Blog

This week, the group that maintains PHP released fixes for two critical security flaws, tracked as CVE-2026-109618 and CVE-2026-109619. PHP is the software behind most websites, including every WordPress site. If your practice has a website, an appointment request form, or a patient portal, it is worth a quick question to whoever runs it.

What Happened

The flaws could allow an attacker to run their own code on a web server. Early attacks have been reported, though that is not yet confirmed. Fixes are available, but a website only benefits once whoever hosts it has installed them.

Why It Matters for a Healthcare Practice

Many practice websites collect information through contact forms, appointment requests, or intake pages. If an attacker gains control of the server behind a site like that, anything stored or submitted there is at risk. When that includes patient information, a server compromise can quickly become a compliance matter as well as a technical one.

The Question to Ask

Ask whoever hosts or maintains your website, whether that is your hosting company, your web designer, or your IT provider:

“Does the PHP version on our website include the fix for CVE-2026-109618 and CVE-2026-109619?”

A good answer is a clear yes, with a date. A vague answer, or no answer, is worth following up on. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP 8.1 and older will not receive a fix, so a site still running one of those needs to be upgraded rather than patched. Some hosts also protect sites in other ways, such as blocking known attack patterns, which is why asking matters more than guessing from a version number.

What About Our Clients?

We’ve reviewed our clients’ websites and have ensured they have been patched or otherwise mitigated as needed.

If your business creates, stores, or transmits protected health information (PHI), a security incident isn’t the same kind of problem it would be anywhere else. A stolen retail customer list is a headache. A stolen patient record is a different category of harm – for the patient, and for you.

This applies well beyond clinics. Billing companies, software vendors, transcription services, IT providers, and other business associates who touch PHI carry many of the same obligations as the practices they serve.

Why PHI Is Different

• It can’t be reset. A compromised credit card can be cancelled and replaced. A diagnosis, a medical history, or a date of birth tied to a Social Security number stays exposed for life.
• It’s rich enough for fraud. A single patient record often combines identity details, insurance information, and medical history – everything needed for identity theft and medical fraud.
• It’s regulated. HIPAA’s Privacy, Security, and Breach Notification Rules apply to covered entities and business associates alike.
• It’s personal. Patients share sensitive information because they trust you to protect it.

What a Breach Costs Beyond the Cleanup

The technical recovery is only the start. A PHI breach can trigger mandatory notification to affected patients, to the Department of Health and Human Services, and in larger cases to the media. Breaches affecting 500 or more people are posted publicly by HHS. Add possible OCR investigation, civil penalties, state-level requirements, legal fees, and the cost of lost patient and partner trust, and the true price of an incident tends to dwarf the cost of preventing it.

Security Is Part of the Compliance Obligation

The HIPAA Security Rule requires administrative, physical, and technical safeguards for electronic PHI, including risk analysis, access controls, audit logging, and workforce training. In other words, the practices that are secure and the practices that are compliant are largely the same practices. The foundations are familiar:

• A current risk analysis that reflects the systems and vendors you use today
• Multifactor authentication and least-privilege access so people only see the PHI their role requires
• Encryption and tested backups for data at rest and in transit
• Business associate agreements with every vendor that handles PHI on your behalf
• Regular staff training – because people remain the most common way in

The Takeaway

Cybersecurity Awareness Month is a good reminder, but if you handle PHI the bar is higher every other month too. The organizations that get this right treat protecting patient data as part of delivering care – not as an IT line item.

Every October, Cybersecurity Awareness Month shows up on calendars, in vendor emails, and on a few office bulletin boards. For many healthcare practices, it passes with little more than a nod. That’s a missed opportunity – because the habits this month promotes are exactly the ones that stop most real-world breaches.

Cybersecurity Awareness Month is an annual national campaign, now in its third decade, built around a simple idea: security isn’t only a technology problem. It’s a people problem, and people can be trained.

Why Healthcare Has More at Stake

Most of the advice in October’s awareness campaigns applies to every business. But a medical or dental practice isn’t every business. You hold records that are sensitive, regulated, and permanent, and you rely on systems that can’t simply go offline for a few days without affecting patient care.

• Phishing targets busy people. Front-desk staff, billing teams, and clinicians handle a constant flow of email and rarely have time to inspect every message.
• Small practices are not too small to target. Attackers use automated tools that look for weak defenses, not famous names.
• Downtime has patient-care consequences. A ransomware outage isn’t just an inconvenience when schedules, charts, and prescriptions depend on your systems.

