Your WordPress Hosting Should Match the Risk
by HIPAA Vault

HIPAA Compliance Tip of the Week

Secure Hosting Is the Foundation of HIPAA-Compliant WordPress.

WordPress itself isn't HIPAA compliant. Your hosting environment, server configuration, backups, security monitoring, and the way your website handles PHI determine whether your site can support HIPAA compliance.

Industry News Roundup

FBI Warns: This Phishing Attack Doesn’t Need Your Password

The FBI is warning about OAuth consent phishing, a technique that tricks users into granting a malicious application access to their cloud accounts.

Instead of stealing login credentials, attackers direct the victim to a legitimate permission screen from Microsoft, Google, or another trusted provider. Clicking Allow may authorize the malicious app to:

• Read and send emails

• Access contacts and files

• Modify account information

• Maintain ongoing access to sensitive data

Because the user approves the connection after authenticating, multifactor authentication may not stop the attack. Changing the account password afterward may also be insufficient—the application’s permissions or active tokens may remain valid until access is explicitly revoked.

Read the Permission Screen

Healthcare organizations should restrict which applications users can authorize, review connected apps regularly, monitor unusual account activity, and train employees to question unexpected consent requests.

Anyone who approved a suspicious application should contact their IT or security team, remove the application from their account, revoke its permissions and active sessions, and review the account for unauthorized activity.

Sometimes the most dangerous phishing page is a legitimate one asking you to trust the wrong application.

Learn How OAuth Consent Phishing Works →

Three High-Severity Flaws Found in a Healthcare “Switchboard”

Three high-severity vulnerabilities have been identified in NextGen Healthcare Mirth Connect, an integration engine used to exchange clinical and administrative information between healthcare systems.

Successful exploitation could allow attackers to:

• Extract sensitive data and stored credentials

• Read files from affected servers

• Write arbitrary files

• Disrupt data processing

• Trigger denial-of-service conditions

The vulnerabilities affect Mirth Connect 4.7.1 and earlier. NextGen has addressed all three in version 4.7.2.

The Software May Be Hidden Inside Another Product

Mirth Connect may operate between laboratory systems, imaging platforms, databases, and clinical applications. Organizations might not realize they use it because the integration engine can be embedded, managed, or resold as part of another product.

Healthcare IT teams should confirm whether Mirth Connect exists anywhere in their environment—including inside vendor-managed solutions—and verify the exact version. Software inventories, vendor disclosures, and software bills of materials can help uncover components that are otherwise easy to miss.

CISA had not reported known public exploitation when its advisory was released, but organizations should not wait for that to change.

Check the Affected Versions and Vulnerabilities →

Your WordPress Site Needs Ongoing Protection

Healthcare websites do not stay secure automatically. WordPress core, plugins, themes, permissions, databases, and server software all require continuous maintenance.

HIPAA Vault’s fully managed WordPress hosting helps your organization reduce that workload with:

• A Business Associate Agreement

• Managed WordPress and software updates

• Daily backups and continuous monitoring

• Multifactor authentication and access logging

• Firewall, malware, and DDoS protection

• 24/7 support from a HIPAA-trained team

Choose an environment suited to your traffic, applications, customization requirements, and growth—without managing the underlying security infrastructure yourself.

Plans start at $120 per month, and your first month is free.