Healthcare organizations face increasing threats from cyberattacks. Medical records contain highly sensitive personal information that is valuable to cyber criminals. A data breach can put patients’ privacy at risk and damage an organization’s reputation. Healthcare cybersecurity risks need to be managed properly to protect patient data.
What types of cyber threats target healthcare organizations?
Healthcare organizations face a wide range of cyber threats including:
- Phishing attacks – Fraudulent emails trick users into revealing passwords or downloading malware
- Ransomware – Malicious software that encrypts data until a ransom is paid
- Insider threats – Data breaches caused deliberately or accidentally by employees
- Hacking – External attacks that exploit security vulnerabilities to gain unauthorized access
- Malware – Malicious software designed to steal data or damage systems
- Identity theft – Stealing personal information to unlawfully access accounts
Attackers use a variety of methods to exploit vulnerabilities in healthcare systems and gain access to sensitive data. Phishing is one of the most common attack vectors.
Why are medical records a top target for cyber criminals?
Medical records contain highly valuable and sensitive personal information including:
- Full names and birthdates
- Social security numbers
- Private health information
- Medical history and conditions
- Health insurance details
- Credit card and bank account numbers
This comprehensive data provides tremendous opportunity for fraud. Stolen medical identities can be used to unlawfully obtain prescription medication or medical treatment. The black market value for complete medical records is high and increasing.
Breached medical data also often lacks the security protections of financial information. Credit card numbers can be changed but personal health data remains static for a lifetime.
What are the consequences of a healthcare data breach?
Healthcare cyber breaches can have severe consequences including:
- Identity theft – Criminals use stolen personal data to open fraudulent accounts and commit medical identity theft
- Medical identity theft – Unlawfully obtaining medical services using someone else’s information
- Prescription fraud – Obtaining unauthorized prescriptions with a stolen medical identity
- Financial loss – Costs of recovering from identity theft and prescription fraud
- Damaged reputation – Loss of patient trust and damage to the organization’s public image
- Legal liability – Lawsuits, regulatory fines and statutory penalties
Cyberattacks directly impact patient wellbeing through medical identity theft. The effects can plague victims for years. Healthcare organizations also suffer financially from legal costs, insurance premium increases and lost business.
How much do healthcare data breaches cost?
According to IBM’s 2021 Cost of a Data Breach report, the average total cost of a healthcare data breach is $9.23 million. This is nearly 3 times the average for data breaches across other industries.
A Verizon Data Breach Investigations Report found that around 1 in 5 healthcare breaches involves internal actors. Insider threats and human error add significant financial risk.
Direct breach costs
Direct costs incurred from a healthcare data breach include:
- Investigation and forensics – Detecting and investigating the breach
- Notification and remediation – Notifying patients, providing credit monitoring services
- Fines and penalties – Regulatory compliance penalties
- Lawsuits – Legal defense and settlement costs
Indirect breach costs
Indirect long-term costs of a healthcare cyber breach include:
- Insurance premium increases – Higher cyber liability insurance premiums
- New compliance controls – Upgrading systems and processes to prevent future breaches
- Lost business – Turnover of patients and damage to reputation
- Increased operational costs – Ongoing improvements to IT security
Preventing attacks is far more cost effective than dealing with the consequences of a breach. Healthcare organizations need to evaluate their cybersecurity posture and make appropriate investments in risk management.
What are the main healthcare cybersecurity challenges?
Healthcare organizations face unique cybersecurity challenges including:
- Legacy systems – Older unsupported systems that are vulnerable to attack
- BYOD – Managing security risks from employees’ personal devices accessing data
- Third party access – Securing systems accessed by contractors, vendors and cloud providers
- Lack of staff training – Human error and phishing susceptibility
- Regulatory compliance – HIPAA, HITECH and state privacy laws
- Value of medical data – High black market value makes healthcare a prime target
Outdated systems and lack of cybersecurity awareness among staff create risks. Connecting with third parties also expands the attack surface. Managing compliance and threats requires comprehensive risk management.
How can healthcare organizations improve their cybersecurity?
Healthcare organizations should take a multifaceted approach to improving cybersecurity through strategies like:
- Conducting risk assessments to identify vulnerabilities
- Establishing a robust cybersecurity framework and policies
- Investing in modern security tools and infrastructure
- Providing comprehensive staff training on risks and protocols
- Performing due diligence on vendors and business associates
- Developing an incident response plan for rapid breach containment
A proactive cybersecurity program requires involvement from executive leadership down to individual staff members. Technical controls and human awareness work hand in hand.
Top healthcare cybersecurity best practices
Specific cybersecurity best practices for healthcare organizations include:
- Enabling multi-factor authentication across all systems
- Encrypting endpoints, records and data in transit
- Developing and testing backup and disaster recovery processes
- Establishing network segmentation through VLANs
- Securing and patching outdated operating systems
- Monitoring systems and data access for abnormal activity
- Providing cybersecurity awareness education to all personnel
Modern security tools and frameworks like CIS Controls provide healthcare IT teams with blueprints for effective defense. Ongoing audits and assessments ensure systems remain secure over time.
How can medical devices be secured?
Networked medical devices introduce unique healthcare cybersecurity risks. Strategies for securing medical devices include:
- Asset management programs to maintain real-time inventory of all devices
- Network segmentation to isolate devices from the rest of the network
- Device hardening to disable unnecessary functions and ports
- Password protection and access controls for device settings
- Encryption to protect data generated and transmitted by devices
- Regular patching and updates for software-based devices
Performing risk assessments during the procurement process ensures new medical devices meet security requirements before deployment. Legacy and internet-connected devices also need to be secured and monitored.
Should healthcare organizations invest in cyber insurance?
Cyber insurance provides financial protection against some costs incurred from a data breach. Policies may cover:
- Forensic investigation into the breach
- Legal liabilities and lawsuit defense
- Notifications and credit monitoring for affected patients
- Public relations services
- Business losses from interruption
However cyber insurance does not cover all indirect costs following a breach. Policy limitations and exclusions should be reviewed closely. Effective in-house controls are still required to reduce the need for insurance claims.
Organizations with inadequate data protections often face steep insurance premiums. Cyber insurers may require certain security standards be met before extending coverage.
While beneficial, cyber insurance should not replace comprehensive cybersecurity measures. Healthcare organizations need to focus on preventing attacks and mitigating risks.
Conclusion
Healthcare cybersecurity requires an organization-wide effort to protect patient data. Medical records contain highly sensitive information that has tremendous value to cyber criminals. Successful attacks can incur substantial financial losses and reputational damage.
Legacy medical devices, staff training gaps and reliance on third-party vendors create security risks that need to be managed. Healthcare organizations should conduct thorough risk assessments and invest in robust cybersecurity tools, policies and processes.
Comprehensive technical controls combined with regular cybersecurity awareness training for all personnel enable effective defense against modern threats. Healthcare data security should be a top strategic priority for providers, payers and related organizations.
