Remote Access Security for Healthcare: Why a Password Reset May Not Be Enough After a Compromise

Changing a compromised password may be an important first step after a cybersecurity incident.

It may not be the last one.

If someone has gained unauthorized access to a remote-access system, firewall, VPN gateway, administrator account, or other important part of the technology environment, healthcare organizations need to understand more than whether the original password has been changed.

They need to know:

What happened while that access was available?

Were other accounts created?

Were permissions changed?

Were authentication methods modified?

Were remote-access settings changed?

What systems were reached?

What do the logs show?

Those questions are particularly timely after an October 6, 2026 advisory from the FBI and U.S. Secret Service regarding FortiBleed, an active credential-compromise campaign targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways.

The American Hospital Association highlighted the advisory for the healthcare sector on October 7 and noted that affected organizations may need remediation beyond normal patching and password resets because attackers may disable accounts or change passwords after gaining access. Read the AHA alert

The federal warning applies to the specific Fortinet technology and activity described in the advisory.

But the broader security lesson is useful for healthcare organizations regardless of which remote-access technology they use:

Recovering a credential and understanding what happened during unauthorized access are two different tasks.

Why Is Remote Access Security Important for Healthcare?

Remote access security is the combination of identity, authentication, permissions, monitoring, and technical controls used to protect connections made to an organization's systems from outside its normal environment.

Healthcare organizations may use remote access for:

• Employees working from other locations
• IT administrators
• Managed service providers
• Software vendors
• Equipment vendors
• Consultants
• Business associates
• Support personnel
• Other authorized third parties

Remote access can be operationally necessary.

The security question is not whether all remote access should be eliminated.

It is whether the organization knows:

Who is connecting?

How they are authenticated?

What they can access?

What they can do after they connect?

How long that access should remain available?

How the organization can review what happened afterward?

HHS has specifically identified remote access as a security consideration under the HIPAA Security Rule. Its cybersecurity guidance notes that remote access may present a higher level of risk to electronic protected health information and that an organization's risk analysis should guide appropriate authentication and access controls. Review HHS guidance on authentication and remote access

What Did the October 6 Federal Advisory Say?

The FBI and Secret Service warned on October 6 that the FortiBleed campaign is targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways.

The FBI describes FortiBleed as an active global credential-compromise campaign.

The American Hospital Association's summary of the federal advisory explains that the activity has involved reused or leaked credentials and legacy password storage, with affected organizations potentially facing account lockouts if attackers disable accounts or change passwords. Review the FBI's 2026 cyber alerts

This is important context.

The guidance does not mean every healthcare organization uses affected Fortinet products.

It does not mean every remote-access service has been compromised.

And it should not be used to suggest that a healthcare organization has an active breach simply because it provides remote access.

The useful lesson is what organizations may need to evaluate after credentials or remote-access infrastructure have been compromised.

That investigation can extend well beyond changing a password.

A Password Reset Addresses the Credential. It Does Not Reconstruct the Incident.

Imagine an attacker obtains credentials for an account that can connect remotely to an organization's network.

The healthcare organization detects the issue and changes the password.

That may stop the attacker from using that particular credential again.

But the organization still needs to determine what happened before the password was changed.

For example:

• Did the attacker log in successfully?
• When did the access begin?
• Which systems were accessed?
• Were permissions changed?
• Was another account created?
• Were new authentication methods added?
• Were configuration settings modified?
• Was remote access enabled somewhere else?
• Was information accessed or transferred?
• Were security tools altered?
• Are any active sessions still open?

The answers determine what additional response may be necessary.

That is why password recovery and incident investigation should be treated as related but separate parts of the response.

Start With the Account, Then Look at What the Account Could Reach

After a suspected credential compromise, one of the first questions should be:

What authority did this account have?

Not all accounts create the same level of risk.

A normal employee account may have access to a limited group of systems.

An administrator account may be able to:

• Create or disable users
• Reset passwords
• Modify authentication methods
• Change permissions
• Alter network configurations
• Manage devices
• Install software
• Access servers
• Change security settings

That is why privileged accounts deserve additional scrutiny.

