When it comes to the healthcare industry and cybersecurity, the adage that an ounce of prevention is worth a pound of cure certainly applies.
With aggressive and sophisticated attacks increasing from all directions, nearly all businesses and organizations are targets. Still, the bullseye focuses on healthcare organizations, including hospitals, doctors, and other healthcare providers.
The following are some disturbing numbers on healthcare cybersecurity attacks:
- The average cost of a data breach in healthcare is $7.13 million, according to the 2021 Cost of a Data Breach Report by IBM Security.
- The Anthem data breach in 2021, the most significant healthcare data breach in the United States, exposed 78.8 million private records.
- Hospitals account for 30 percent of all significant data breaches.
- More than 2,100 healthcare data breaches have been chronicled in the United States since 2009.
- Approximately 93 percent of healthcare organizations have been victimized by a data breach in the past three years, and 57 percent have had more than five data breaches during the same timeframe.
- Over the past decade, nearly 4500 data breaches have exposed 500 or more medical records.
- In February 2022, 46 healthcare data breaches were reported, which affected more than 2.5 million people.
- Health and Human Services reported 30 healthcare breaches in March 2022, which affected 1.4 million people.
For other numbers, click on this Becker’s Hospital Review article on healthcare data breaches by the numbers.
Prime Targets for Attacks
Because healthcare organizations have so much valuable personal and financial data in their systems, combined with the industry’s switch to digitization, cyber thieves have turned their focus on them. What’s more, the rising sophistication of hackers is often ahead of the adoption of new safeguards by the healthcare industry. Like businesses, many hospitals have been distracted by continual supply chain disruptions, staffing shortages, and other related issues caused by COVID-19. As a result, some hospitals need to update practices, leading to a gap in cybersecurity.
In response to the rising number of cybersecurity incidents affecting the industry, the Department of Health and Human Services (HHS) advised healthcare organizations to re-evaluate the use of legacy devices and IT systems last year.
Other crucial challenges healthcare organizations face in combatting cyber-attacks include limited resources, small budgets, the need to balance security with accessibility and usability, and the complexity of the healthcare system with several different entities and procedures involved.
But not all is lost. By staying informed as new threats develop, healthcare organizations can protect themselves and their patients from attacks. Here are some preventative measures:
Start at the C-Suite
It all begins at the top. Healthcare leaders play a crucial role in locking down cybersecurity for their organizations. By prioritizing cybersecurity and collaborating with their teams to deploy best practices, leaders can guard patient data, secure operations, and mitigate financial, legal, and regulatory risks. If cybersecurity is not top of mind, it will not be a big priority for the entire organization. Everyone loses.
Train Your Staff
While it is good to have comprehensive technical controls to make it difficult for unauthorized individuals to get into your system, your security is only as strong as your weakest link, meaning the end user. Phishing, spoofing, and other social engineering tactics go around your system controls to exploit employees’ lack of security awareness. Cybersecurity training programs can assist workers in recognizing and avoiding common attacks like phishing. A comprehensive program should feature training on password best practices, secure communication, and data encryption. These procedures are imperative in protecting sensitive patient data.
Topple Silos
For healthcare organizations, there are often silos that can be a petri dish for trouble and risk. To break down these silos, teams within a hospital or system should work closely and collaborate on better spotting areas vulnerable to attacks. In the end, addressing cyberattacks has as much to do with your staff and processes as with the tools and technologies on hand.
Sequester devices
In a recent Black Book Market research survey, 96 percent of IT professionals in healthcare organizations believe that medical devices are vulnerable to attacks. Last year, hundreds of thousands of medical devices were exposed to Access:7 vulnerabilities.
To prevent the spread of malware and ransomware between systems, it is vital to isolate medical devices from the leading network through digital firewalls. It is one of the most crucial controls in any clinical environment. Administrative devices include iPads and laptops. This helps stop security breaches and protects patient data.
Demand Multi-Factor Authentication
In 2022, the Biden Administration issued a statement advising the country’s critical infrastructure, including healthcare organizations, to demand that system users give more than one verification factor to gain access. Multi-factor authentication (MFA) requires two or more methods of verifying a user’s identity. For example, a password and fingerprint or PIN and smart card. MFA should be implemented by everyone with access to patient information, such as IT staff, administrators, and clinicians. In addition, continuous authentication procedures, such as behavioral biometrics, should be considered to detect and prevent real-time unauthorized access and takeovers.
Order Encryption
The importance of encryption is paramount in the healthcare sector. Because digital technology is increasing, healthcare organizations must ensure patient data is impenetrable to attacks. Electronic health records house extensive personal data, which bad actors can use for insurance fraud, identity theft, and other nefarious activities.
Encrypted information from a readable format is turned into an encoded form, meaning encrypted data can only be read after decryption. From stored data to data being accessed by an application, encryption can be utilized on a wide range of information.
To establish a top level of security, healthcare organizations should craft a comprehensive encryption plan, incorporating strong algorithms, secure key management practices, and personnel training on overseeing and safeguarding encrypted information.
Be Ready for Recovery
To minimize the impact of data loss, healthcare organizations need to establish strong data recovery plans. Data recovery is retrieving damaged or lost information from a backup to its original state. This allows businesses and organizations to continue operations with minimal disruption, which is particularly important in healthcare. Data loss can be very damaging when you consider the information that can be exposed: personal information, medical records, and intellectual property. One step to crafting a strong data recovery plan is identifying key data, backup procedures, testing data recovery, and defining recovery time goals.
Get a Regular Checkup
At least annually, hospitals and other healthcare organizations should conduct a technology risk assessment, which entails accessing your IT system, processes, and applications to spot potential threats and vulnerabilities. Any checkup should also include risk mitigation strategies. To augment this assessment, healthcare organizations should consider initiating other cybersecurity best practices, including staff education and training, frequent security audits, and incident response plans.
Call Dr. VirnetX
Safeguarding the sensitive data of healthcare providers requires knowledge, education, detailed planning, and technical skill. We hope these insights help your organization stave off data theft and loss threats.
Of course, a healthy dose of new cybersecurity technology tools never hurts, especially in the vital healthcare arena. At VirnetX, we have the perfect prescriptions for your healthcare cybersecurity objectives: Matrix and War Room.
Matrix enforces access policy controls and enables real-time network management to protect cloud or on-premises applications from threats. The platform safeguards applications and modern remote workforces from sophisticated hackers and mitigates threats by enabling corporate applications to be invisible to unauthorized users.
War Room is an encrypted construct only visible to authorized users and combats threats and hackers from invading video meetings. Built with a Zero Trust philosophy and backed by VirnetXOne – VirnetX’s proprietary Gabriel technology.
After all, an ounce of cybersecurity protection is worth a pound of cure. For more information, please visit https://virnetx.com/.
About VirnetX
VirnetX Holding Corporation is an Internet security software and technology company with patented technology for secure communications, including 4G LTE and 5G security. VirnetX’s software and technology solutions, including its secure domain name registry and Gabriel Connection Technology™, are designed to facilitate secure communications and to create a secure environment for real-time communication applications such as instant messaging, VoIP, smartphones, e-readers, and video conferencing. The Company’s patent portfolio includes over 200 U.S. and foreign-granted patents, validations, and pending applications. For more information, please visit www.virnetx.com.
