This guest post was contributed by Saket Modi, Co-Founder, and CEO at Safe Security.
This year was full of critical cybersecurity challenges for the healthcare industry. In just the first six months of 2021, there were 238 reported healthcare data breaches, making it the most targeted industry in America. Not only are cyber and ransomware attacks extremely costly to the healthcare industry, but they put highly sensitive patient medical records and critical healthcare operations data at risk.
Recently, eight Texas cancer clinics were the victims of a cyberattack, forcing the facilities to immediately shut down their IT network and notify nearly 37 thousand patients that their medical records were in danger. Unfortunately, instances like these have become an everyday reality. While it is evident that the healthcare industry needs to improve its cyber risk management practices, that is only possible if it shifts from a traditionally reactive cybersecurity approach to a predictive one. To do this, healthcare organizations must have a comprehensive view of their cybersecurity risks relating to people, processes, and technologies for first and third-party, to help predict the most significant threats and improve their security postures.
Cyber Awareness and Mitigation Training
Providing cyber awareness and mitigation training for medical and paramedical staff and even medical vendors and manufacturers is the first step in ensuring all individuals understand the importance of securing protected health information (PHI) and other sensitive data. Yet, a study found that while 91 percent of hospital administrators consider cybersecurity a top priority, only 62 percent feel adequately trained to combat cyber risks.
An industry-wide education standard is necessary to increase understanding of the different types of cyber risks in a healthcare environment. This can be done through active training methods and real-time measurable feedback to the learners enabling them to self-monitor their cyber awareness. The scale of measuring cyber awareness - the breach likelihood - represents the possibility of an organization being hacked because of an individual. It also represents the financial impact of a data breach, making employees aware of the tangible consequences of their cyber negligence. The breach-likelihood score per employee can be extrapolated to the collective score of a department and the enterprise. This enables an organization to customize cyber awareness sessions, track peoples’ responses, and better understand enterprise-wide security awareness. Additionally, IT staff and hospital personnel should be trained in the highest level of disaster recovery and crisis management to be prepared when real threats occur. Implementing these strategies can establish a positive organizational culture of security within a hospital.
Data Security and Privacy Processes
Modern healthcare requires confidentiality, and as hospitals continue the move to paperless file storage, electronic medical records are also more susceptible to cyber-attacks. While electronic medical records have benefits, they also contain an immense amount of sensitive patient data that make them a prime target for attackers. Investment in cybersecurity incident response processes for identifying and responding to vulnerabilities on time is critical while supporting safe clinical care. Using a Cyber Risk Quantification platform can collate external threat intelligence and identified vulnerabilities to help security teams understand their organization’s volume and types of risks and where the weakest links are. In addition, by identifying their breach-likelihood in real-time, healthcare security leaders and administrators can focus on the areas that pose the greatest security and patient risks.
Securing Electronic Medical Devices
Another area of growing concern is the proliferation of medical devices connected to the internet, hospital networks, and other tools to assist providers in treating patients. System vulnerabilities and outdated medical device software are two of the largest sources of healthcare cyber risk. More than 75 percent of medical devices are running on outdated operating systems, and by 2028, HIMSS expects over 50B medical devices to secure. The FDA mandates continued hardware and software support, even to legacy devices. Healthcare centers must ensure their operating software is updated and follow the latest reporting protocols and guidelines to prevent data breaches that leverage loopholes in medical device software.
While these are solid cybersecurity patches, they are still siloed and fragmented. A concrete step in the right direction for cybersecurity in this sector is to have a unified dashboard that collects cybersecurity feeds across people, processes, technology, and third-party, analyzes them in real-time, and generates a single score that matters - instead of multiple alerts that are often missed or ignored. With breach-likelihood, healthcare can adopt a proactive, prioritized, and actionable cybersecurity strategy and better ensure patient safety.
###