The healthcare industry is hardly alone in facing serious cybersecurity risks, but it is unique in the consequences it faces for failing to prevent attacks from internet-based criminals. One of the most important of these relates to the Health Insurance Portability and Accountability Act (HIPAA), which demands that organizations in this field implement strict security measures to safeguard patient data. In addition, the vital services provided by healthcare organizations make them attractive targets to hackers, who understand that cyber threats can be especially disruptive to this industry.
For professionals in the healthcare field, preventing security breaches to information systems requires a multi-pronged approach. Cyber-attacks can come from a number of sources, from both inside and outside the organization. The key to optimizing your healthcare cybersecurity efforts is knowledge—you must be aware of the threats out there. Keep reading for an overview of the top healthcare cybersecurity issues that you need to be able to grapple with effectively.
Ransomware
Of all the cyber threats faced by modern healthcare organizations, ransomware may be the most dangerous. It is deviously simple. The attacker infects the organization’s operating systems with malware that encrypts electronic health records and other data, rendering it impossible to access. The only way to regain access is to pay the attacker via wire transfer, Bitcoin, or a similarly difficult-to-trace method. Even after regaining access, organizations can never be fully sure hackers didn’t duplicate the data.
Such victimized organizations aren’t left paying trivial amounts of money, either. In 2020, the average ransom paid by U.S. organizations from ransomware attacks was $847,344, but reached figures as astronomical as $10 million. These numbers don’t even take into consideration the subsequent threats of extortion.
Trojan viruses usually trigger ransomware attacks by infecting computers through phishing emails when users click malicious links or attachments. That’s why healthcare organizations must train employees on safe email and internet practices. Many ransomware attacks succeed because an employee failed to delete a suspicious email.
The COVID-19 era has brought a new twist to this threat. Attackers often disguise ransomware emails as health advisories from government agencies or other reputable organizations.
Ransomware cyber threats are particularly troublesome for healthcare organizations due to the potential catastrophe of an operational slowdown after an attack. If hospitals, insurance companies, and other healthcare organizations are unable to access patient information when needed, it can result in lethal consequences. Hackers are well aware of this, which is why, sadly, healthcare providers are often targeted for these kinds of attacks. It further emphasizes the importance of proper backup strategies to ensure that in the event of a ransomware attack, vital information will still be accessible so that, at least, patients immediate healthcare needs won’t be an additional factor.
Ransomware is not a new phenomenon, but it has become increasingly dangerous in recent years with the rise of Ransomware as a Service (RaaS). This makes ransomware tools within easy reach of enterprising criminals who lack technical expertise, and provides an explanation for the rise in ransomware attacks over the last few years.
Data Breaches
The black market for protected health information (PHI) remains quite active. PHI refers to the full range of personally identifiable data associated with a patient, including diagnoses, test results, and prescriptions, as well as contact information and Social Security numbers.
Hackers find this data especially appealing because, unlike stolen credit card numbers, they cannot delete or lock patients’ personal histories. Once hackers have seized this information, they can use it to obtain loans, purchase medication, file an insurance claim, or set up credit lines—all under other people’s identities.
The HIPAA Security Rule mandates that healthcare organizations observe adequate data security practices for storing and transmitting PHI. However, many organizations lack the resources to maintain up-to-date protocols, security measures, and fully staffed IT departments. Rather, healthcare organizations tend to devote the constrained resources they have disproportionately on patient care rather than computer systems even though the potential consequences to those same patients from a cyber-attack are also devastating.
Healthcare organizations must back up data properly and protect it with strong encryption and up-to-date software. They should also use anomaly detection tools to uncover data theft attempts early, before attackers cause damage.
Insider Sabotage
Negligence by a single employee or the entire organization often causes cybersecurity incidents, though some cases involve deliberate actions. Sometimes an employee at a healthcare organization decides to exploit the black-market demand for PHI—such as a disgruntled worker simply vandalizing a company’s computer system out of spite.
This threat is another reason why data encryption is vital. If a company stores sensitive information in plain text, it can be easily stolen by an employee.
Organizations should implement a Zero-Trust Access (ZTA) strategy that limits employee data access based on job duties. If an employee doesn’t need access to a database or system, they should not be able to enter it. These areas should have dedicated passwords or be accessible only to those employees with special account settings. Data logs should be implemented to track who has accessed databases where this information is stored.
Distributed Denial-of-Service (DDoS) Attacks
A DDoS attack overwhelms a website or network with internet traffic to disrupt its functionality. Attackers often use botnets, large networks of hacked computers, to flood targets with excessive data traffic. In some cases, attackers combine DDoS attacks with ransomware attempts. Like ransomware, DDoS attacks severely impact healthcare organizations that cannot afford extended downtime.
Hackers have used this threat for years (the first recorded DDoS attack happened in 1999), and it has grown more sophisticated and powerful over time. In response, many cybersecurity companies now offer DDoS mitigation services to defend against these attacks.
Ciphertex® offers world-class HIPAA-compliant data security solutions that address the operational requirements of the modern healthcare organization. To learn more, feel free to contact us at 818-773-8989.