SOC stands for Service Organizational Control. There are three types of SOC reports, but we’ll focus on the second one, which is “designed for the growing number of technology and cloud computing entities that are becoming very common in the world of service organizations” according to ssae16.org. ...

It’s reported to have been one of the largest cyber extortion attacks to-date. The WannaCry (aka WanaCryptor 2.0) ransomware attack hit globally and hit hard. In the U.S., security analysts have leaped into the fray with patches and detection software, trying to stay ahead of the infiltration to ...

Why is healthcare so heavily and successfully targeted by cybercrime? It’s a tough question, but after a record number of breaches last year – nearly 90% of all successful ransomware attacks were on hospitals – it’s one that needs to be asked.

HITRUST. A term becoming increasingly popular in the healthcare arena. But what exactly is HITRUST? And what’s involved in becoming HITRUST certified?

Having patients feel safe sharing sensitive health information is critical to the future of informed population health. How can you ensure that you are compliant with the Health Insurance Portability and Accountability Act (HIPAA) when sharing this information with 3rd parties? If you are using a ...

According to research conducted by Intel in 2015, avoiding breaches and associated business impacts is the top privacy and security concern across healthcare organizations, globally. Ostendio has partnered with Intel to offer a confidential, 1 hour breach security assessment to ensure that ...

Does a repeal or reworking of the Affordable Care Act mean that we should expect less focus on HIPAA and cybersecurity? Almost certainly not. In fact, we may even see increased enforcement as opposed to less.

As 2016 draws to a close, it was a busy year for both companies defending themselves, and cyber criminals creating new forms of attack. As CEO of Ostendio, and a former CISO, I speak with a lot of different companies about what their security concerns are. Here are my predictions for what 2017 may ...

The Ostendio blog covered a lot of ground this year – from a 3-part series about Cybercrime in Healthcare – to the worst passwords your organization can use. As you review and prepare your risk and compliance strategies for the coming year, check out some of our client's most read blog posts from ...

After a lengthy process of “putting things to rights” in 17 states, Zenefits is paying up to US$7 million in penalties. As with other digital health companies penalized for non-compliance, the fast-growing benefits company has discovered the hard truth: compliance should not be an afterthought.

Demonstrating HIPAA compliance is a challenge for many digital health companies. In fact, smaller digital health companies often struggle to meet even the basic requirements of the HIPAA Privacy, Security, and Breach notification rules. Fortunately, Amazon Web Services and MS Azure, both of which ...

In our Cybercrime article series, we say that it’s a good idea to check if your back door is unlocked. But what if you are the back door? In June, Massachusetts General Hospital confirmed, and named, the third party vendor who was responsible for the cyberattack and security breach that exposed ...

There’s a streamlined way to get there. A growing number of digital health companies are being asked to adopt the HITRUST standard. You too may soon get asked. HITRUST is now the compliance standard for many large healthcare organizations like Anthem, Health Care Services Corp., Highmark, Humana, ...

Ransomware attacks are changing how companies put a price on cybersecurity, and making it a Board Room issue. Think back to the data breaches at Anthem, Care First Blue Cross Blue Shield or Premera Blue Cross. Individual patient records were exposed, potentially costing each entity millions of ...