Five small healthcare organizations — including Family Medical Associates — have publicly disclosed security incidents that exposed patient data, as reported by The HIPAA Journal. While the individual announcements differ in detail, the pattern is one I've watched accelerate over the past several years: threat actors have systematically shifted attention downstream from large hospital systems to small practices, specialty clinics, and business associates that hold the same density of protected health information (PHI) with a fraction of the defensive capability.
Small healthcare organizations are attractive for three reasons. First, PHI remains one of the highest-value data classes on criminal markets — a complete medical record enables identity theft, insurance fraud, and extortion in ways a stolen credit card never will. Second, small clinics typically run lean IT: no dedicated security staff, flat networks, legacy EHR deployments, shared credentials, and email tenancy without conditional access or robust logging. Third, HIPAA's breach notification requirements mean these incidents become public, creating extortion leverage — attackers know a covered entity cannot quietly absorb a disclosure.
If you operate or advise a small healthcare organization, this is your moment to act. The HHS Office for Civil Rights (OCR) continues to levy enforcement actions following breaches where basic Security Rule safeguards were absent. The defensive measures below are not theoretical — they are the controls that consistently separate organizations that contain an intrusion from organizations that end up in a breach notification letter.
Technical Analysis
The disclosures covered by The HIPAA Journal follow the dominant intrusion patterns we see against small covered entities and business associates. Because the public notifications for small-entity breaches frequently cite "unauthorized access" to email accounts or network servers without naming a specific CVE, defenders should focus on the techniques that produce these outcomes rather than a single vulnerability:
1. Email account compromise (the most common vector in small-entity breach notifications). A large share of healthcare breach reports to HHS trace back to a compromised mailbox — usually via phishing, credential stuffing against Microsoft 365 tenants without MFA, or adversary-in-the-middle kits that harvest session tokens. Once inside, attackers search mailboxes for PHI attachments, set up inbox rules to forward or hide mail, and quietly exfiltrate patient rosters, lab results, and billing records. Small practices often store astonishing amounts of PHI in email because staff use it as a de facto file transfer mechanism.
2. Network intrusion and ransomware-adjacent data theft. The second pattern is an external attacker gaining initial access via exposed remote services (RDP, VPN appliances, unpatched firewalls), moving laterally to file servers hosting EHR databases, scans, and billing exports, then staging and exfiltrating data before — or instead of — deploying ransomware. Double-extortion groups explicitly target healthcare because the regulatory exposure makes payment more likely.
3. Third-party and business associate compromise. Several recent small-entity disclosures originated not in the clinic itself but at a billing vendor, IT provider, or collections agency. Under HIPAA, the covered entity still bears notification obligations when a business associate is breached, which is why vendor risk management is non-negotiable.
Exploitation status: These are not theoretical techniques. Email compromise and data extortion against healthcare are confirmed, ongoing, and tracked by HHS/OCR's breach portal, which consistently shows "Hacking/IT Incident" and "Unauthorized Access/Disclosure" as the leading breach categories affecting small providers. CISA, the FBI, and HHS have issued repeated joint advisories on ransomware and data-theft groups targeting the Healthcare and Public Health sector.
Detection & Response
The detections below target the two highest-probability behaviors in small-clinic breaches: suspicious mailbox manipulation (forwarding rules, mass PHI access) and bulk data staging/archiving on endpoints and file servers. These are tuned to be high-signal rather than exhaustive — deploy them and baseline against your environment.
---
title: Suspicious Inbox Rule Created to Hide or Forward Mail
description: Detects creation of inbox rules that delete, move to obscure folders, or forward mail externally — a hallmark of business email compromise and mailbox-based PHI theft in healthcare breaches.
references:
- https://attack.mitre.org/techniques/T1114/002/
author: Security Arsenal
date: 2026/04/06
id: 3f8a2c91-7b4d-4e6a-9c1f-2d5e8a0b6c34
status: experimental
logsource:
product: office365
service: exchange
detection:
selection:
Operation:
- 'New-InboxRule'
- 'Set-InboxRule'
filter_parameters:
Parameters|contains:
- 'DeleteMessage'
- 'ForwardTo'
- 'ForwardAsAttachmentTo'
- 'RedirectTo'
- 'MoveToFolder'
condition: selection and filter_parameters
falsepositives:
- Legitimate user-created forwarding or organizational rules; baseline approved forwarding destinations
level: high
---
title: Mass Archive Creation of Patient Data Directories
description: Detects use of archiving utilities (7-Zip, WinRAR, tar) against directories likely to contain PHI or EHR exports — a common staging behavior before exfiltration in healthcare intrusions.