HHS specifically notes that privileged accounts may pose a greater risk because their access can supersede other role- or user-based controls. Review HHS cybersecurity guidance

AvTek's Cybersecurity Services include Multi-Factor Authentication, Privileged Access Management, identity controls, network security, endpoint protection, monitoring, and security assessments.

The goal is to reduce unnecessary access and provide greater visibility around accounts with elevated authority.

Check Whether Other Accounts Were Created or Changed

A compromised account can potentially be used to create additional access, depending on its permissions.

That creates an important incident-response question:

Did the attacker establish another way back into the environment?

Organizations may need to review:

• Newly created accounts
• Newly enabled accounts
• Unexpected administrator memberships
• Changed security groups
• New remote-access permissions
• Unusual user provisioning
• Changes to service accounts

Simply changing the original password would not necessarily remove access created through another account.

This is one reason maintaining visibility into identity and account activity is important.

Review MFA and Authentication Changes

Multi-factor authentication can make unauthorized account access more difficult.

But organizations also need processes around how MFA itself is managed.

After a suspected compromise, review whether:

• A new MFA device was enrolled
• An authentication method was removed
• A phone number was changed
• A new token or factor was registered
• MFA was disabled
• Recovery information was changed
• Authentication policies were modified

HHS notes that organizations should base authentication safeguards on their risk analysis and identifies stronger authentication, including MFA, as one option for reducing risks associated with remote access. Review the HHS guidance

The lesson is not simply:

Use MFA.

It is:

Protect the processes that control MFA as well.

Revoke Active Sessions Where Appropriate

Changing a password does not answer another important question:

Is the compromised user already authenticated somewhere?

Depending on the technology involved, organizations may need to consider active sessions, tokens, or other authenticated connections as part of containment.

The appropriate response will depend on the systems and circumstances involved.

But incident-response procedures should give IT and security teams a way to quickly determine:

• Which sessions are active
• Which devices are connected
• Whether those sessions can be revoked
• Whether remote connectivity should be temporarily restricted

That is particularly important for privileged or remote-access accounts.

Review the Remote-Access Configuration Itself

If the compromised account had administrative access to remote-access infrastructure, the organization should consider whether the infrastructure was changed.

Depending on the specific technology, that review may involve areas such as:

• User accounts
• Administrator accounts
• Authentication settings
• Remote-access policies
• VPN configuration
• Firewall rules
• Allowed network paths
• Logging
• Security settings

This is one of the key lessons from the October FBI and Secret Service advisory.

The AHA specifically noted that affected organizations could require remediation beyond routine patching and password resets because unauthorized users may have changed accounts or other settings. Read the AHA summary

Organizations using the technologies identified in the federal advisory should follow the specific mitigation and investigative guidance provided by the agencies and affected vendors.

For everyone else, the broader principle still applies:

When infrastructure is compromised, verify the infrastructure rather than assuming a new password restores the environment to its previous state.

Logs Help Answer the Question: What Actually Happened?

After an incident, memory is not enough.

Organizations need records.

Depending on the environment, logs can help answer:

• Which account logged in?
• When did authentication occur?
• Where did the connection originate?
• Which device was used?
• Which systems were accessed?
• What administrative actions occurred?
• Were permissions changed?
• Were new users created?
• Did the account access ePHI?
• Was activity unusual for that user?

The HIPAA Security Rule requires regulated entities to implement audit controls capable of recording and examining activity in systems that contain or use ePHI. Review the HHS summary of the HIPAA Security Rule

HHS also requires regulated entities to regularly review records of information-system activity as part of the Security Rule's administrative safeguards.

Those requirements make logging relevant beyond a single cybersecurity incident.

Logs help organizations understand whether their controls are operating as intended and provide information needed to investigate unusual activity.

Access Control and Authentication Work Together

The HIPAA Security Rule addresses both access control and authentication.

HHS states that regulated entities must implement technical policies and procedures that allow only authorized persons to access systems containing ePHI.

