BLOG

Webinar Recap: A Clear Path to Solving for Risk | CORL Technologies Third-party risk management in healthcare is changing, and a bold new future will allow for more effective risk management than ever. Discover how. Read More

What do the barrier reef and vendor risk have in common? | CORL Technologies Third-party risk management in healthcare has a lot to learn from the Great Barrier Reef. Read the blog to discover what we can learn and how CORL can help. Read More

The Cybersecurity and Infrastructure Security Agency (CISA) has been hinting for weeks about a pending announcement on cybersecurity for the nation’s critical infrastructure including healthcare. That update has arrived in the form of a major publication titled CPG: Cross-Sector Cybersecurity Performance Goals.[1]The CPGs provide a mechanism for healthcare organizations and other critical sector entities to prioritize their implementation of the most effective and essential security controls required to defend against emerging cyberattacks. This blog provides an overview of the CPGs and delves into the CPGs that are dedicated to supply chain and third-party vendor risk management. We also discuss the history and genesis of the CPGs, definitions and components, and practical applications for the CPGs for healthcare organizations. Read More

Our Vendor Breach Digest provides a summary roll-up of major breach events for third-party vendors operating within the healthcare supply chain. Breaches covered in this release: Okta & Microsoft, SummaCare, Healthplex, Inc, GitHub, Arcare, American Dental Association, T-Mobile, Mental Health Center of Greater Manchester, Mountain Area Health Education Center, The State Bar of Georgia, McCarter & English, Kaiser Foundation, Health Plan, Touchstone Imaging, DialAmerica Marketing, Block, Parker Hannifin Corporation, MailChimp, HubSpot, Cytometry Specialists, Palo Alto Networks, Globant, and Gainwell Technologies. Read More

CORL and HITRUST specialize in delivering cybersecurity assurance products and services for the healthcare industry including Third-Party Risk Management (TPRM) programs. Our companies have been listening attentively to our clients and colleagues and one message has come across loud and clear: TPRM is broken and we need to collaborate as an industry to fix it. This blog provides a summary of the feedback and perspectives from cybersecurity and risk leaders charged with managing healthcare TPRM programs. Read More

Cloud Security Alliance (CSA) recently released new guidance on managing third-party cyber security risk in healthcare that offers some practical and useful tips for defenders to consider. The report comes on the heels of a new industry report from IBM that cites healthcare as the highest sector for breach costs. The IBM report also notes that 45% of breaches were cloud-based and almost one fifth of breaches occurred because of a compromise at a third-party business partner. Read More

A bombshell news report was issued by The Markup on June 16 in their publication, Facebook Is Receiving Sensitive Medical Information from Hospital Websites. Specifically, the report claims that healthcare organizations across the country have installed Meta Facebook’s Meta Pixel tracking tool on patient portals and other patient-facing websites. The Meta Pixel platform reportedly sends Facebook Protected Health Information (PHI) including patient names, IP addresses, names of doctors, appointment information, prescription details, and more for many of the nation’s hospitals. Read More

Identifying the cybersecurity gaps in your vendor ecosystem is only one part of solving for risk. Risk management and reduction can only be achieved when third-party risk management programs make concrete investments to support their vendors in making timely and cost-effective improvements in their cybersecurity program. Here at CORL, we are committed to more than risk measurement. We foster excellence and accountability on both sides of the vendor contract by actively championing and managing proactive remediation and risk maintenance. Read More