“Companies have improved their recovery processes and user controls but still lag in risk preparedness, according to the report.”
Why this is important: On average, healthcare companies receive and maintain more sensitive information than other industries, making the healthcare sector a big target for cyberattacks. In 2024, 92 percent of healthcare organizations reported cyberattacks, and nearly 70 percent saw patient care impacted. Common areas of security vulnerabilities include: securing old systems, recovery process improvements, response planning, post-incident communications, and threat analysis maturity. Focused improvements in these areas are essential for protection against cyberattacks and compliance with upcoming potential federal regulations.
On January 6, 2025, the U.S. Department of Health and Human Services (HHS) published a notice of proposed rulemaking in the Federal Register detailing proposed changes to the HIPAA Security Rule. If implemented, it will be the first major update to the Security Rule in two decades. The comment period closed on March 7, 2025, and the process of reviewing the comments began thereafter. The proposed rule aims to improve cybersecurity and better protect the U.S health care system from a growing number of cyberattacks. The proposed rule would, among other things, mandate specific risk analyses and the use of multi-factor authentication. --- Joseph C. Unger
Featured Attorneys Question & Answer
This is our Featured Attorneys Q&A to introduce you to our large healthcare law team. To help you get to know our team a little better, we are highlighting attorneys in each issue by asking them a healthcare-related question. We hope their responses will be insightful for you.
H. Dill Battle III - Member; Chair, Insurance Government Relations & Regulatory Practice Group; Chair, Workers' Compensation Practice Group
|
Charity K. Lawrence - Member
|
Q: As we all know, safety in the healthcare industry is of utmost importance and is gaining in prominence every single day. As attorneys who are considered top of your fields regarding workers’ compensation issues, what are your best practices for healthcare organizations when it comes to safety policies, human resources trainings, and workers’ compensation programs?
Answer: When it comes to the healthcare industry, there is special emphasis put on achieving high-quality patient care, regulatory compliance, reducing liability, and maintaining strong employee well-being and satisfaction. All of those tenets can be achieved if you have robust safety, human resources, and workers’ compensation programs.
Amazingly, some organizations have formal safety plans in place, but corners may be cut with complete compliance. The healthcare industry moves fast, and those moving parts can cause breakdowns in safety procedures. It is essential that your safety plan is comprehensive. From hazardous materials to mobilizing and moving patients to emergency response plans, your management and staff must know your expectations and how to execute appropriately. Do your safety plans take into account demands from OSHA and CDC? Do you regularly audit and assess your programs and procedures? Your staff should have no doubt how to react in any given situation.
Your employees are your front line when it comes to safety and prevention. Your human resources staff is absolutely pivotal when it comes to employee training, including understanding HIPAA, anti-harassment policies, infection control procedures, and adherence to codes of conduct and ethics.
We all know that accidents can and will happen in a healthcare setting, but how the organization and staff react to those incidents will help mitigate issues, including litigation. You cannot wait for an injury to occur and then react. Proactive injury prevention programs must be a focus. If an injury occurs, does your staff know the best practices established by your organization in terms of reporting the injury? Do you have a return-to-work process that is clearly outlined and adhered to? And are you tracking those injuries and using data analysis to help prevent injuries in the future? Can you utilize technology and artificial intelligence to help with potential pitfalls in your system? Are there any other ways you and your staff can identify potential issues before they happen?
Finally, is your staff connected with your workers’ compensation carrier and claim administrator to ensure proper claim investigation and efficient management if a workers’ compensation claim is filed?
If you have legal counsel, they should be intimately involved in all of your safety, human resources, and workers’ compensation programs. They should be an extension of your staff and can help you identify issues before they become problems. Workers’ compensation programs will vary depending on local and state guidelines. Your lawyers are well-versed in those systems and can provide training to avoid potential problems in your claim management process.