PHI is involved.

22:50

The Three Healthcare Marching Orders

Run the credential audit this week. Inventory your Business Associates this month. Conduct a HIPAA Security Rule Risk Assessment this quarter. The biggest HIPAA penalty isn’t a financial fine — it’s executive prison time. And as an executive, you don’t want to spend any time in prison.

// INCOMING SITREP

Want the operational build guide for the HIPAA Security Rule Risk Assessment? The companion Sitrep walks through the eight components, the quarterly cadence, and the three failure modes that turn the Risk Assessment into a willful neglect finding. Read the SITREP dossier.

ACCESS THE BRIEF »

TRANSMISSION LOG //

Two Missions in One Briefing

This transmission delivers two missions in a single episode. The first five minutes cover the threat landscape affecting every industry we serve — healthcare, GovCon, finance, and the tech sector. The remaining briefing is the foundational HIPAA walkthrough every healthcare executive needs from the ground up.

The bridge between the two segments is the operational truth: identity attacks and vendor breaches are now the leading causes of HIPAA-reportable breaches in 2026. The cross-industry threat lands hardest on healthcare organizations precisely because healthcare environments contain the highest volume of identifiable patient records, the broadest credential footprint, and the most extensive web of Business Associate relationships of any industry the threat actor economy targets.

The Shift in Attack Vectors — Why Identity Is the New Perimeter

In years past, the dominant attack pattern was an outside threat actor exploiting an unpatched vulnerability to gain a foothold. Bad actors hunted for systems that hadn’t been patched, ports that were exposed, services that were misconfigured. The defensive playbook was patch management, vulnerability scanning, and perimeter hardening.

Today, the dominant attack pattern is fundamentally different. Threat actors are walking through the front door with stolen credentials harvested from the dark web. They’re hijacking authenticated sessions to bypass MFA entirely. They’re exploiting deepfake voice-based social engineering against IT help desks to get password resets pushed through by sympathetic technicians. They’re running MFA fatigue attacks that pummel users with authentication prompts until someone clicks approve just to make it stop. And they’re using AI-assisted credential harvesting at scale across breach databases to enumerate working combinations of usernames and passwords across thousands of services simultaneously.

The frame that captures all of this is identity abuse. Credential theft sounds like it’s just stolen passwords. It is not. Identity abuse is the umbrella. Stolen credentials are just the most visible piece.

Why This Hits Every Industry — Not Just Healthcare

The reason identity attacks are universal across every WatchUr6 ICP is structural. Every industry uses credentials to log in.

Healthcare organizations issue credentials to thousands of clinical staff across hospitals, clinics, and remote care environments. As care delivery expanded into the home — patients discharged faster, home health monitoring, telehealth — the credential footprint exploded across devices and locations the organization no longer directly controls.

GovCon contractors issue credentials to subcontractors, primes, and vendors all accessing the same CUI environments under DFARS flowdown requirements. The credential chain extends through every tier of the supply chain.

Tech startups issue credentials to engineers with production database access. Small teams wearing multiple hats means broad access permissions across systems. The principle of least privilege gets sacrificed for velocity.

Financial institutions issue credentials to wealth managers, compliance teams, and SaaS integrations connecting to every client portal in their book of business. Every client wanting on-demand visibility into their data multiplies the credential footprint exponentially.

And the threat is about to get worse, not better. Organizations are now issuing credentials to AI agents — autonomous and semi-autonomous systems that authenticate, take actions, and access data on behalf of users. Every AI agent is a new credential surface. The number of credentials in circulation inside the average enterprise has exploded, and the trajectory is accelerating.

In the last 30 days, the Mini Shai-Hulud variant compromised multiple enterprise environments through credential theft. The Zestix Initial Access Broker has been actively selling stolen corporate credentials on the dark web — affecting aviation, defense, healthcare, utilities, telecom, legal, real estate, and government simultaneously. Credential theft is so big it has become its own industry.

The Vendor Breach Pattern Compounding Identity Attacks

The second cross-industry threat operating in tandem with identity abuse is the third-party vendor breach pattern.

Some of the largest healthcare breaches in the last 90 days were not the breached organization’s direct fault. The Oncology Institute disclosed a third-party data breach earlier this year — the Covered Entity itself did nothing visibly wrong. Patients were still exposed because the failure occurred inside a software service vendor’s environment. The breached organization did the right things, and the breach happened anyway through a vendor relationship.