It also requires procedures to verify that a person seeking access to ePHI is who they claim to be. Review the HHS Security Rule summary

Those requirements answer two different questions.

Authentication

Are you actually the person you claim to be?

Authorization

What are you permitted to access after we verify your identity?

Both matter in remote access.

A legitimate employee can still have unnecessary permissions.

A compromised administrator account may have excessive authority.

A properly authenticated vendor may still need access to only one specific application.

Healthcare organizations should therefore review identity and permissions together rather than treating authentication as the end of the access decision.

Vendor Remote Access Deserves Its Own Review

Healthcare organizations often depend on outside technology providers.

Those relationships can be necessary for maintaining:

• Software
• Medical systems
• Business applications
• Networks
• Servers
• Cloud systems
• Specialized equipment

But vendor access should still be intentional.

Healthcare organizations should understand:

• Which vendors have remote access
• Which individual vendor users have accounts
• Whether access is shared
• What systems each vendor can reach
• How vendor users authenticate
• Whether MFA is required
• How long access remains active
• How vendor activity is logged
• Who approves changes
• How quickly access can be removed

HHS's risk-analysis guidance specifically tells regulated organizations to consider external sources of ePHI, including vendors and consultants that create, receive, maintain, or transmit that information. Review HHS risk-analysis guidance

For healthcare organizations that need additional cybersecurity leadership around vendor access and other security decisions, AvTek's vCISO Services include cybersecurity risk management, incident-response planning, governance, documentation review, vendor and third-party risk discussions, security recommendations, and support for HIPAA-related security responsibilities.

Remote Access Should Be Part of the HIPAA Risk Analysis

Remote access should not be managed separately from the organization's broader security-risk process.

HHS describes risk analysis as foundational to HIPAA Security Rule compliance.

A regulated entity's risk analysis should consider the ePHI the organization creates, receives, maintains, or transmits, along with the risks and vulnerabilities affecting that information. Review HHS risk-analysis guidance

For remote access, useful questions include:

• Which systems containing ePHI can be reached remotely?
• Which users have remote access?
• Which vendors have remote access?
• How are those users authenticated?
• Which privileged accounts can connect remotely?
• What devices may be used?
• What logging is available?
• How is access revoked?
• What happens when employment or a vendor relationship ends?
• What is the response if credentials are compromised?

The appropriate safeguards will vary by organization.

HHS does not prescribe one universal security architecture for every healthcare environment.

Instead, regulated entities are expected to identify their risks and implement reasonable and appropriate safeguards based on those risks.

Remote Access Is Also an Operational Continuity Issue

Cybersecurity incidents do not exist separately from healthcare operations.

If an organization needs to restrict remote access during an investigation, that may affect:

• IT support
• Administrative workflows
• Remote employees
• Vendor support
• Business applications
• Clinical support systems

That means incident planning should consider not only how to disable access but how the organization will continue operating safely while restrictions are in place.

The American Hospital Association has increasingly emphasized cyber resilience and clinical continuity alongside prevention and detection. Its October cybersecurity resources include guidance focused on protecting operations as well as responding to active threats.

The practical question becomes:

Can we contain the incident without creating unnecessary operational confusion?

That requires planning before the incident occurs.

Backup and Recovery Still Matter

An incident that begins with compromised credentials can still result in system disruption.

That means backup and recovery remain part of the broader resilience strategy.

A healthcare organization should understand:

• Which systems are backed up
• How often backups occur
• Whether backups are monitored
• Whether backup integrity is verified
• How quickly critical systems can be restored
• Who decides restoration priorities
• Whether recovery procedures have been tested

AvTek's Data Backup and Disaster Recovery Services support healthcare organizations with server and workstation backups, Microsoft 365 backup, recovery planning, backup monitoring and verification, ransomware recovery planning, and business-continuity support.

Changing a password may remove one access path.

Recovery planning answers a different question:

What happens if the incident has already disrupted the environment?

Managed and Co-Managed IT Can Support Different Healthcare Environments

Not every healthcare organization has the same internal IT resources.

