DHS identifies vulnerability for Phillips Tase EMR, issues advisory

PARCA eNews – April 30, 2019 – The Department of Homeland Security issued an advisory to users of the Phillip Tasy electronic medical records on April 30, 2019. The advisory noted that the EMR system was vulnerable to low-skill-level exploitation and outlined steps users can take to mitigate the problem.

Philips Tasy EMR is a comprehensive healthcare informatics solution that integrates all areas of the healthcare environment, connecting clinical and non-clinical domains within a hospital system.

The vulnerability was reported by security researcher Rafael Honorato, who reported it to Phillips. Successful exploitation could impact patient confidentiality and system integrity. Phillips’ analysis found that full exploitation could allow hackers of low skill into the customer site, or via VPN allow them to provide unexpected input into the application, execute arbitrary code, or alter the intended control flow of the system.

DHS recommends users should follow the product configuration manual and not provide Tasy EMR access to the internet without a VPN. Users are also advised to update the most recent three released versions of the product.

NCCIC (National Cybersecurity and Communications Integration Center) recommends users take these defensive measures to minimize risks:

• Restrict system access to authorized personnel only and follow a least privilege approach.
• Apply defense-in-depth strategies
• Disable unnecessary accounts and services
• Where additional information is needed, refer to existing cybersecurity in medical device guidance issued by the FDA.

For more information check the Phillips Security website.

https://ics-cert.us-cert.gov/advisories/ICSMA-19-120-01

https://www.dhs.gov/sites/default/files/microsite-banner/18_1119_CISA_microsite-banner-01b_0.jpg