The Role of Cybersecurity in Insurance Eligibility

What it means for healthcare providers

On October 21, Ontario Health and the Canadian Centre for Cyber Security issued advisories about two serious security flaws in PHP, a programming language used by many websites and web-based applications. Our team has reviewed both advisories and looked at how they apply to the technology healthcare providers rely on. For most of our clients, there is nothing you need to do. Here is how it breaks down.

What happened

PHP is a programming language that runs a large share of the world’s websites and web-based applications. It is also built into the setup pages of some devices. Two flaws were recently found in it, and the fix has already been released. They are rated critical because an attacker could use them to take control of a website or web server that has not been updated. Ontario Health sent an advisory to healthcare organizations on October 21, and the Canadian Centre for Cyber Security issued its own alert the same day.

For a clinic, pharmacy, dental office or any other healthcare provider, it comes down to one thing: whether anything in your office runs PHP and connects to the internet. For most of our clients, nothing does.

What this means for the technology you rely on

Here is how each layer stands, starting with the systems that matter most to patient care.

• Your EMR, dental software or pharmacy system. Most clinics use a cloud-based EMR, and the same goes for the add-ons that connect to it, such as online booking, eReferral, secure messaging and AI scribe tools. These are looked after and updated by the vendor, not by us and not by you. We stay in close contact with those vendors and keep an eye on their security updates so we can let you know quickly if anything changes. As of today, none have been reported as affected. Dental practice software and pharmacy management systems are more often installed on a server in your office. Those are Windows applications that do not normally use PHP, so we do not expect them to be affected, and their updates still come from the vendor.
• Anything in your office that connects to the internet. Next comes equipment that can be reached from outside the office. Many security camera recorders (NVR and DVR systems) do not use PHP. Remote access tools such as VPN and remote desktop do not use PHP either, so we are not aware of any that are affected.
• The software you use every day. Microsoft 365, QuickBooks and most of the other programs on your computers do not use PHP, so we do not expect them to be affected.
• Printers, scanners and other devices. Most of these contain no PHP at all. If a manufacturer decides a fix is needed, it comes from them as a firmware update.
• Your website or anything custom-built. This is the one area outside our management. A website, intranet or custom-built tool is looked after by the developer who built it, and websites are where PHP is most often found. If you have one, ask your developer to confirm the update has been applied. We are happy to work with them to make sure it is done properly.

What you need to do

For most of our clients, nothing. We have scanned the systems we manage, contacted the few clients who may be affected, and remediation is done or under way. If you have not heard from us, there is nothing to do. 

If you have a website, an intranet or a custom-built application, ask whoever maintains it to confirm the PHP update has been applied. If you are not sure who that is, or would rather we handled it, let us know and we will coordinate with them for you.

And if you are simply not sure, that is fine. Whether you want advice, a second look at something in your office, or written confirmation of our review for your records, reach out to our team at any time. We are always happy to help.