Why a file-transfer server belongs on the list of systems that hold PHI

The week

On February 13, 2023, Community Health Systems, one of the largest US hospital operators, disclosed a breach in an SEC filing. Patient information had been exposed through Fortra, maker of the GoAnywhere managed file transfer product. Fortra had warned customers in early February about a zero-day remote code execution flaw in the GoAnywhere administrative console, later tracked as CVE-2023-0669, and released a patch on February 7. The Clop extortion group claimed it had used the flaw to steal data from about 130 organizations, without deploying ransomware. CHS said the incident occurred at Fortra rather than in its own systems and that the affected data included personal and health information. Other healthcare and financial organizations disclosed related exposures in the following weeks.

Managed file transfer rarely appears in architecture reviews. It is treated as plumbing: the way files move between a hospital and its payers, labs, clearinghouses, pharmacy benefit managers, billing services and state registries. The GoAnywhere incident showed that this plumbing often holds a health system’s most sensitive data in bulk, and for longer than anyone intended. A file-transfer platform deserves system-of-record treatment for three reasons, which are the subject of this piece: where it sits in the network, what data rests on it and for how long, and who is accountable when someone else runs it.

Where file transfer sits

File transfer servers exist to accept connections from outside, so they are internet-facing by design. The flaw Clop used was in the administrative console, not in the file exchange service, and many affected installations had that console reachable from the internet. Fortra’s mitigation advice centered on restricting that access.

A sound design separates two planes. The partner plane, where outside parties exchange files, can be exposed, with strong authentication, allow-listed partner addresses where practical and a narrow set of protocols. The administrative plane controls users, keys, workflows and stored files. It should be reachable only from an internal management network through privileged access controls. For vendor-hosted services, the customer should ask how the administrative plane is exposed and get the answer in writing.

Placement also means putting the platform into the processes that govern other critical systems. That means vulnerability scanning, privileged access management, log forwarding to the security operations center, and a named owner. Integration teams often install file-transfer tools to get a partner connection working by a deadline, and the security review arrives later, if at all. Adding the platform to the critical-asset register is a small administrative step with large consequences for how it is patched and watched.

What data rests on it, and for how long

File transfer is meant to be transient. A file arrives, the receiving system collects it, and the copy is deleted. In practice files pile up. Retention settings stay at defaults. Failed transfers leave copies behind. Archive folders are kept “for troubleshooting.” A server meant to hold a day of files ends up holding months or years of eligibility files, claims extracts, lab results and remittance data.

That accumulation is what made extortion-only attacks profitable. The attackers did not need to reach the EHR or the data warehouse. They took what was sitting on the transfer server, and the size of each victim’s breach was set largely by its retention settings.

The fix is to manage the platform as a data tier with an explicit retention standard. Delete files on confirmed pickup. Move anything that must be kept to a governed archive with its own access controls. Report monthly on the volume and age of files actually stored, by partner flow. Encryption at rest helps, but if the transfer server holds the keys, an attacker who controls the server can usually read the files. A useful metric is the oldest file on the platform; if it is more than a few days old, someone should be able to explain why.

Clinical and revenue-cycle teams belong in that conversation. They know which partners will resend a file on request, which makes long retention unnecessary. They also know which flows genuinely need an archive for audit or payment disputes, and those archives can then be governed properly.

Retention also affects breach response. A platform that holds only a few days of data produces a short, well-bounded notification list. One holding years of files produces months of forensic and legal work to establish whose information was exposed.

Who is accountable when someone else runs it

The third issue is accountability across a chain of vendors. A hospital may run its own transfer server, use a vendor-hosted service, or exchange files with a business associate that runs a product of its own. HIPAA requires business associate agreements with vendors that create, receive, maintain or transmit PHI on a covered entity’s behalf. Business associates need equivalent agreements with their subcontractors. Those agreements require safeguards and breach notification. They do not tell the hospital which products its vendors run, where, or how they are configured.

CHS’s own disclosure illustrated the point: the breach happened at Fortra, yet the hospital operator carried the disclosure and the patient relationship. Health systems that maintained a data-flow map could act quickly. Such a map records each partner, the files exchanged, the channel, the product and the operator. Those relying on contract inventories alone spent weeks reconstructing it under pressure.

Contracts can close part of the gap. Health systems can require business associates to disclose the file-transfer products they use for the hospital’s data and to keep administrative interfaces off the internet. Notice of a vendor-side incident should be required within days, not the outer limit HIPAA allows. Retention limits on transferred files belong in the agreement too. Each clause adds negotiation time, so they belong in the standard template, where they need not be argued deal by deal.

With hindsight

GoAnywhere proved to be a rehearsal. At the end of May 2023 the same group exploited a zero-day flaw in Progress Software’s MOVEit Transfer, and the resulting breaches reached thousands of organizations, including many providers, insurers and business associates. In December 2024 Clop claimed another campaign against Cleo’s file-transfer products. In each case the attackers took data without encrypting anything, and the scale of harm tracked how much data sat on the servers. Shortening retention and moving consoles off the internet are within a health system’s own control. Data-flow mapping has proved slower, because it depends on partners’ cooperation. HHS’s voluntary healthcare cybersecurity performance goals, published in January 2024, gave third-party risk a place in the baseline. The Change Healthcare attack that February made the dependency point at far larger scale.