Four Things to Do This Month

You don’t need a large project to make October count. These four steps are realistic for a practice of any size:

• Run a short staff refresher on phishing. Fifteen minutes covering what suspicious emails, texts, and phone requests look like is worth more than a once-a-year slideshow nobody remembers.
• Turn on multifactor authentication for email, remote access, and your EHR wherever it’s available.
• Review who has access to what. Remove accounts for former employees and trim access that no longer matches someone’s role.
• Make it easy to report. Staff should know exactly who to tell the moment something looks off – and should never fear getting in trouble for speaking up.

Don’t Let It End on October 31

The practices that stay secure treat awareness as a year-round habit rather than a one-month event. HIPAA’s Security Rule also expects ongoing workforce security training, so what you start this month can double as documentation that your practice takes it seriously. Use October as the kickoff: set a recurring schedule for refreshers, and revisit your controls at least once a year.

A few years ago, getting cybersecurity insurance for a medical practice was mostly a matter of filling out a form and writing a check. That’s no longer true. Insurers have paid out enough healthcare ransomware and breach claims to know exactly which security gaps lead to losses – and they’ve adjusted their applications accordingly.

Practices that haven’t reviewed their security posture recently are often surprised by what today’s applications ask for – and by how a claim can be denied after the fact if the answers on that application weren’t accurate.

What Insurers Are Actually Asking For Now

Cybersecurity insurance applications for healthcare organizations have grown considerably more detailed, and increasingly ask about controls that were optional recommendations just a few years ago:

• Multifactor authentication on email, EHR access, and remote access – often a hard requirement, not a bonus question
• Endpoint detection and response (EDR) rather than traditional antivirus alone
• Immutable, tested backups isolated from the production network
• A documented incident response plan, specifically covering breach notification timelines
• Evidence of regular security awareness training for staff, particularly around phishing

Why Healthcare Applications Get Extra Scrutiny

Healthcare breach claims tend to be larger and more complex than those in other industries, given HIPAA notification requirements, potential OCR investigations, and the value of patient records on the black market. Insurers price and underwrite accordingly, which means healthcare practices are often held to a higher technical bar than a similarly sized business in another industry.

Getting Ready Before You Apply (or Renew)

The practices that get through underwriting smoothly – and avoid an unpleasant surprise at claim time – are the ones that treat the application as a real audit of their environment, not paperwork to get through quickly. Reviewing your actual controls against what insurers are asking for, before you apply or renew, is far less painful than finding the gap during a claim.

A breach rarely announces itself politely. It’s a ransomware note on the front desk screen. A patient calling to ask why they received a bill for a visit that never happened. A staff member who can log in but suddenly has access to records they shouldn’t.

However it starts, what happens in the first 24 hours shapes everything that follows – both for patient care and for how the incident is judged under HIPAA’s breach notification requirements.

Contain First, Investigate Second

The instinct to immediately understand what happened is natural, but containment comes first. Isolate affected systems from the network, preserve logs rather than rebooting devices, and get eyes on the problem – ideally from an incident response team that has handled healthcare breaches before.

The HIPAA Clock Starts Immediately

Under the HIPAA Breach Notification Rule, covered entities generally have 60 days from discovery to notify affected patients, and breaches affecting 500 or more individuals must also be reported to HHS and, in many cases, local media, within that same window. “Discovery” is defined broadly – the clock often starts well before an investigation confirms exactly what happened.

• Document everything from the first moment, including when the incident was discovered and by whom
• Loop in legal counsel early, since breach notification obligations and attorney-client privilege considerations both start immediately
• Determine what data was involved as quickly as the investigation allows – PHI, payment data, and employee data each carry different notification obligations
• Check your cybersecurity insurance policy for required notification timelines to the insurer, which are often shorter than HIPAA’s own deadlines

Keep Patient Care Running Where Possible

Alongside containment and compliance, someone needs to be thinking about continuity of care – whether that means falling back to paper charting temporarily, rescheduling non-urgent visits, or activating a documented downtime procedure. A practice that has rehearsed this in advance loses far less time than one improvising for the first time during an actual incident.

Most practices know they should have backups. Far fewer have actually tested whether those backups would restore a working EHR system fast enough to matter during a real ransomware incident.

