Four healthcare organizations just announced data breaches: HCA Healthcare, Blossom Health, El Camino Health, and University of Mississippi Medical Center. The details are still emerging, but the pattern is depressingly familiar.
Healthcare is the most targeted sector for ransomware and data theft. The reason is simple: the data is critical, the systems are often old, and the pressure to pay or remediate is enormous. A hospital that can’t access patient records isn’t just inconvenienced — it’s potentially unable to provide care.
What Actually Happens in Healthcare Breaches
Regardless of the specific attack vector, nearly every healthcare data breach involves unauthorized file system operations on Windows machines:
Ransomware delivery: The attacker delivers a payload via phishing email, compromised credentials, or an unpatched vulnerability. That payload has to write an executable file to disk before it can run. Once it runs, it begins encrypting files — writing encrypted versions over the originals or creating new encrypted copies.
Unauthorized PHI access: An external attacker or malicious insider uses legitimate or stolen credentials to access patient records. They open PHI files using unauthorized programs — a script, a custom tool, or even just copying files to a personal cloud storage folder via a browser.
Data exfiltration: Before PHI can leave the building, it has to be read from disk and copied somewhere — a USB drive, an email attachment, a file upload to a personal webmail account, a sync to Dropbox.
All of these are file operations. All of them happen at the Windows kernel level. And all of them can be controlled.
How FileSure Prevents It
FileSure Defend operates as a Windows kernel filter driver. It sits between applications and the file system, intercepting every file operation: open, read, write, delete, create, rename. It enforces behavioral policies that define which users, programs, and machines can perform which operations on which files.
Here’s a specific rule configuration that would apply to a healthcare environment protecting electronic health records:
File filter: *.hl7, *.xml, *.dat, C:\ProgramData\EHR\*, \\FileServer\PatientRecords\*
Authorized programs: EHRClient.exe, PACS_Viewer.exe, LabSystem.exe
Allowed operations: Read, Write (for authorized programs only)
Blocked operations: Delete, Rename, Copy to removable drives (USB, external), Copy to network shares outside approved locations
Logging: All access attempts — successful and blocked — recorded with user name, machine name, program name, timestamp
What this does:
- Blocks ransomware payload delivery: If a phishing email delivers a malicious executable, or a compromised RDP session tries to write a payload, FileSure blocks the write operation. The file never lands on disk. The ransomware never runs. Encryption never starts.
- Prevents unauthorized PHI access: Only the authorized EHR client, PACS viewer, and lab system can open patient data files. If a PowerShell script, a Python exfiltration tool, or even just
notepad.exetries to open those files, the operation is blocked and logged. - Stops data exfiltration: Even if an attacker has valid credentials and can log in, they can’t copy PHI files to a USB drive, upload them via webmail, or sync them to personal cloud storage. The file read operation for unauthorized programs is blocked at the kernel level.
The Legacy System Problem
Here’s the uncomfortable truth that most healthcare IT teams live with: a significant portion of medical infrastructure runs on Windows versions that mainstream security vendors stopped supporting years ago.
Medical imaging systems. Laboratory equipment. Infusion pumps. Pharmacy dispensing systems. Much of this is locked to Windows 7, Windows XP, or even older versions — not because the IT team is negligent, but because the specialized medical software won’t run on anything newer. The vendor won’t certify it. The FDA approval is tied to a specific configuration.
Modern endpoint security tools won’t install on those systems. So they sit unprotected, connected to your network, holding patient data.
FileSure installs on all of them. We run on legacy and modern Windows systems. The same kernel-level file operation control that protects your modern workstations protects the PACS system running Windows 7 in radiology.
HIPAA Audit Trails
Every access to a file containing patient data is recorded: who accessed it, when, from which machine, with which program. Logs are encrypted, tamper-resistant, and stored separately from the files they record. Your HIPAA audit trail is always ready, because FileSure never stops recording.
The HIPAA Security Rule requires covered entities to implement technical policies restricting PHI access to authorized users and programs, and to record and examine activity. FileSure produces exactly that — automatically, continuously, and in a format your compliance team can actually use.
If your EHR, PACS, RIS, laboratory, or pharmacy system runs on an older version of Windows, FileSure still protects it. Your compliance doesn’t stop at the edge of your modern infrastructure.
Healthcare data breaches are not inevitable. The file operations that enable them can be controlled. Start a free 21-day trial at bystorm.com and see how FileSure protects your patient data — including the systems running on legacy Windows.
Source: Data Breaches Announced by HCA Healthcare; Blossom Health
Category: Data Loss Prevention
Tags: healthcare data breach, hipaa compliance, phi protection, ransomware prevention, kernel filter driver, legacy windows security, medical device security, file system security
