Texas Hearing Institute recently disclosed a ransomware attack that compromised the protected health information of nearly 30,000 patients. The organization now faces HIPAA breach notification requirements, potential OCR investigation, remediation costs, and reputational damage.
This attack followed the same pattern as nearly every other ransomware incident: an executable payload was delivered to the organization’s Windows systems, executed, and proceeded to encrypt patient data files. The intervention happened too late — after the damage was done — or didn’t happen at all.
The Payload Has to Land Before It Can Encrypt
Every ransomware attack requires the malicious executable to be written to disk before it can run. Email attachment, browser download, remote access session, compromised software update — the delivery mechanism varies, but the file system operation is the same: a program writes an executable file to a Windows system.
That’s the intervention point.
FileSure operates at the Windows kernel level via a filter driver. It intercepts file system operations — create, write, read, delete, rename — before they reach the disk. You define which programs are allowed to write executable files. Everything else gets blocked and logged.
A ransomware payload delivered via email? Outlook isn’t authorized to write .exe files. Blocked.
Downloaded through a browser? Chrome isn’t authorized to write executables to user directories. Blocked.
Delivered via a compromised remote access session? The remote access client isn’t authorized to write executables outside its own program directory. Blocked.
The payload never lands. If it never lands, it never executes. If it never executes, it never encrypts your patient data files.
The Legacy System Problem in Healthcare
Healthcare organizations — including audiology practices like Texas Hearing Institute — often run specialized medical software, practice management systems, and diagnostic equipment on older Windows versions. The software is locked to those versions because it won’t run on anything newer, or because upgrading would require expensive recertification.
Modern endpoint security tools often won’t install on those systems. So they sit unprotected, connected to the network, holding patient data.
FileSure installs on all Windows versions from XP through Windows 11 and Server 2022. The same kernel-level protection applies to your legacy practice management system running on Windows 7 as it does to your modern EHR on Server 2022.
A Specific FileSure Configuration for Healthcare
Here’s a policy that would have prevented this attack:
Rule: Block executable file creation from email clients and browsers
File filter: *.exe, *.dll, *.scr, *.bat, *.cmd, *.ps1
Program filter: outlook.exe, chrome.exe, firefox.exe, edge.exe (deny list)
Operations: CREATE, WRITE
Action: BLOCK and LOG
This rule prevents the most common ransomware delivery vectors from writing executable payloads to disk. Legitimate software updates and IT-managed deployments use different mechanisms (Windows Update, SCCM, authorized deployment tools) that you explicitly authorize.
Every block generates a log entry: user name, machine name, program that attempted the write, file name, timestamp. Your HIPAA audit trail is automatically maintained.
HIPAA Requires This
The HIPAA Security Rule’s Technical Safeguards require covered entities to implement access controls and audit controls. Specifically: restrict access to ePHI to authorized users and programs, and maintain a record of who accessed what.
FileSure does both. It restricts file access to authorized applications — not just authorized users. An authorized employee running an unauthorized program still gets blocked. And every file access is logged: who, what, when, which program, which machine.
Your compliance documentation is always current because FileSure never stops recording.
Start Protecting Patient Data at the File System Level
The Texas Hearing Institute breach didn’t have to happen. The ransomware payload had to land on disk before it could encrypt patient files. That file write operation could have been blocked.
FileSure gives you that control — on every Windows system you run, including the legacy ones you can’t replace.
Start your free 21-day trial at bystorm.com. No credit card required. Full functionality. See how many unauthorized file operations are happening on your systems right now.
Source: Texas Hearing Institute Ransomware Attack Affects 30,000 Patients
Category: Ransomware
Tags: ransomware, healthcare breach, hipaa, patient data protection, kernel filter driver, file system security, legacy medical systems, texas