That gap – between having a backup and having a tested recovery plan – is where healthcare organizations discover, usually at the worst possible moment, that their disaster recovery plan doesn’t hold up under pressure.

Why Healthcare Recovery Time Objectives Are Different

For most businesses, a system outage is a productivity problem. For a medical practice, an EHR outage means providers can’t access medication histories, allergy information, or lab results during an active patient visit. Recovery time objectives (RTOs) for healthcare systems have to reflect that urgency – “we’ll be back up within a day or two” is not an acceptable answer when patients are in the waiting room.

What a Real Healthcare Backup Strategy Includes

• Backups isolated from your production network, so ransomware that spreads through your systems can’t also encrypt the backups meant to recover from it
• Regular, scheduled test restores, not just backup jobs that report “success” without ever being verified against a real EHR restore
• Defined RTOs and RPOs specific to clinical systems, distinct from less urgent systems like marketing files or archived records
• A documented communication plan for notifying staff, patients, and regulators if downtime extends beyond a defined threshold

Backups Are Also a HIPAA Requirement, Not Just Good Practice

The HIPAA Security Rule explicitly requires a contingency plan covering data backup, disaster recovery, and emergency mode operation. A backup strategy built only around convenience, without those documented plans, leaves a practice exposed on the compliance side even if the technical backups themselves are solid.

“We should move our systems to the cloud” comes up in almost every healthcare IT conversation now – usually framed around cost savings or convenience. For a medical practice, that conversation is incomplete until it includes one more word: compliance.

Cloud migration isn’t inherently riskier for a healthcare practice than keeping systems on-premises – in many cases it’s more secure. But it has to be done in a way that satisfies the HIPAA Security Rule from day one, not retrofitted afterward.

The Question That Comes Before “Which Cloud Provider?”

Before evaluating any cloud platform, the real first question is whether that vendor will sign a Business Associate Agreement (BAA). Under HIPAA, any vendor that stores, processes, or transmits protected health information (PHI) on your behalf is a business associate – and without a signed BAA in place, using that service with PHI is a compliance violation regardless of how secure the platform itself is.

What a HIPAA-Ready Cloud Migration Actually Involves

• A signed BAA with every cloud vendor that will touch PHI, reviewed before migration begins, not after
• Encryption in transit and at rest configured correctly, since default settings on many platforms don’t meet HIPAA expectations out of the box
• Access controls and audit logging that track exactly who accessed which records and when, matching or exceeding what your on-premises system currently provides
• A tested data migration and rollback plan so patient care isn’t interrupted if something doesn’t transfer cleanly
• Updated risk assessment documentation reflecting the new environment, since your HIPAA risk assessment is only accurate for the systems it was written against

Why the Right Setup Actually Improves Your Security Posture

Done correctly, cloud infrastructure often gives a practice better uptime, more consistent patching, and stronger disaster recovery than an aging on-premises server room ever could. The difference between “more secure” and “a compliance liability” almost always comes down to how the migration was planned, not whether the cloud itself was the right decision.

We’re excited to share that Atech Healthcare IT Management has a brand new website. The redesign reflects who we are today: a dedicated healthcare IT and cybersecurity partner built specifically for medical practices, with HIPAA compliance and patient data security at the center of everything we do.

Beyond a fresh look, the new site is easier to navigate, faster on mobile, and organized around the solutions healthcare practices actually ask us for – managed IT, HIPAA-focused cybersecurity, cloud, incident response, and compliance support.

Take a look around, and let us know what you think.

Schedule a Complimentary Consultation

A front desk employee gets an urgent email that looks like it’s from the practice’s EHR vendor, warning that their login will be disabled unless they “verify” their credentials immediately. A biller receives what looks like a routine insurance payer notice, asking them to update remittance details. Neither looks unusual at a glance – and that’s exactly the point.

Healthcare staff field a constant stream of urgent, credential-related, and billing-related messages as part of a normal day. Attackers know this, and they design phishing attempts to blend into that noise rather than stand out from it.

Why Healthcare Is a Preferred Target

Patient records sell for significantly more than stolen credit card numbers on the black market, because they contain enough information to commit sustained identity theft and insurance fraud. Combine that value with staff who are trained to respond quickly to urgent requests involving patient care, and healthcare organizations become an efficient target for attackers running phishing campaigns at scale.