The ShareFile, Nextcloud, and OwnCloud cluster of breaches across the last quarter exemplified the compounding effect. Threat actors stole highly sensitive corporate data — including health records and government contracts — from multiple cloud collaboration platforms simultaneously. Aviation, defense, healthcare, utilities, mass transit, telecom, legal, real estate, and government all hit at once. The breach cause: stolen credentials and lack of multi-factor authentication on the vendor side.

This is what we mean when we say your security posture is now tied to the weakest vendor in your supply chain. And the difficult operational truth is that you can only do so much. You can verify they have MFA enforced. You can request their SOC 2 Type 2 report. You can execute audit rights in your contract. But ultimately you are accepting their attestation that the controls are operating as documented — and you have limited ability to independently verify the day-to-day operational reality on their side.

Why Identity Attacks and Vendor Breaches Compound

Identity abuse and vendor breaches are not two separate threats. They are the same threat operating at two layers. One vendor compromise can expose dozens of downstream organizations simultaneously. As more organizations migrate to SaaS-based outsourced services rather than maintain their own infrastructure, the math gets worse. You are one customer in a list of 50 or 100 other customers on the same vendor platform. You are separated logically by security controls. When the vendor gets breached, every customer on that platform is potentially exposed — and the threat actor inherits credentials from every tenant simultaneously.

This is the loudest theme of 2026: the breached organization did the right things, and the breach happened anyway.

The Three Universal Marching Orders

Regardless of industry — healthcare, GovCon, finance, or the tech sector — three actions close the most leveraged gap on both identity attacks and vendor exposure this week:

First: Enforce MFA on Every Account, Including Administrative Ones.

When you ask your staff if MFA is enabled, they will tell you yes — and they will mean it. But the reality on the floor is often that administrators have turned off MFA on their own administrative accounts because it slows down operational work. Everyone should know better by now. Many don’t. It only takes one administrative account without MFA — and that’s the one the threat actor finds. There are documented incidents where attackers obtained credentials for endpoint management platforms like Intune and wiped entire fleets of managed devices. MFA on everything. No exceptions for convenience.

Second: Run a Credential Hygiene Audit.

Pull the list of every active account in your identity provider. Compare it against your current HR roster. Perform continuous access reviews. Enforce the principle of least privilege. These are the basics of having accounts in a modern enterprise — and the basics are where most organizations are failing.

Third: Inventory Your Vendors and Verify Their Credential Management.

Don’t just sign the contract that says they provide security. Execute on your audit clauses. Audit them. The Oncology Institute breach happened because that verification gap existed downstream of an otherwise compliant Covered Entity. Your vendor inventory is your liability inventory.

A Foundational Walkthrough of HIPAA

Most healthcare executives have heard HIPAA referenced thousands of times. Many of them have never had it explained from the ground up. Here is the foundational briefing.

HIPAA — the Health Insurance Portability and Accountability Act — was passed in 1996. The name explains the original purpose. The “portability” piece allowed patients to keep coverage when they changed jobs, moved from one insurance carrier to another, or switched providers. The “accountability” piece ensured that when records moved between organizations, patient privacy was preserved.

As the healthcare industry digitized and patient records transitioned from paper charts to electronic systems, HIPAA evolved. Two main regulatory frameworks now operate together: the Privacy Rule, finalized in 2003, and the Security Rule, finalized in 2005. There was a meaningful gap between HIPAA’s original passage and the addition of the Security Rule — for years, HIPAA was primarily a records-handling framework. As technology became more central to healthcare operations, the regulation had to catch up.

Who HIPAA Applies To — The Covered Entity Categories

HIPAA applies to three categories of organizations called Covered Entities:

Healthcare Providers

Anyone who provides care to patients. Hospitals, clinics, individual doctor practices, dentists, pharmacies, urgent care centers, home health agencies, nursing facilities.

Health Plans

The payers. Insurance companies, HMOs, employer-sponsored health plans, Medicare and Medicaid programs.

Healthcare Clearinghouses

Organizations that process health information between providers and payers. This category is small in number but enormously consequential. The Change Healthcare ransomware attack that crippled the U.S. healthcare payment system was devastating precisely because Change Healthcare is a healthcare clearinghouse processing transactions between virtually every provider and every plan in the country.

If your organization transmits Protected Health Information electronically as part of standard healthcare transactions, you are a Covered Entity and HIPAA applies to you.

The Business Associate Category Most Executives Underestimate

The fourth category of HIPAA-regulated organizations is Business Associates — and this is the category that connects directly back to the vendor breach pattern.