Some organizations rely primarily on an outside technology partner.

Others have internal IT teams that need additional security, monitoring, infrastructure, or strategic support.

AvTek's Managed IT Services include proactive monitoring, cybersecurity and risk management, MFA, Microsoft 365 and Azure management, server and network management, backup and disaster recovery, and strategic IT planning for healthcare and other regulated organizations.

For organizations with internal IT staff, AvTek's Co-Managed IT Services can supplement the internal team with capabilities including:

• Managed Detection and Response
• Microsoft 365 security
• Privileged Access Management
• MFA
• Credential management
• Endpoint and identity management
• Network-device monitoring
• Backup and business continuity
• Incident-response escalation

The purpose is not to replace a capable internal team.

It is to provide additional capacity and cybersecurity capabilities where needed.

What Should Healthcare Organizations Review After a Remote-Access Credential Compromise?

A response should be tailored to the specific technology and incident.

But healthcare organizations can use the following questions to guide the investigation.

1. Was the Credential Actually Used?

Determine whether there were successful logins associated with the compromised account.

2. Are Any Sessions Still Active?

Determine whether existing authenticated sessions or connections need to be revoked.

3. Was MFA Changed?

Review newly enrolled devices, authentication methods, recovery settings, and policy changes.

4. Were Other Accounts Created or Modified?

Review user creation, administrator membership, permissions, and unusual account changes.

5. Were Remote-Access Settings Changed?

Review relevant firewall, VPN, authentication, and remote-access configuration.

6. What Systems Did the Account Reach?

Determine what information and technology were accessible with that identity.

7. What Do the Logs Show?

Review authentication, administrative, network, and system activity relevant to the incident.

8. Was ePHI Involved?

Determine whether systems containing electronic protected health information were accessed or affected.

9. Does Additional Containment Need to Occur?

Consider whether accounts, sessions, devices, network paths, or remote services need to be temporarily restricted.

10. Can Critical Systems Be Recovered?

If systems were changed, damaged, encrypted, or disrupted, understand the organization's recovery options.

That turns the response from:

"We changed the password."

into:

"We understand what happened, what changed, what was affected, and what needs to happen next."

What If Your Organization Does Not Use Fortinet?

The October 6 FBI and Secret Service advisory specifically addresses Fortinet FortiGate firewalls and SSL VPN gateways.

Healthcare organizations that do not use the affected technology should not treat the advisory as evidence that their own remote-access systems are compromised.

But the incident-response questions remain useful.

Every organization that provides remote access should understand:

• Who has access
• What credentials protect it
• How users authenticate
• Which accounts are privileged
• What activity is logged
• How sessions can be revoked
• How configurations are reviewed
• How unauthorized changes would be detected

The technology may differ.

The risk-management questions do not disappear.

Frequently Asked Questions About Healthcare Remote Access Security

Changing the Password Is the Beginning of the Question, Not the End

A password reset can be an important containment step.

But it does not tell you what happened while the credential was compromised.

For healthcare organizations, a more complete response asks:

Was the account used?

What could it access?

Were other accounts created?

Were permissions or MFA changed?

Were remote-access settings modified?

What do the logs show?

Was ePHI involved?

Can affected systems be recovered?

Those questions connect remote access to identity, privileged access, monitoring, HIPAA risk analysis, incident response, and business continuity.

The October 6 federal FortiBleed advisory provides a timely reminder of why those controls need to work together. The alert is technology-specific, but the risk-management lesson is broader: when access may have been compromised, verify the environment rather than assuming the original password was the only thing that changed.

AvTek Solutions helps healthcare organizations strengthen those layers through Managed IT Services, Co-Managed IT Services, Cybersecurity Services, Data Backup and Disaster Recovery, and vCISO Services.

If your healthcare organization has not recently reviewed its remote-access accounts, privileged access, MFA processes, logging, and incident-response procedures, this is a useful time to make sure the written process matches the environment you actually have.

Talk with AvTek about your healthcare cybersecurity risk