Glasswing Secured the Code. The Rest of Your Stack Is Still on You

Threat Overview

Healthcare practices face an expanding attack surface that extends far beyond their primary software systems. Shadow IT — unauthorized applications employees install without approval — creates security gaps that circumvent official HIPAA controls. Forgotten integrations between your practice management system, billing software, patient portals, and third-party services accumulate over time, often maintaining access to ePHI long after anyone remembers they exist. Shadow AI tools represent the newest frontier: staff using ChatGPT, Claude, or other AI assistants to draft patient communications or analyze clinical data without realizing they're potentially exposing protected health information to third-party systems with no Business Associate Agreement.

Attackers don't need sophisticated AI to exploit these gaps. They simply identify the weakest link — an outdated plugin, an unsecured API connection, or a SaaS tool someone installed months ago that's still syncing your patient database. Average breach costs reach $9.8 million (IBM Security, 2024), with detection and containment averaging 258 days. For independent practices, a breach of this magnitude is often terminal.

Attack Vector & Tactics

The attack pattern is straightforward: reconnaissance identifies forgotten access points, initial access exploits weak authentication or outdated credentials, and lateral movement spreads through interconnected systems before anyone notices. A staff member uses a "free" appointment reminder service without vetting it. That service gets breached six months later. Your patient contact information — names, phone numbers, appointment types — is now circulating on criminal forums, and you never signed a BAA.

The challenge isn't sophisticated malware. It's visibility. Most practices can't answer basic questions: Which systems currently have access to our ePHI? When was the last security review of each integration? Do we have signed BAAs for every vendor touching patient data? Which cloud services are staff using without IT approval?

Defense Measures

Effective defense requires systematic inventory and continuous monitoring:

• Conduct quarterly access audits — document every system, integration, and SaaS tool with access to practice data
• Implement formal approval processes for all new software or services before staff deployment
• Require BAAs before data access — no exceptions, including "free" tools and AI services
• Use session-level logging to track exactly who accessed what ePHI and when
• Establish AI usage policies prohibiting entry of patient data into unapproved AI tools
• Review vendor security postures annually using standardized assessment frameworks
• Disable unused integrations immediately rather than leaving them dormant

The goal is eliminating blind spots. You can't secure what you can't see.

What This Means for Your Practice

Every practice has shadow IT. The question is whether you know about it before attackers do. Staff install tools with good intentions — a better scheduling app, an AI writing assistant, a file-sharing service — without understanding HIPAA's Business Associate requirements. Each creates potential breach pathways.

The regulatory exposure is direct. OCR expects practices to maintain comprehensive inventories of systems accessing ePHI, validate vendor security controls, and ensure BAAs are in place. "We didn't know staff was using that" isn't a defense. Documentation gaps during breach investigation signal systemic compliance failures, escalating penalties beyond the breach itself.