This is extremely troubling news. It is really important to find out exactly what the compromise was here. Was the legit clinic using an unsecure platform or do they have a bad actor among them. I did find it interesting that the third party software companies weren't commenting on the case. It would be absolute mayhem in the healthcare industry if it turns out that the software was easily compromised by bad actors. I understand that a lot of smaller companies "get what they pay for" however HIPAA isn't something to fuck around with. And I would definitely like to see some criminal charges for the crisis center's theft of data and patients here. Those snake oil salesmen are a plague on real healthcare.

I want to know how this was accomplished. I meand did they hack them. Article is a bit short on detail:

"“AWHC’s outreach to Four Women’s patients appears to be the result of their unlawful infiltration of Four Women’s electronic platforms,” said Matthew Patton, an attorney representing Four Women. “The patients they are intercepting are seeking a range of reproductive health care services, from birth control to abortions to ultrasounds.”"

It is unclear exactly how Four Women’s patient communications were allegedly compromised. A digital security analyst contracted by Four Women, Robert Knapp with Rapid7 in Texas, said in court filings that the “most likely points” through which the center allegedly accessed patient data are Klara and AthenaHealth, two third-party vendors that Four Women uses to communicate with patients and manage their data. Neither company responded to GBH News’ requests for comment.

[…]

“I would love to hear from the app developers ... I want to hear from tech people exactly what is happening,” Barnett said. “It’s actually quite rare that an app itself is so heavily compromised — like, technically speaking, that there’s some vulnerability that is being burned by some hackers.”

I doubt it's anything so sophisticated. Probably purchasing targeted advertising and setting up front websites. It's far easier to masquerade as another party than it is to steal their data.

In some states, these “Crisis Pregnancy Centers” receive government funding. (Texas)

This is why the DPH awareness campaign referenced in the article is so important. This is some predatory bullshit interfering with people's healthcare. Ain't always fun being in MA but this is leading by example.

I hope CMS works with the clinic to improve information handling, rather than fining it out of existence.