CareScope Watch/Compliance/August 20, 2026

Website tracking on patient-facing pages is still a live risk

Federal guidance on online tracking technologies used by covered entities has been litigated and revised, but the underlying exposure has not changed: analytics and advertising tags on patient-facing pages can transmit identifiable information to third parties.

Why it matters

Most practice websites were built by a marketing vendor who added tags without a business associate agreement or a second thought.

What it means for your practice

Inventory every tracking script on your patient-facing pages, especially appointment and symptom pages. Remove what you cannot justify, and get agreements in place for what remains.

Source

HHS Office for Civil Rights, Online Tracking Guidance

CISA Adds ConnectWise ScreenConnect Flaw to Exploited Vulnerabilities List

CISA added three vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. The additions include an improper privilege management and missing authorization vulnerability in ConnectWise ScreenConnect (CVE-2026-84869), alongside two authorization and authentication flaws in JFrog Artifactory.

What it means

Cybersecurity/Sep 10

Orthanc DICOM Server Vulnerable to Denial-of-Service Flaw

A vulnerability in Orthanc DICOM Server versions prior to 1.13.0 allows an authenticated remote attacker to trigger a heap out-of-bounds write. The issue stems from an integer overflow in pitch and buffer-size computation when decoding an attacker-supplied PNG or JPEG image. Exploitation crashes the Orthanc process, causing a denial-of-service condition.

What it means

Cybersecurity/Sep 10

CISA Warns of Actively Exploited MikroTik RouterOS Vulnerabilities

CISA has added two MikroTik RouterOS vulnerabilities to its Known Exploited Vulnerabilities Catalog due to evidence of active exploitation. The flaws include CVE-2026-67277, a missing authentication vulnerability for a critical function, and CVE-2026-86060, an improper neutralization of argument delimiters in a command.

What it means