What Healthcare-Specific Phishing Actually Looks Like

Generic phishing training talks about bad grammar and suspicious links. Healthcare-targeted attempts are often more specific than that:

• EHR or patient portal login spoofing: A fake login page built to look identical to the practice’s actual EHR or portal sign-in screen
• Insurance and billing fraud: Messages impersonating a payer or clearinghouse, asking staff to update remittance or banking details
• Prescription and referral scams: Urgent-sounding messages referencing a specific patient or provider name to add credibility
• Vendor impersonation: Fake invoices or account alerts appearing to come from medical device or software vendors the practice actually uses

Building a Defense That Fits Clinical Workflows

Generic security awareness training rarely accounts for how clinical and administrative staff actually work. A stronger approach combines technical controls with training built around real healthcare scenarios:

• Email filtering tuned to catch known healthcare-targeted phishing patterns
• Multifactor authentication on EHR and patient portal access, so a stolen password alone isn’t enough
• A clear, judgment-free process for staff to report a suspicious message or a mistaken click
• Training scenarios built around actual EHR, billing, and vendor communication patterns your practice uses

The goal isn’t a staff that never makes a mistake – it’s an environment where one mistake doesn’t turn into a reportable breach.

Every business depends on technology, but no industry carries the specific mix of risk, regulation, and real-time urgency that healthcare does. When a retail store’s network goes down, sales pause. When a medical practice’s network goes down, patient care can stop cold, and protected health information can be exposed in the process.

That difference is why choosing an IT provider for a healthcare practice is not the same decision as choosing one for any other small business. Here is what makes healthcare IT genuinely different, and why experience in the field is not a nice-to-have.

1. Protected Health Information Touches Almost Everything

In most industries, sensitive data lives in a few well-defined systems. In a healthcare practice, protected health information (PHI) touches nearly every device: the front desk workstation, the fax machine, the billing software, the portable ultrasound cart, the tablet a nurse carries between rooms. An IT provider who has not worked in healthcare often does not know where to look for PHI exposure, because it is not concentrated the way it is in other industries.

• Every endpoint needs to be evaluated for how it stores, transmits, or displays PHI
• Legacy devices and medical equipment often cannot run modern security agents
• Fax machines, scanners, and printers are common, overlooked sources of exposure

2. HIPAA Is a Floor, Not a Checklist

The HIPAA Security Rule and Privacy Rule set enforceable minimums, not a finish line. A generalist IT provider may treat a HIPAA risk assessment as a one-time compliance exercise. A healthcare-experienced provider treats it as an ongoing discipline: access controls, audit logging, encryption, and business associate agreements (BAAs) have to be maintained continuously as staff, vendors, and systems change.

3. Downtime Is a Patient Safety Issue, Not Just a Business Cost

For most businesses, an IT outage is measured in lost revenue. For a medical practice, an EHR outage can mean a provider cannot access medication histories, allergy information, or lab results in the middle of a patient visit. Backup and disaster recovery planning for healthcare has to account for that urgency, with recovery time objectives that reflect what is actually at stake.

4. Healthcare Is a Bigger Target Than Most Businesses Realize

Patient records are valuable on the black market, and healthcare organizations are frequently targeted by ransomware precisely because attackers know that downtime is especially costly and that practices may feel pressure to pay quickly. An IT partner who has actually defended healthcare environments understands these attack patterns and builds defenses around them, rather than applying generic best practices and hoping they hold up.

5. Vendor and Device Ecosystems Are More Complex

A typical healthcare practice runs an EHR platform, a practice management system, lab integrations, imaging systems, and often specialty devices, all from different vendors, all needing to work together securely. Managing that ecosystem, including tracking which vendors have signed business associate agreements, requires a level of vendor coordination that most generalist IT providers are not set up to handle well.

What to Look for in a Healthcare IT Partner

• A track record working specifically with medical practices and healthcare organizations
• A documented approach to HIPAA Security and Privacy Rule compliance, not just a one-time checklist
• 24/7 monitoring and incident response, with recovery plans that reflect patient safety urgency
• Experience managing BAAs and vendor relationships across an EHR-centered technology stack
• Security defenses built around how healthcare organizations are actually targeted

Healthcare IT is not general IT with a few extra rules bolted on. It is a discipline of its own, and the practices that treat it that way are the ones that stay protected, compliant, and online when it matters most.