BLOG

Keep Up with CORL: Vendor Breach Digest, 3/15/22

Our Vendor Breach Digest provides a summary roll-up of major breach events for third-party vendors operating within the healthcare supply chain. Breaches covered in this release: Morley Companies, South Denver Cardiology Associates, Securitas, Priority Health, Medical Healthcare Solutions, PracticeMax, Charlotte Radiology, RR Donnelley, US Radiology Specialists, Pekin Insurance, The International Committee of the Red Cross, DataHEALTH, American Osteopathic Association, Vantage Holding Company, Crossroads Health, UMass Memorial Health, LGAA... Read More

Russia/Ukraine Cyberwar: Healthcare Vendor Risks & Response

Healthcare organizations are scrambling to adjust their cybersecurity preparation and response capabilities in the wake of potential cyberattacks stemming from the ongoing conflict between Russia and Ukraine. This blog post provides threat intelligence on the escalating cyberwar activities stemming from this conflict as well as recommendations for healthcare vendor risk management programs to prepare and respond to these emerging threats. Read More

Obtaining Buy-In for Your Third-Party Risk Management Program

Third-party risk management breaches have been snowballing in recent months with no clear end in sight. However, too many healthcare organizations have maintained a status quo approach to their Third-Party Risk Management (TPRM) and Vendor Risk Management (VRM) programs. This blog provides recommendations for delivering messaging to key stakeholder groups within healthcare entities to make the business case for further investments in third-party risk programs. Read More

Keep Up with CORL: Vendor Breach Digest, 1/17/22

Our Vendor Breach Digest provides a summary roll-up of major breach events for third-party vendors operating within the healthcare supply chain. Breaches covered in this release: Kronos, Microsoft Exchange Outlook Web Access, BioPlus, QRS, BDO, The Medical Review Institute of America, Doxy.me, Jefferson Surgical Clinic, EMI Health, Neuro-Rehab Associates, UScellular, Georgia Bone and Joint Surgeons, Anthem, Walgreens, Daniel J. Edelman Holdings, A New Leaf Inc, Ibex, Ciox Health, Broward Health, UAW Retiree Medical Benefits, T-Mobile, Southern Orthopaedic Association, CompuGroup Medical & Bertelsmann, and Fiondella, Milone & LaSaracina LLP. Read More

Urgent Vendor Risk Alert: Log4j Java/Apache Logging Vulnerability

A far-spanning zero-day vulnerability was exposed over the weekend for the ubiquitous open-sourced logging utility called Log4j. CORL is actively working with our customers and vendor population to understand the extent of deployment of Log4j in the vendor community and the impact and risk exposure it may create for our customers. This blog provides a short summary of the Log4j vulnerability, as well as recommendations for remediation and risk mitigation for organizations and their third-party vendors. Read More

Keep Up with CORL: Vendor Breach Digest, 12/9/21

Our Vendor Breach Digest provides a summary roll-up of major breach events for third-party vendors operating within the healthcare supply chain. Breaches covered in this release: DNA Diagnostic Center, Ace Surgical Supply, Maxim Healthcare Services, Panasonic, Planned Parenthood, Boulder Neurosurgical and Spine Associates, Medsurant, Region IV Area Agency on Aging, Bureau Veritas, Mowery Clinic, Saltzer Medical Group, Blue Shield of California, Maryland Department of Health, Supernus Pharmaceuticals, Episcopal Retirement Services, Continental American Insurance, Anthem, Nationwide Laboratory Services, and Anthem Blue Cross of California. Read More

Healthcare Vendor Risk Management (VRM) FAQs

Are you able to answer these questions about your vendor risk management (VRM) process? What are the most common security frameworks and standards used for healthcare VRM assessments? Does HIPAA mandate that vendors and business associates need to perform security risk assessments? Which risk management tools are most commonly deployed to support healthcare VRM programs? How do healthcare organizations drive and track remediation for vendor security risks? What are the leading practices for high-performing VRM programs? Check out our vendor risk management FAQ to answer these and other related questions. Read More

CORL Releases New NIST 800-53 Rev 5 Vendor Questionnaire

CORL is continually innovating and updating our capabilities to provide the healthcare industry’s leading Vendor Risk Management solution set. We are pleased to announce that the ​CORL Vendor Portal now includes a new NIST SP 800-53 Rev 5 Vendor Security Questionnaire. The new vendor questionnaire is 351 questions and includes the following features: Read More