A Business Associate is any third party that handles PHI on behalf of a Covered Entity. Examples include: a claims processor working for a health plan, an MSP monitoring a hospital’s network, a cloud storage provider hosting backups, a medical transcription service, a billing company, an IT contractor, a legal firm reviewing patient records during litigation, a marketing vendor managing patient communications.

The point of confusion that derails many healthcare executives: a Business Associate doesn’t have to look at PHI directly to qualify. An MSP that monitors the network without ever opening a patient file is still a Business Associate — because if their credentials were breached, someone could potentially access PHI through that access. Indirect exposure is still exposure under HIPAA.

Every Business Associate must sign a Business Associate Agreement — a BAA — that contractually mandates the Business Associate to follow HIPAA. If the Business Associate fails to comply, the Covered Entity that engaged them carries responsibility under the agreement. The Covered Entity is responsible for ensuring its Business Associates are following HIPAA. Your BAA inventory is your liability inventory.

What Counts as PHI

Protected Health Information is any individually identifiable health information. This includes names, dates, medical record numbers, social security numbers, photos, and biometric identifiers — combined with information about a person’s physical or mental health.

The key word is combined. A name alone is not PHI. A diagnosis alone is not PHI. A social security number alone is not PHI. It is the combination of an identifier plus health data that creates PHI. But that’s why you still have to protect every single identifier field — because if a threat actor obtains a name from your system, then obtains another piece of data that connects that name to a medical condition, you are liable for that combination.

The Privacy Rule Versus the Security Rule

This is where most healthcare executives lose the thread. Here is the cleanest way to remember the distinction:

The Privacy Rule is records management. The Security Rule is technology management.

The Privacy Rule governs who can access PHI, under what circumstances, and for what purposes. It defines data ownership, data custodianship, and the legitimate uses of PHI — Treatment, Payment, Healthcare Operations. It establishes patient rights — the right to access their own records, the right to request corrections, the right to know who has accessed their information. The true data owner is always the patient. Inside the organization, accountability typically sits with a designated Privacy Officer.

The Security Rule governs how PHI is technically protected when it exists in electronic form — called ePHI (electronic Protected Health Information). It requires administrative, physical, and technical safeguards. These map directly to operational controls. An administrative safeguard might be an access policy requiring every user to have a unique identity. A physical safeguard might be facility access controls preventing unauthorized entry to data centers. A technical safeguard might be encryption of all ePHI at rest and in transit.

The Security Rule is the framework most directly affected by the identity attacks and vendor breaches discussed at the top of the episode. Access controls, audit controls, transmission security, and workforce security policies are all what determine whether a stolen credential or a compromised vendor actually leads to a breach.

The Privacy Rule tells you what to protect and who gets to see it. The Security Rule tells you how to protect it once it’s in your systems.

HIPAA Enforcement in 2026

When HIPAA is violated, the agency that comes after you is the Office for Civil Rights — OCR — operating under the Department of Health and Human Services. OCR investigates breaches, conducts compliance audits, levies financial penalties, and refers the most serious cases to the Department of Justice for criminal prosecution.

The Breach Notification Rule

When a breach of unsecured PHI affecting 500 or more individuals occurs, the Covered Entity must notify affected individuals within 60 days of discovery, report the breach to OCR within the same 60-day window, and notify prominent media outlets in the affected region. These breaches are documented on the OCR public breach portal — colloquially known as the “Wall of Shame” — which remains publicly searchable indefinitely.

Breaches affecting fewer than 500 individuals must still be reported to OCR, but only annually. They are not exempt from reporting. The threshold determines the cadence, not whether you have an obligation.

The Four Civil Penalty Tiers

HIPAA penalties are tiered based on culpability. The investigator determines the tier based on duty of care, controls in place at the time, and how diligently the organization tried to protect PHI.

Tier 1 — Lack of Knowledge: Minimum $137 per violation, capped at roughly $34,000 per identical violation per year.

Tier 2 — Reasonable Cause: Minimum $1,379 per violation, capped at roughly $137,000 per identical violation per year. The organization knew or should have known but did not act with willful neglect.

Tier 3 — Willful Neglect, Corrected: Minimum $13,785 per violation, capped at roughly $344,000 per identical violation per year. The organization knew something was likely to happen, but corrected it once it occurred.

Tier 4 — Willful Neglect, Uncorrected: Minimum $68,928 per violation, with annual caps now exceeding $2 million per violation type. The organization knew and did nothing.

