Patch, verify, document: Managing PHP2Shell and Quest Diagnostics risk at your practice

For practice administrators, this week brought two cybersecurity problems at once, and each lands on a different part of the job.

The first is PHP2Shell, two critical flaws in PHP, the programming language that runs WordPress, Drupal, Joomla and most websites whose underlying code can be identified. The flaws could let an attacker take over a web server without a password. Fixes arrived Oct. 21, and the Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA) and the FBI told organizations to update immediately or take vulnerable systems offline. Few practices run their own web servers, which makes this a vendor management task: finding out who hosts the practice website, forms and payment pages, and confirming in writing that they have patched.

The second is a breach at Quest Diagnostics. Quest disclosed Oct. 22 that an unauthorized party accessed patient records in Quanum Lab Services Manager (LSM), the portal some practices use to order tests and pull results. Quest paused the system, routed users to other ordering options and said it will notify affected patients as required by law. Quest said the breach is not connected to the PHP flaws. For practices that order through Quanum LSM, the immediate work is keeping orders and results moving and preparing the front desk for patient questions.

Neither event requires a practice to report a breach of its own at this point. Both are a reason to document what the practice checked, when and with whom, as part of its HIPAA security records.

Two other warnings round out the week: a breach of Kentucky's Medicaid provider portal run by a state contractor, and a federal advisory on the SafePay ransomware group, which has hit at least 600 organizations, with health care among its targets.

The slides that follow walk through the facts as of Oct. 23 and an action list practice managers can work through this week.

The U.S. Department of Health and Human Services has free online resources to bolster cybersecurity of physicians' offices, hospitals and health care systems. Learn more here.