[{"innerBlocks":[],"name":"core\/freeform","postId":2557,"blockType":{"name":"core\/freeform","keywords":[],"attributes":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"}},"providesContext":[],"usesContext":[],"selectors":[],"supports":{"className":false,"customClassName":false,"reusable":false},"styles":[],"variations":[],"apiVersion":3,"title":"Classic","description":"Use the classic WordPress editor.","category":"text"},"originalContent":"Ambulatory electronic health records vendor Allscripts is still attempting to recover from the ransomware attack it suffered on January 18 that affected two of its data centers housing a subset of its products, the company said Monday evening.

\u201cThe ransomware has since been identified as a new variant of the SamSam malware,\u201d a statement from the company indicated. \u201cOf the roughly 1,500 clients impacted, none were hospitals or large independent physician practices, and services to many already have been restored.\u201d

\u201cImportantly, there is no evidence that any data was removed from our systems,\u201d the company said. \u201cWe continue to work unceasingly to restore all services to our clients who are still experiencing outages.\u201d

In communications with its customers on Friday, Allscripts said it was attempting to \u201crestore both the directly affected services\u2014hosted Pro EHR and hosted EPCS\u2014and the other unaffected services that we proactively shut down to protect clients and client data.\u201d

Conference calls over the weekend by the company indicated that service outages were continuing, and that the outage was expected to continue into Monday. The vendor\u2019s marketing materials suggest it provides services to 45,000 physician practices with 180,000 doctors, 2,500 hospitals and 19,000 post-acute care providers.

The attack has prompted concerns from providers using cloud-based IT services from vendors about the potential vulnerability of such systems to cyberattack and service outages. Vendor preparedness is typically difficult for customers to determine, and \u201csecurity safeguards are kept confidential, so there\u2019s little transparency on the issue,\u201d says Steve Phillips, a health law attorney and partner in the Hooper, Lundy & Bookman law firm in San Francisco.

Phillips contends that providers need to be vigilant about including contractual provisions about security protections and service interruptions when they\u2019re buying EHRs.

\u201cMost vendors try to sharply limit their liability through qualitative limitations on liability, limited representations and warranties, limited indemnity terms and other contractual provisions,\u201d he contends. \u201cProviders should not accept limits on liability stemming from violations of HIPAA or from privacy breaches; they should demand a broad indemnity from third-party claims stemming from HIPAA violations and breaches, and vendors should be required to carry adequate cyber-liability insurance.\u201d

Asked what recourse providers have to re-write security clauses in their EHR contracts, Phillips was blunt. \u201cNone. That\u2019s why it is imperative that security provisions be negotiated and written into the purchase agreement.\u201d","saveContent":"Ambulatory electronic health records vendor Allscripts is still attempting to recover from the ransomware attack it suffered on January 18 that affected two of its data centers housing a subset of its products, the company said Monday evening.

\u201cThe ransomware has since been identified as a new variant of the SamSam malware,\u201d a statement from the company indicated. \u201cOf the roughly 1,500 clients impacted, none were hospitals or large independent physician practices, and services to many already have been restored.\u201d

\u201cImportantly, there is no evidence that any data was removed from our systems,\u201d the company said. \u201cWe continue to work unceasingly to restore all services to our clients who are still experiencing outages.\u201d

In communications with its customers on Friday, Allscripts said it was attempting to \u201crestore both the directly affected services\u2014hosted Pro EHR and hosted EPCS\u2014and the other unaffected services that we proactively shut down to protect clients and client data.\u201d

Conference calls over the weekend by the company indicated that service outages were continuing, and that the outage was expected to continue into Monday. The vendor\u2019s marketing materials suggest it provides services to 45,000 physician practices with 180,000 doctors, 2,500 hospitals and 19,000 post-acute care providers.

Allscripts ransomware attack still not completely resolved

More for you