AdaptHealth, a publicly traded provider of home medical equipment and diabetes supplies, just disclosed a material cybersecurity incident involving the theft of patient data. The company hasn’t released full technical details yet, but the pattern is familiar: an attacker gained access to systems containing protected health information and exfiltrated it.
What Happens at the File System Level
Data theft requires reading files from disk before transmitting them anywhere. Whether the exfiltration happens via email, FTP, cloud sync, USB drive, or an encrypted tunnel back to the attacker’s infrastructure, the first step is always the same: some program opens patient data files and reads them.
That’s a file read operation. Windows file system, kernel level, every single time.
Most organizations focus on perimeter security, endpoint detection, and network monitoring. Those are important layers. But they all operate after the fact — detecting the exfiltration attempt while it’s happening or analyzing logs afterward. By that point, the files have already been read from disk. The data is already in the attacker’s hands.
FileSure operates upstream. It controls file operations at the kernel level, before the read happens.
How FileSure Prevents Patient Data Exfiltration
FileSure enforces behavioral policies through a Windows kernel filter driver. You define which programs are authorized to perform which file operations on which files. Everything else gets blocked.
For a healthcare organization protecting patient data, the policy is straightforward:
File Name Filter: *.xml, *.hl7, *.dat, *.db, *patient*, *PHI*, [EHR-specific file extensions]
Authorized Programs: C:\Program Files\EMR\emr.exe, C:\Program Files\PACS\viewer.exe, C:\Program Files\Billing\billing.exe
Operations: Read, Write
Result: Only your EHR, PACS, and billing applications can open patient data files. Any other program attempting to read those files — malware, remote access tool, PowerShell script, even File Explorer — gets blocked immediately. The operation fails at the kernel level. The file contents never reach the unauthorized program.
The attacker can have full administrative access to the system. Doesn’t matter. The kernel filter driver intercepts the file operation before it reaches the file system and denies it based on policy.
The Audit Trail You Actually Need
Every blocked attempt gets logged: user name, machine name, program that attempted access, file name, operation, timestamp. Every successful access by an authorized program gets logged too.
That’s your HIPAA audit trail. Not Windows Event Log entries that roll over when the log fills. Not application logs that the application itself controls. A separate, encrypted, tamper-resistant log that records every file access to PHI, continuously, automatically.
When OCR shows up for an audit and asks who accessed patient data, you have the answer. When you’re investigating a breach and need to know what the attacker touched, you have the answer. When an employee’s laptop gets stolen and you need to know if patient data was on it and whether anything accessed those files, you have the answer.
Legacy Systems Get Protected Too
A significant portion of healthcare infrastructure runs on older Windows versions. Medical imaging systems, laboratory equipment, pharmacy systems — often locked to specific Windows versions because the specialized software won’t run on anything newer.
Modern endpoint security tools won’t install on those systems. FileSure installs on all of them. Windows XP through Windows 11, Windows Server 2003 through 2025. Same kernel filter driver, same policy enforcement, same audit trail.
Your compliance doesn’t stop at the edge of your modern infrastructure. Neither should your file system security.
AdaptHealth’s incident is still unfolding, but the file system operations involved are the same as every other data theft: unauthorized programs reading files they shouldn’t have access to. Control the file operations, stop the exfiltration.
Start a free 21-day trial at bystorm.com and see how FileSure protects patient data by controlling file operations at the kernel level.
Source: AdaptHealth Reports Material Cybersecurity Incident and Theft of Patient Data
Category: Data Loss Prevention
Tags: patient data theft, healthcare breach, hipaa compliance, phi protection, kernel filter driver, file system security, data exfiltration