The difference between the tiers — particularly between Tier 1 and Tier 3 — often comes down to whether the organization had a current Risk Assessment that identified the threat and documented the safeguard decisions made to address it.

Criminal Penalties

Knowing violations of HIPAA can escalate beyond civil penalties into criminal prosecution. Up to one year in prison for knowing violations. Up to five years for offenses committed under false pretenses. Up to ten years in prison for offenses committed with intent to sell, transfer, or use PHI for commercial advantage, personal gain, or malicious harm.

Yes, executives at Covered Entities can go to prison for HIPAA violations. The fact pattern is rare, but it is not zero. And as the CISO put it on the episode: as an executive, you don’t want to spend any time in prison.

The Three Marching Orders for Healthcare Leaders

The cross-industry threats covered at the top of the episode — identity attacks and vendor breaches — connect directly to HIPAA compliance. Three concrete actions close the gap between the threat and the framework.

Marching Order 1 — Run the Credential Audit This Week.

Cross-reference active accounts in your identity provider against your current HR roster. Disable everything that no longer maps to a current workforce member. This is the single most leveraged action against the identity attack threat.

Marching Order 2 — Inventory Your Business Associates This Month.

You probably have BAAs in place that haven’t been reviewed in years. Verify every BAA is current and executed. Identify any vendor relationship where PHI is changing hands without one. Verify the Business Associate’s ongoing security posture rather than accepting the original contractual attestation as permanent truth.

Marching Order 3 — Conduct a HIPAA Security Rule Risk Assessment This Quarter.

If properly structured, the Risk Assessment can be reviewed and updated on a quarterly cadence rather than rebuilt from scratch each cycle. The Risk Assessment is the operational map that converts the 2026 threat landscape into HIPAA-specific safeguards. It is also the first document OCR will request if a breach occurs in your environment. A missing or outdated Risk Assessment is the single fastest path to a Tier 3 willful neglect finding.

Execute the Standard

Identity attacks and vendor breaches are the dominant breach vectors across every industry in 2026. Healthcare is no exception. The operational truth is that a stolen credential or a compromised vendor walking into an unprepared healthcare environment is the breach that lands on the OCR portal, the patient notification letter, and the executive’s reputation — and in extreme cases, on the criminal docket.

Mission success starts with closing the gap between the threat and the framework. Trust but verify your own posture. Run the credential audit. Inventory your Business Associates. Update the Risk Assessment.

Execute the standard. We’ll see you next week.

// DECODED TRANSCRIPT

Access the full text logs of this transmission for compliance and review purposes.

Actual (00:00)
Welcome to Status Secure. Today we’re covering identity attacks that are crippling organizations across every sector, the vendor and third party breach pattern that is amplifying those attacks. And then we’re going to get into everything you need to know about HIPAA. So CISO, let’s start with identity. What is the dominant attack vector right now in twenty twenty six and why is it different from what we saw two, three years ago?

The CISO (00:23)
well, in the past, you know, ⁓ bad actors just tried to get into your network, right? Like, ⁓ through network exploits, right? In unpatched systems, just knocking on the door, trying to find holes, right? Like that was their modus operandi, right? But now it’s shifted, right? The the dominant attack pattern, you know, from an outside ⁓ threat

is now you know is now credentials, right? Is now they’re looking for stolen like usernames and passwords on the dark web, ⁓ so session tokens, they’re trying to bypass MFA, right? Or they’re ⁓ hijacking the you know the authorization, right? ⁓ the authentication and authorization process. You know.

this is that this has become a lot more lucrative for them and in some aspects easier for them because people are human and you know make mistakes, give out passwords, ⁓ click phishing links, you know. and you know the reason this hits every industry is because every industry uses credentials, right, to log in.

you know, the the bigger your organization, the more the the more opportunities that actor has, right? So like in healthcare organizations, they issue credentials to thousands of clinical staff across hospitals, clinics, remote care, and especially ⁓ as the workforce and the ⁓

And the operating environment becomes more expanded into remote devices, right? and to remote environments like working remotely or ⁓ in the case of health care, w you know, when you go now, you don’t stay in the hospital very long. They send you home and you have home care. so think about you know all the devices and all the opportunities when your care is now in your home.

So, you know, Gov you know, GovCon, right, in the government contractor space. They issue c credentials to subcontractors, to vendors and primes, right? ⁓ in the tech startup. They issue credentials to engineers.

