Federal auditors were able to gain access to a large southeastern hospital’s internal systems after successfully capturing an employee’s login credentials during a phishing campaign, according to the HHS Office of the Inspector General.
OIG found the hospital generally had cybersecurity controls in place to protect patient care and Medicare data but identified gaps that could leave it vulnerable to cyberattacks, per the Feb. 2 report.
During testing, auditors accessed an internet-facing account management application that lacked strong user authentication controls, including multifactor authentication, allowing them to log in using credentials obtained through phishing. OIG also found a public-facing web application that didn’t have proper input validation controls and was not protected by a web application firewall, potentially exposing it to injection attacks and malicious code insertion.
The hospital, which has more than 300 beds and is part of a larger system, agreed with all four of OIG’s recommendations and said it has taken steps to address the weaknesses. OIG said the audit is part of a broader series examining hospital cybersecurity controls amid rising healthcare cyber threats and did not identify the hospital due to security concerns.
Becker’s 3rd Annual Fall Chief Pharmacy Officer Summit is the top tier event that the people leading the future of pharmacy convene. This 3-day event is built specifically for Chief Pharmacy Officers and senior pharmacy leaders. The sessions examine the workforce, financial and clinical priorities shaping pharmacy today. Becker’s is where candid discussions flourish and new ideas thrive. Becker's 3rd Annual Fall Chief Pharmacy Officer Summit
