HS releases mobile device security checklist, update on ransomware threat 

The Department of Health and Human Services yesterday released a mobile device security checklist for the health care sector, and an update on the Black Basta ransomware group targeting the sector since last year.

“The Health Sector Cybersecurity Coordination Center checklist is a practical guide to mobile device security, and the unique risk exposure we face through the integration of these devices into clinical operations on site and via remote access,” said John Riggi, AHA’s national advisor for cybersecurity and risk. “Mobile device security also raises the related issues of HIPAA security and privacy compliance. Mobile devices used to store or transmit patient data should be centrally managed by enterprise mobile device management applications. 

“The Black Basta Russian-speaking ransomware gang has been aggressively targeting the health care sector since 2022, gaining access through unsecured remote desktop protocol and using highly targeted spear phishing emails containing malicious attachments. Black Basta and other Russian-speaking ransomware gangs increasingly rely on the despicable tactic of data extortion — threatening to publicly expose sensitive patient health information to force ransom payment. I strongly recommend storing and transmitting all protected health information inside and outside the electronic health record in an encrypted manner.”

For more information on this or other cyber and risk issues, contact Riggi at jriggi@aha.org. For the latest cyber and risk resources and threat intelligence, visit aha.org/cybersecurity.