Your browser is out of date.

You are currently using Internet Explorer 7/8/9, which is not supported by our site. For the best experience, please use one of the latest browsers.

Protecting Your Health Center From Third Party Cyber Risk

Your firewall is solid. Your staff finished their phishing training. Your backups are tested. And yet one Tuesday morning, claims stop moving, the pharmacy can't verify coverage, and patients start asking why their data showed up in a breach notice.

The cause wasn't your network. It was your vendor's.

For community health centers, this is one of the least discussed and most expensive cyber risks out there. The recent McKesson breach is a fresh reminder of why.

What happened at McKesson

In late August, McKesson confirmed that hackers broke into several of its cloud-hosted accounts and exfiltrated data, and said it expected intermittent service degradation related to the incident. The group claiming responsibility, ShinyHunters, told TechCrunch it got in by tricking several employees into granting access through phishing and social engineering. 

The data at stake is exactly what health centers are trusted to protect. The hackers said they took names, addresses, and Social Security numbers, along with protected health information such as diagnoses, medications, allergies, and patient notes. Bleeping Computer reported a $55 million ransom demand to keep the files from being published. 

McKesson is not an outlier. Electronic patient records provider CareCloud and health tech company TriZetto each had breaches affecting more than 3 million patients this year. The pattern is clear: attackers have figured out that breaching one vendor can unlock thousands of downstream providers at once. 

Health centers have seen this movie before

If this feels familiar, it should. The February 2024 attack on Change Healthcare showed what happens when a single vendor goes dark. Change processes 15 billion health care transactions a year, touching 1 in every 3 patient records, including eligibility verification, prescriptions, claims, and payment. 

Health centers felt it directly. In a NACHC survey of 408 health centers conducted in early April 2024, the numbers were stark:

 

Before an incident. Start with a complete vendor inventory: who they are, what they do for you, whether they hold PHI, and how they connect to your systems. Many health centers find vendors on this list they'd forgotten about, like an old patient reminder tool that still has access to the patient database. Next, confirm you have a current business associate agreement with every vendor that touches PHI, and check that your contracts spell out how quickly a vendor must notify you of a breach. Finally, require multifactor authentication on every account tied to a vendor portal or shared system. The McKesson attackers got in by tricking employees, and MFA is one of the most effective ways to blunt that tactic.

During an outage. This is where revenue cycle and IT planning meet. Your downtime procedures should cover clinical and financial workflows alike: how you'll register patients, document visits, and capture charges when a system is offline. Know ahead of time whether you have a backup route for claims submission if your clearinghouse goes dark, since changing clearinghouses in the middle of a crisis is slow and painful. If a vendor reports a compromise, act quickly to disable its connections and any shared credentials until it's safe.

After recovery. Work through claims that were held or rejected during the outage before timely filing deadlines slip past. Rotate any passwords or keys the vendor could have exposed. Then update your plan with what you learned, while the lessons are still fresh.

Five questions to ask your team this quarter

  1. Do we have a single, current list of every vendor that stores or accesses our patient data?
  2. If our clearinghouse went down tomorrow, how many days of cash could we cover?
  3. Does every vendor contract require prompt breach notification?
  4. Is MFA turned on for every system a vendor can reach, including Microsoft 365?
  5. When did we last test restoring from backup without help from a vendor?

If any of those answers were "we're not sure," you're not alone, and that's a good place to start.

Take the first step

Visualutions works with FQHCs at the intersection of IT and revenue cycle, which is exactly where vendor incidents do the most damage. We're happy to help identify your risks and work with you on securing your health center.