Wikipedia -WSS

Wikipedia

author：knowledge 2025-08-26 23:47:37 - browse：52774

In the last year, cyberattacks on hospitals have surged, putting a spotlight on the need to protect patients’ health data. But hackers don’t need to attack providers directly to get that valuable info. A new cybersecurity report shows it is remarkably easy for bad actors to steal it through third-party apps and data aggregators that tap into providers’ electronic health record systems.

Hacker and cybersecurity analyst Alissa Knight got access to more than 4 million patient and clinician records by exploiting vulnerabilities in data aggregators’ application programming interfaces, along with associated apps that track medications and share patient records — records that include demographics, lab results, medications, procedures, allergies, and more. Collectively, the tested tools can read and write data to the major EHR systems.

Knight initially set out looking for vulnerabilities in APIs built by the EHR companies themselves. Built on the open Fast Healthcare Interoperability Resources (FHIR) standard for health care data, those APIs are a powerful tool to unify data collected by different systems and support interoperability. “The EHR companies themselves have been partnering with me, allowing me access to their APIs” to conduct security testing, said Knight. But when she couldn’t find any soft spots in their systems, she began testing the FHIR APIs built by third-party data aggregators that interface with electronic health records, along with the gallery of apps that developers have built on those APIs.

Unlock this article by subscribing to STAT+ and enjoy your first 30 days free!

GET STARTED Log In

Previous article： Tori Bowie and the unacceptable rates of Black maternal death
Next article： Senator probes 340B programs at Cleveland Clinic, Bon Secours

WSS

Cancer drug shortages' outsize impact on ovarian cancer patients

Listen: Racing for gene therapy & a pioneering approval

Trump cancels press conference intended to dispute Georgia election interference charges

Special counsel raises new conflict of interest concerns for De Oliveira's lawyer

Baltimore teen accused of firing into crowd during block party mass shooting

Congress must give Medicare recipients genetic counseling access

explore

Wikipedia

Wikipedia

Duchenne breakthrough therapy leaves behind pioneering families

STAT Virtual Event: How to Increase Diversity in Clinical Trials

Wildfire smoke exposes gaps in outdoor worker protections

Why do women spend more than men on medical expenses?

23andMe had bad news about my health. I wish a person had delivered it

Cancer drug shortages' outsize impact on ovarian cancer patients

Over 800 arrested across France in 3rd night of riots after fatal police shooting of teen

Cigna to pay $172 million to settle Medicare Advantage fraud probe

How to save PrEP access — and even expand it

Lung cancer is America's deadliest cancer. Yet so few get screened

knowledge

Clinical trials must include more disabled people

Patient advocates sound warning on FDA proposal on salt intake

Baltimore teen accused of firing into crowd during block party mass shooting

New definition of a human embryo proposed amid rapid advances

After a drawn out lobbying fight, ARPA

Shingles, which affected Dianne Feinstein, is on the rise

focus

explore

hotspot

explore