references:
- https://attack.mitre.org/techniques/T1560/001/
author: Security Arsenal
date: 2026/04/06
id: 91c4e7d2-3a8f-4b5c-8e6d-1f0a9b2c4d78
status: experimental
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith:
- '\7z.exe'
- '\7za.exe'
- '\rar.exe'
- '\winrar.exe'
selection_cli:
CommandLine|contains:
- ' a '
- ' u '
selection_path:
CommandLine|contains:
- 'patients'
- 'ehr'
- 'emr'
- 'medical'
- 'billing'
- 'claims'
- 'scans'
- 'phi'
- 'shares\\'
condition: selection_img and selection_cli and selection_path
falsepositives:
- Legitimate backup or archival jobs run by IT; whitelist known backup service accounts and scheduled tasks
level: high
---
title: Non-Interactive Logon to EHR or File Server From Unusual Workstation
description: Detects network logons (Type 3) to servers hosting EHR databases or patient file shares from workstations that do not normally connect — an indicator of lateral movement toward PHI stores.
references:
- https://attack.mitre.org/techniques/T1021/
author: Security Arsenal
date: 2026/04/06
id: 5b2d9f47-8c1e-4a3b-b7d2-6e8f0a1c3d95
status: experimental
logsource:
product: windows
service: security
detection:
selection:
Logon_Type: 3
Authentication_Package: NTLM
filter_known_admins:
Account_Name|contains:
- 'svc-backup'
- 'svc-ehr'
condition: selection and not filter_known_admins
falsepositives:
- Normal clinical workflows generating SMB traffic; pair with a baseline of expected workstation-to-server pairs before raising severity
level: medium
// Hunt: External forwarding rules and suspicious inbox rule creation in Microsoft 365
// Surface accounts that suddenly forward mail externally or hide messages — top BEC/PHI-theft indicator
OfficeActivity
| where TimeGenerated > ago(14d)
| where Operation in ("New-InboxRule", "Set-InboxRule")
| extend Params = tostring(Parameters)
| where Params has_any ("ForwardTo", "ForwardAsAttachmentTo", "RedirectTo", "DeleteMessage")
| extend ForwardTarget = tostring(parse_json(Parameters)[0].Value)
| summarize RuleCreations = count(), Rules = make_set(ForwardTarget), LastSeen = max(TimeGenerated)
by UserId = tostring(parse_json(UserId)), ClientIP = tostring(ClientIP)
| where RuleCreations >= 1
| project UserId, ClientIP, RuleCreations, Rules, LastSeen
| sort by LastSeen desc;
// Hunt: Abnormal volume of file access against servers hosting patient data (via Defender for Endpoint)
// Flags devices reading an unusually large number of distinct files in PHI-relevant folders
let threshold = 500;
DeviceFileEvents
| where TimeGenerated > ago(24h)
| where FolderPath has_any ("patients", "ehr", "emr", "medical", "billing", "claims", "scans", "phi")
| where ActionType in ("FileCreated", "FileModified", "FileRenamed")
| summarize DistinctFiles = dcount(FileName), Files = make_set(FileName, 20)
by DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName
| where DistinctFiles > threshold
| sort by DistinctFiles desc;
// Hunt: New or rare network connections to EHR/file servers (CEF/Syslog-ingested firewall data)
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DestinationPort in (445, 3389, 1433, 3306)
| summarize Connections = count(), Sources = make_set(SourceIP)
by DeviceName, DestinationIP, DestinationPort
| where Connections < 5
| sort by Connections asc
-- Hunt for archive staging of patient data and unusual compression activity on clinic endpoints
-- Deploy across workstations and file servers; review hits for non-backup processes
SELECT Pid,
Name,
Exe,
CommandLine,
Username,
CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(7z|7za|rar|winrar|tar).*( a | u | -r ).*(patient|ehr|emr|medical|billing|claims|scans|phi|\\\\)'
OR Exe =~ '(?i)(7z|7za|rar)\.exe$'
-- Hunt for recently created large archives in user-writable and staging locations
SELECT FullPath,
Size,
Mtime,
Atime
FROM glob(globs=[
'C:/Users/*/AppData/Local/Temp/**/*.zip',
'C:/Users/*/AppData/Local/Temp/**/*.7z',
'C:/Users/*/AppData/Local/Temp/**/*.rar',
'C:/ProgramData/**/*.zip',
'C:/ProgramData/**/*.7z',
'C:/Users/*/Desktop/**/*.zip',
'C:/Users/*/Documents/**/*.7z'
])