And they’re giving out access to everything. They have small, they have a small group of workforce. So everybody wears multiple hats. So they’re gonna get a lot of access, right? financial institutions. They give credentials to wealth managers, compliance teams, you know, all the SaaS integrations to all of their clients, right? Because everybody wants it at you know, everybody wants to be able to see their data ⁓ on demand.

So now all your clients have access to financial data. the number of credentials in circulation ⁓ in the inside the average enterprise has exploded. And now it’s actually gonna get worse because now you’re giving credentials to AI agents, right? That’s just, you know, that is just exponentially increasing the available credentials that bad actors can ⁓ you know, can can look for, right? And can ⁓

exploit. So in the last thirty days, the mini Shea Hullet vr variant comprised multiple enterprise environments through credential theft. Right. So they’re they like ⁓

⁓ the I mean these are just examples of the threat landscape, right? That’s just one. There’s Zestix initial access broker, right? They they’re selling stolen corporate credentials on the dark web. I mean, we’ve this has been going on for a long time, but now they’re just able to like sell more. and it’s not a single industry. And think about it.

It’s so big that it became its own industry selling stolen credentials. Right? So why identity abuse is the you know, why we need to talk about it? So credential theft makes it sound like the threat is just stolen passwords. It’s not.

mean the modern attack chains include stolen sessions, hijacked OAuth tokens, deep fake voice-based social engineering against IT help desk, MFA fatigue attacks, and AI assisted credentials harvesting at scale. Identity abuse is the umbrella. Stolen credentials are just the most visible piece, right? So even though we just talked a lot about, you know, user credentials, it’s the whole it’s the whole ecosystem of access.

Actual (04:37)
Yeah, and then there’s the vendor breach pattern compounding on top of the identity attacks. So can you walk us through that? because some of the biggest headline breaches of the last ninety days were not the breached organizations’ fault directly,

The CISO (04:51)
yeah, so like let’s look at the oncology institute patent, right? so earlier this year the oncology institute disclosed a third party data breach. The covered entity itself did nothing visibly wrong, right? Patients were still exposed because the failure occurred inside a software service vendor system. And it’s a ⁓ we’ve known that third parties are, you know, ⁓ your supply chain is is a concern. It is a huge concern. It continues to be.

That’s the quiet version of the loudest theme of twenty twenty six. The breached organization did the right things and the breach happened anyway through a vendor relationship. Right.

⁓ Share Files, NextCloud, and Own Cloud clusters. Across the last quarter, three actors stole highly sensitive corporate data, including health records and government contracts, from multiple cloud collaboration platforms simultaneously. Aviation, defense, healthcare, utilities, mass transit, telecom, legal, real estate, government. All hit at once. The breach caused, stolen credentials, and lack of multi-factor authentication on the vendor side.

Your security posture is now tied to the weakest vendor in your supply chain. Right? I mean we are we’ve always we’ve known that for a while, but it’s so hard because this is your vendor. You can only do so much, right? You can you can try and verify that they have MFA, right? but you have to basically accept what they they tell you or accept a lot of times they submit a stock to or some other ⁓ attestation.

And you just have to accept that. That’s that’s the price of doing business these days. Why this compounds with identity attacks? Because identity abuse and vendor breaches are not two separate threats. they’re the same threat operating at two layers. ⁓ you know.

When you have like one vendor compromise can expose dozens of downstream organizations, that’s the thing, because now a lot of companies outsource, right? Outsource things, use third-party tools, right, on a SaaS platform versus having to have their own infrastructure and bringing it in-house. Right. And so you you are one customer in like 50 or 100 other customers on that same platform.

Right? You’re separated logically by security. So now if that vendor gets breached, it’s not just that vendor, it’s their entire client. Their entire client list. And if you’re one of those clients, unfortunately, that’s you. That’s you. Right.

Actual (07:08)
And and so if I’m listening to this, regardless of you know what industry I I’m in, what can I do this week to help close the gap on both identity attacks and vendor exposure?

The CISO (07:19)
And the first the first thing is make sure your MFA is on. You know, I mean sometimes when you ask your staff, they’ll tell you, Yeah, we have MFA and then, you know, y you do, but not on everything.

Right. Not on all and sometimes administrators turn off MFA for administrative accounts because it’s time consuming. Everybody should know better now. But sometimes they don’t, right? there are and it only takes one one incident, one one case of not turning on MFA, and that’s the one that the bad actors obtain and then you’re done.

