A major security vulnerability was just discovered in PHP -- and it's important for therapists to know about it.
As background, PHP is a technology that powers a HUGE chunk of the internet. Like a surprisingly huge chunk. If a website is powered by Wordpress? PHP. Just to name one of the biggest examples.
This PHP security vulnerability could allow attackers to take control of affected servers without a password or login. And once they can take control? Ehhh... It's not good. Once inside a server, the attacker can access credentials, data, processes, and code that the server contains or has access to.
Security patches have since been released, but it takes time for so many websites to update and apply these patches (and some dormant ones may never apply them)... And attackers had already been attempting to exploit the vulnerability before these patches were released.
And so why does any of this matter?
Privacy! Security! Data minimization!
Maybe your EHR isn't built on PHP. Maybe your AI scribe service isn't built on PHP. (Doing some quick research, it looks like most EHRs and AI scribes are not built on PHP, although there's a handful of less notable examples.)
But non-PHP software isn't automatically in the clear.
Modern applications like these rely on interconnected systems. Maybe it's a customer support portal. Maybe it's an administrative dashboard. Maybe it's a sales tool. A vulnerability in one of these can impact and expose other systems and other data. Hackers gaining access to an otherwise unrelated system can potentially expose sensitive information handled elsewhere in the company's infrastructure.
To be clear, there's no evidence that this particular vulnerability has compromised an EHR or AI scribe.
But these vulnerabilities are going to keep popping up. AI is super super good at finding them.
And so everyone has to be thoughtful about what data they choose to handle and process and store -- and what data they choose to never collect at all. (And remember: A HIPAA sticker does not automatically stop these vulnerabilities from impacting an otherwise secure website.)
At Quill, we think therapy session conversations should stay in the room. Not sent somewhere else, not recorded, not transcribed. Not sitting somewhere forever as a "de-identified" transcription file.
And the giant perk with this approach?
A security vulnerability will never expose a never-recorded therapy session!
If you don't use an ambient AI scribe, you can rest easy that your clients' most private conversations will never see the light of day.
It's a relief that (so far) there hasn't been an impacted EHR or AI scribe. And we hope this serves as a wake-up call to others that these vulnerabilities exist -- and will continue to exist and get exposed and get exploited. And therapy clients stand to lose the most.
Note: In addition to never handling or processing therapy session recordings, audio files, or transcripts, Quill is also not built on PHP.
