Tag: Ransomware

Your Business is About to Get Hacked

 Author: Seymore Bones  Published Date: October 12, 2026  Leave a Comment on Your Business is About to Get Hacked

Hackers are looking for weaknesses and, when found, they’ll pounce.

If any of the following resemble your practice, you are definitely in trouble.

1. You have higher than average employee turnover.

If you’re losing employees more than the norm than there may be a reason behind this – like lower than average pay, less than fabulous working conditions, etc.  When employees leave they sometimes take data with them – usually inadvertently but sometimes on purpose to use with a competitor or other vengeful reasons.  Re-address your employee concerns and do your best to limit turnover – you will reduce a chance of a hack that way

2. Your staff is remote and/or mobile.

When employees are moving around they are moving around with your data – it can be easily lost or stolen.  If an employee or contractor is remote then they are connecting to your database through online services and these have a chance of being hacked.  Work with an IT person to make sure you have strong data management and connection tools in place for these remote people and make sure they’re being monitored

3. You have no IT support.

Speaking of an IT (information technology) person:  get one.  Even the smallest of companies are exposed to a data hack.  Paying someone to evaluate your risks, install software, monitor activity and keep things up to date is a critical and essential business cost – even the work is done monthly (it all depends on your size and activity)

4. You do not buy security software.

Subscribe to one of the great security applications like McAfee, Norton, Malwarebytes or Bitdefender.  There are many others.  These software applications are inexpensive, run quietly in the background of every device and are checking for malware, viruses, infected websites and other tools of the hacker.  Make sure this software is always updated.

5. Your employees do not get trained.

Most security problems, particularly at small companies, are from employee-related errors – clicking on bad websites, opening up infected files, etc.  Invest in a day of training a few times a year with a good IT security firm so that your employees are well aware of potential problems and can avoid doing dangerous stuff.

6. You have no procedures for securing data.

If you are handling health, financial or other personal information about your customers, and it gets stolen, you could have a big problem on your hands.  Keeping this data in an unprotected place means that hackers are going to find it.  If this is you, then you’re going to need procedures and policies around the safeguarding of confidential customer data.  And after they’re written training will be required to ensure that your employees are complying.

7. Your computers and operating systems are old.

Thousands of computers around the world are still running older, out of date versions of Microsoft Windows.  All hackers need is one vulnerable computer to attack and then can get on a network and wreak havoc.  One of the best ways to avoid a hack is to ensure that all of your computers are running the most recent versions of Windows or iOS all the time.  If a desktop or other device is too old to handle the new operating systems then buy a new one.  The cost will pale in comparison to the cost you’ll incur if you’re hacked

8. You have no BYOD policy.

Are your employees allowed to bring their own devices (a BYOD policy) and use them for work?  That’s what most companies do. Unfortunately, this can create security issues if they are not monitored.  Many companies use remote management software to install company apps on their employees’ devices for a secure access while other companies issue their own devices to their employees which have been secured.  So, what is your Bring Your Own Device policy?  Every company must have one and every company must have an IT person monitoring those devices.

9. Password changes are not enforced.

Most people are pretty complacent with passwords – the most common one, if you can believe it, is still “1234.”  You must require a more complicated password for your employees to enter your network – a combination of letters, numbers and symbols – and this password should be required to be changed every month or two.  That way passwords are more difficult to hack and hackers may move on to another easier target.
Speaking of an IT person; Get One

HEIGHTENED RANSOMWARE THREAT: ACTION STEPS

 Author: Seymore Bones  Published Date: November 4, 2020  Leave a Comment on HEIGHTENED RANSOMWARE THREAT: ACTION STEPS

MGMA members-the federal government has announced a heightened risk of malware/ransomware attacks on the healthcare industry-including physician practices and inpatient facilities. We wanted to identify some actions you can take to reduce your risk and resources to assist you.

Actions to reduce your risk:

  • Discuss the issue of cybersecurity with your IT/website vendor and have them block known sites that provide known functionality to the malware (reference the IOC list below)
  • Have your IT/website vendor monitor endpoint detection on servers and workstations for changes in applications and running services
  • Have your IT/website vendor monitor all new account creations. Especially critical are those with administrator access
  • Have your IT/website vendor confirm that your data backup systems are in place and working effectively. Remember that offsite data storage is preferable
  • Ensure your practice’s business continuity and disaster recovery plans are up-to-date and readily available
  • Discuss the heightened threat with your administrative and clinical staff and the increased need to stay highly diligent during this time
  • Consider instituting a practice-wide policy prohibiting staff use of personal email accounts as a method to decrease your risk
  • Remind staff not to open emails and/or attachments from unknown senders (and even be cautious with attachments from recognized senders)
  • Encourage staff to inform you regarding any suspicious email or cyber incident

Resources:

HHS Bulletin: us-cert.cisa.gov/sites/default/files/publications/…

 IOC List: gist.github.com/aaronst/…

MGMA member-benefit Cybersecurity Action Steps

Robert Tennant MA
Director of Health Information Technology Policy MGMA Government Affairs
Washington DC