So, you know, I I know of a case where ⁓ the they actually got the credentials. I think we talked about in a previous episode where they got the credentials for Intune and then they wiped all of you know, so make sure MFA is on for everything. you know, do ⁓ basically do a credential hygiene audit, right? Make sure you’re auditing

you know that all the list pull all the list of active accounts right and then make sure you’re comparing that against HR do do do access reviews like ⁓ on a continuous basis right make sure that you are doing least privileged right making sure you have MFA I mean that these are your these are your credential hygiene like that’s the basics of ha of create of having accounts now right third is inventory your vendor

and verify their, you know, their credential management, right? Their account management. Make sure, like don’t just, you know, don’t just accept you know, sign the contract that says that they are going to provide security. You know, make sure you actually execute on your audit clies, audit them.

Actual (09:02)
Yeah, and this is something we say often on this podcast is trust but verify. Right. And and so going back to what we’re talking about, here’s why both of these threats land the hardest in healthcare specifically. identity attacks and vendor breaches together are the leading cause of HIPAA reported breaches. And so with that as a setup, let’s get into HIPAA as we transition kind of into that for this episode.

So why don’t you give us the foundational walkthrough? You know, most healthcare executives have heard of HIPAA, they know about it. it’s been referenced a thousand times. Many of them have never heard maybe it explained from the ground up. Like where does it come from and what does it actually require?

The CISO (09:39)
so HIPAA, which is the which stands for Health Insurance Portability and Accountability Act, was passed in 1996.

⁓ so just like the the title says portability, right? So this was to allow patients to keep coverage when they went from one, you know, when they changed jobs, right? And they went from one insurance carrier to another, or they changed from one doctor to another, you know, doctor, which ⁓ anybody who provides care is called providers in in healthcare. So and payers are your insurance organi organizations, right? So that’s the main purpose was the

portability, but when you are moving records around, you want to make sure that you know people’s privacy is still maintained, right? So that’s the accountability part of the act.

You know, this was to make sure that when you’re moving healthcare records, that it’s so you know, that the the patient’s privacy is protected and that there’s security on those. And as the industry digitized, right, ⁓ you know, the patient records moved from paper charts into electronic systems. So HIPAA in its modern form is two main regulatory frameworks that operate together. ⁓ the privacy rule, which was finalized in 2003, and the security rule, which finalized

license 2005. So you can see there were several years where it was basically, you know, the HIPAA was very much just around like, when you move health information, just make sure that it’s you know, it’s that other people don’t see it.

Then with modern technology and records being digitized, they were like, hey, we need to we need to make this stronger, right? We need to make sure that, you know, as technology is being used more, that technology is also following the rules, right? yeah, and then it gets confusing because each role is actually does different things, but most executives kind of put them together, right? the privacy part and the security part. But

they need to really understand the difference between the two.

And then, you know, HIPAA applies to and and then so now it’s like, well, who who who has to follow HIPAA, right? it’s what is called covered entities, in the in in the role, right? And there’s three categories. You have your healthcare providers, like I mentioned, right? These are they provide services to patients, hospitals, clinics, individual doctor practices, dentists, pharmacists, right, pharmacies.

Health plans. So health plans, these are your payers, the insurance companies, HMOs, employee-sponsored plans. Right? And then you have healthcare clearing houses, ⁓ organizations that process health information between providers and payers. So this is you remember United Healthcare that you know that had that huge. they’re a healthcare clearinghouse. That’s why that

You know, that ransomware attack was so devastating and so impactful because they process the health information between the providers and the plans. So if your organization transmits ⁓ PHI, which is protected health information, you know, electronically as part of you know, standard healthcare transactions, you are what’s considered a covered entity. Okay, and HIPAA applies to you.

And ⁓ and so another one is business associates. So if you’re a covered entity, like who who does business or who works for you ⁓ or does or touches data for you, right? ⁓ they’re considered business associates.

This is the category that most healthcare executives underestimate. And the one that lies directly to the vendor breach conversation. A business associate is any third party that handles PHI on behalf of a covered entity. So let’s say, for instance, I’m I’m a plan, right? you know, I’m a plan, I provide health insurance, but

I hire a company, right? I hire a company to just review just to process my claims, right? So like when providers submit claims for care, you know, ⁓ for patients,

My plan employees don’t review it and move it to the next stage. I hire an a third party to just review the claim, make sure that it’s, you know, that it’s the claim is ⁓ documented in the right way, and then they push it along the process, right? Well, that company is a business associate. You hire a company to provide you like an MSP to provide you like

augment augmented staff to you know just monitor the network. So they’re not looking at PHI, but they’re monitoring the network. That they’re still considered a business associate. This is this is why like some some executives think no, then they’re not a bus they’re not a business associate because they don’t look at PHI directly. That’s not true.