WHERE Size > 50000000
AND Mtime > now() - 86400 * 7
# Healthcare Small-Clinic Hardening & Audit Script (Microsoft 365 + Windows Server)
# Run as Global Admin (Graph modules) and Domain Admin (AD sections). Review output before acting.
# --- 1. Audit: find all mailboxes with external forwarding enabled ---
Connect-ExchangeOnline
Get-Mailbox -ResultSize Unlimited | ForEach-Object {
$mbx = $_
if ($mbx.ForwardingSmtpAddress -or $mbx.ForwardingAddress) {
[PSCustomObject]@{
Mailbox = $mbx.PrimarySmtpAddress
ForwardingSmtp = $mbx.ForwardingSmtpAddress
ForwardingInternal = $mbx.ForwardingAddress
}
}
Get-InboxRule -Mailbox $mbx.PrimarySmtpAddress -ErrorAction SilentlyContinue |
Where-Object { $_.ForwardTo -or $_.RedirectTo -or $_.DeleteMessage } |
ForEach-Object {
[PSCustomObject]@{
Mailbox = $mbx.PrimarySmtpAddress
RuleName = $_.Name
ForwardTo = ($_.ForwardTo -join ';')
RedirectTo = ($_.RedirectTo -join ';')
DeleteMessage = $_.DeleteMessage
}
}
} | Export-Csv -Path "C:\Audit\MailboxForwardingAudit.csv" -NoTypeInformation
# --- 2. Remediate: block automatic external forwarding tenant-wide ---
Get-RemoteDomain Default | Set-RemoteDomain -AutoForwardEnabled $false
# --- 3. Verify: confirm MFA registration coverage and flag gaps ---
Connect-MgGraph -Scopes "UserAuthenticationMethod.Read.All","Policy.Read.All"
Get-MgReportAuthenticationMethodUserRegistrationDetail -All |
Where-Object { -not $_.IsMfaRegistered } |
Select-Object UserPrincipalName, IsMfaRegistered |
Export-Csv -Path "C:\Audit\MfaGaps.csv" -NoTypeInformation
# --- 4. Verify: legacy auth must be disabled; list enabled conditional access policies ---
Get-MgIdentityConditionalAccessPolicy -All |
Select-Object DisplayName, State |
Format-Table -AutoSize
# --- 5. Harden: disable SMBv1 on all servers (legacy lateral-movement protocol) ---
Get-WindowsFeature FS-SMB1 | Select-Object Name, InstallState
Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -NoRestart -ErrorAction SilentlyContinue
Set-SmbServerConfiguration -EnableSMB1Protocol $false -Confirm:$false
# --- 6. Harden: ensure RDP is not exposed; verify NLA is required ---
Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' \
-Name UserAuthentication | Select-Object UserAuthentication
Set-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' \
-Name UserAuthentication -Value 1
# --- 7. Audit: enabled file-and-audit logging on PHI shares (requires GPO for object access auditing) ---
Get-SmbShare | Where-Object { $_.Path -match 'patient|ehr|emr|medical|billing|claims' } |
Select-Object Name, Path, CurrentUsers | Format-Table -AutoSize
Write-Host "Audit complete. Review C:\Audit output. Remediate forwarding rules and MFA gaps immediately."
Remediation
There is no single patch for this story — the fix is a prioritized control set. Based on fifteen years of healthcare IR engagements, this is the order of operations that produces the fastest risk reduction for small covered entities:
Within 48 hours:
- Enforce MFA on every account, no exceptions — email, EHR remote access, VPN, and administrative interfaces. Phishing-resistant methods (FIDO2/security keys) for administrators; at minimum, app-based MFA for clinical staff. Mailbox compromise is the single largest source of small-entity breach notifications, and MFA is the single largest mitigation.
- Disable external auto-forwarding in Exchange Online (
Set-RemoteDomain Default -AutoForwardEnabled $false) and audit every existing inbox rule. Any rule a user cannot explain gets deleted and the account gets a password reset plus sign-in review. - Audit sign-in logs for impossible travel and unfamiliar geographies going back 90 days. If you find unauthorized mailbox access, you now have a HIPAA breach determination to make — involve privacy counsel early.
Within 30 days:
- Close the perimeter basics: no RDP exposed to the internet, VPN appliances and firewalls on current firmware, SMBv1 disabled, and EHR database servers segmented away from general clinical workstations. Most small-clinic network intrusions I respond to walked in through one of these four doors.
- Verify backups are offline or immutable and actually restorable. Test a restore of your EHR database and critical file shares. Ransomware groups count on small practices having backups that are connected, unencrypted, or never tested.
- Enable and centralize logging: Microsoft 365 unified audit log, endpoint detection on every workstation and server, and retention that satisfies your risk analysis. You cannot investigate a breach you cannot see, and OCR expects you to reconstruct what data was accessed.
Within 90 days:
- Conduct or refresh your HIPAA Security Rule risk analysis (45 CFR §164.308(a)(1)). OCR's enforcement actions after breaches almost universally cite a missing or stale risk analysis. The HHS Security Risk Assessment Tool is free and sized for small practices.
- Review every Business Associate Agreement and ask your billing, IT, and collection vendors what their MFA, EDR, and incident notification commitments are. Several small-entity disclosures originate at the vendor, but the notification burden lands on you.
- Tabletop your breach response: who calls counsel, who preserves evidence, who drafts the OCR and state notifications, and within what timelines (60 days to HHS and affected individuals for breaches of 500+; annual reporting for smaller incidents, with state laws often stricter).
If you are currently responding to a suspected incident: isolate affected systems without powering them off, preserve mailbox audit logs and endpoint telemetry before resetting anything, and engage DFIR support before making containment decisions that could destroy attribution evidence. Notification clocks under HIPAA and state breach statutes are unforgiving, and the investigation quality in the first 72 hours largely determines your regulatory outcome.
Related Resources
Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.