Like if their credentials were breached, they you somebody could get access to PHI. So they’re considered a business associate. Okay.

And every single one of these, right, they have to sign what’s called a BAA, a business associate agreement, which which mandates, which inside mandates that business associate to follow HIPAA, right? And if they don’t, then you actually as the person ⁓ as the organization that has this agreement with them, because it’s your responsibility to ensure that your business associates are following HIPAA.

So protected, so what is HIPAA actually, so protected health information is any any individually identifiable health information. And so, but but you know, when they say name, dates, medical records, social security numbers, photos, biometric identifiers, right? you have to remember that if I have just your name, is that PHI?

No, it’s not. So I have to have your name and I have to have like your like your medical record number. Or I have to have, you know, I I have to be able to connect an individual patient with their medical information and that becomes PHI. Uh-huh. And but that’s why you still have to like protect

you know, your ⁓ just the name field. Because if they get the name from you, but they get you know, and they can connect that to another piece of ⁓ data in your system and then together they can identify medical history for for someone, then you know, then you’re you’re liable. and you have to think about that, right? So you have to remember that. So there’s, you know,

All kinds of things, but combined, so you see, combined with information about a person’s physical or mental health. So just because they have social security numbers, that’s not PHI. You have to be able to combine it with something else. So the combination of identifiers plus health data is what makes information PHI.

Actual (16:18)
Got it. Yeah, and and I know as we’re we’re talking about this, you know, some terms that are gonna you know, we’re gonna go back and forth with privacy and security and I maybe sometimes you know we might think of them as one of the same. And so for those of us who don’t really understand the differences, could you kinda break down in in especially in regards to HIPAA, can you break down the difference ⁓ between like the privacy rule and the security rule?

⁓ so that we can have a better understanding of what they are.

The CISO (16:45)
Sure. So like the privacy rule. An easy way for for me, a lot of times an easy way to remember is this. The privacy rule is around records management. The security rule is around technology management. Right? So the privacy rule governs who can access PHI. So when you talk about records management, it’s it’s what’s a record, which is PHI. the owner, right? data owner.

who who owns the data. data custodians, right? Is you know, and so it’s it’s really around records management. So under what circumstances, for what purpose can, you know, can people access the data? The data owner decides that, right? It establishes the rights the patient’s rights, the right to access their own records, the right to request corrections, the right to know who has access to their information. So you can see this is all around the the

you know, the management of data, right? And the data owner, the the real data owner is always the ⁓ is actually always the the member, right? Or or in the

in the company, in the organization, it’s usually like usually you’ll have a privacy officer, right? You have an executive that’s accountable, right, for for this. It defines the legitimate use of PHI, right? Like treatment, payment, healthcare operations. It restricts disclosures and requires patient authorization for most. So you can see these are these are like business requirements, right? Okay, so so the easiest way is to remember that pri privacy rule is around, you know, records management.

data man like ⁓ from a business perspective. The security rule on the other hand governs how PHI is technically protected when it exists in electronic form. And so when it’s in electronic form they add a little E in the front of PHI, right? Electronic protected health information.

it requires administrative, physical, and technical safeguards. It’s the framework that most directly affected by the identity attack and vendor breach because the security is what defines access controls, audit controls, transmission security, and the workforce security policies that determine whether a stolen credential or compromised vendor actually leads to a breach. So it says it says administrative, physical and technical safeguards. Those can be mapped to controls. What’s an administrative control?

Right. what’s a physical control and what’s a technical control? You can map that, right? So like administrative control ⁓ could be something like, you know, ⁓ you have an access you have an access policy that you know every user only gets one identity, one unique identity, right? ⁓ physical. This is really around ⁓ protection of your data centers, right? Who can access the data center?

technical safeguards. This is, you know, that you know all all PHI must be encrypted at rest and in transit. So, you know, the privacy tells you what you must protect and who gets to see it. And the security rule tells you how you protect it once it’s in your systems.

Actual (19:43)
so now that we have a good understanding of that and ⁓ a better understanding of HIPAA in general, can you talk to us about what HIPAA enforcement looks like in twenty twenty six? what maybe what would trigger an investigation or like, you know, what what the consequences could be if something like that occurs.

The CISO (19:59)
Okay. So first, ⁓ who you know, who’s going to come after you, basically, right? And that’s the Office of Civil Rights, OCR. Mm-hmm. And they’re under CMS, which is ⁓ you know, they they are they cover ⁓ Medicare, Medical, right? The but they’re the ones that will come after you.

They’re under the Department of Justice. and they’ll what they’ll do is they will investigate, send it to the Department of Justice, and then, you know, you’re off to ⁓ fines and penalties. Okay. At that point. ⁓ the breach notification rule what this says is that you have to have it ha the breach has to affect more than five hundred people. ⁓ at that point you have to report it to OCR. you know, you have when you once you like once you

notify OCR once you know that you have a breach, you have sixty days to notify the individuals who were affected. Right? That’s the breach notification rule. civil penalties, so civil penalties,

before I go to that, anything anything less than five hundred because I don’t want people to think that if I have four hundred and ninety nine, I don’t have to do anything. If you have five hundred if it affects five hundred, ⁓ you know, then you have to ⁓ just report it annually, right? And you get like on a wall of shame. But ⁓ but you don’t have to report right away. That’s the difference. Okay. Civil penalty tiers. So on there, this is based on like

Like when they go and do an investigation, it’s based on, you know, like what did you do? What your your d you know, your your duty of care, right? what controls did you have in place? how how hard how much did you try to protect your members the PHI, right? And there’s different tiers. I’m not gonna go through them, you can look them up, but basically there’s tier one, you know, ⁓ you didn’t know, and that’s like

a minimum of $137 per violation capped at 34,000. Tier two is reasonable cause, right? That means you did you knew and you didn’t you didn’t do anything. That gets higher, right? And then ⁓ tier three willful neglect means that you you absolutely knew that something was gonna happen, but you didn’t do anything ⁓ anyway, right? Tier four is ⁓ you know

Well, I take that Tier three is like you knew, you knew and you tried to correct it, but it happened. Tier four is you knew but you didn’t do anything, and that’s higher. Right. So that’s that’s the that’s the penalties. and so it just gets worse and worse if you don’t take care of it, basically.

Actual (22:27)
And so kind of moving, you know, towards the end of this episode, if we’d like to give our marching orders. And so let’s say we’re giving marching orders right now to the healthcare leaders that are listening as we’ve kind of gone over HIPAA. So we’ve covered some attacks, identity attacks and vendor breaches. We’ve covered HIPAA. what are three things they can execute this week?

To help close the gap, so that they don’t, you know, fall victim to some of these things that we’ve discussed.

The CISO (22:50)
Yeah, so ⁓ run the credential audit like we talked about earlier, right? Just do your audit and and make sure you’re doing, you know, your due diligence there. Inventory your business associates, right? You probably have some that you’ve had for years. Make sure you’re checking like every year you’re you’re actually updating your review of them, right? Making sure that you know what they’re doing. ⁓ conduct a hypersecurity rule risk assessment. ⁓ you should you know, you can do this every quarter if you

structure it correctly, right? ⁓ and it should be fast, especially if you’re doing it on a regular basis. But those are the three things because you have to remember that the biggest f the biggest penalty with HIPAA is that you can you can end up with ten years if there’s an intent to sell, transfer, use PHI. If there’s no intent, it’s up to five years in prison, right? And up to and the minimum is well, it’s like up to one year for

you know, for a violation. And as an executive, I don’t think you want to spend any time in prison.

Actual (23:47)
Yeah, no, let’s avoid prison and ⁓ let’s avoid you know, people’s information PHI getting out there for anyone to see. Right. So three things run the credential audit, inventory your business associates and conduct a HIPAA security rule risk assessment. So identity attacks and vendor breaches are the dominant breach vectors across many of all the industries right now.

So healthcare no exception. And the operational truth is that a stolen credential or a compromised vendor walking into an unprepared healthcare environment is the breach that lands on the OCR portal. So mission success starts with closing the gap between the threat and the framework. Trust would verify your own posture. Run the audit, inventory your associates, your business associates, and update your risk assessment. Execute the standard, and we’ll see you next week.

JOIN "THE WATCH" //

Receive critical SITREPs, Industry Alerts, and Threat Indicators sent directly to your inbox.

By submitting this form, you agree to our Terms & Conditions and Privacy Policy.

SILENCE THE NOISE. AMPLIFY THE SIGNAL.

INTELLIGENCE IS USELESS IF YOU AREN'T LISTENING.

Join The Watch to receive New Episode Alerts, Strategic Breakdowns, and Guest Intel delivered to your inbox.