There’s no shortage of cybersecurity attacks in the news. Because the industry has proven to be a popular target for bad actors, cybersecurity in healthcare has become a hot topic for industry and even political leaders, in the U.S. and globally.
Cybersecurity: a crucial element in healthcare
According to the U.S. Department of Health and Human Services (HHS), there was a 93% increase in large data breaches reported from 2018 to 2022. In that time, there was a 278% increase in large breaches that involved ransomware. In 2023, HHS reported that more than 630 ransomware attacks impacted healthcare worldwide; 460 affected the U.S. healthcare and public health sector.
The Change Healthcare cyberattack occurred in February 2024. The company acts as a clearing house for 15 billion medical claims annually, which represents nearly 40% of claims worldwide. The attack created a backlog of unpaid claims, leaving doctors’ offices and hospitals with serious cashflow problems and threatened patients’ access to care.
Although the government advises against it, according to reports made online, Change Healthcare elected to pay the ransom. Several weeks later, they were the victim of another attack. More than the financial cost, healthcare organizations face disruptions to patient care, legal repercussions, and diminished reputation in their communities.
Many experts agree that with the rise in ransomware attacks and data breaches, it’s not a matter of if your organization will be affected; it’s a matter of when. If you’re not 100% confident in your cybersecurity strategy, it’s time to analyze your threat detection, analysis, and reaction.
Key components of a strong healthcare cybersecurity strategy
Health system leaders must develop an aggressive, proactive strategy to mitigate cybersecurity threats in healthcare. There are five key components of a strong healthcare cybersecurity strategy:
- Risk assessment and management includes conducting regular, thorough risk assessments and managing vulnerabilities with dedicated IT teams.
- Data protection and encryption should follow best practices for data encryption to ensure data integrity and confidentiality.
- Network security at its core should include implementing firewalls and intrusion detection systems, as well as updating and patching systems regularly.
- Access control employs the least privilege principle, along with the use of multi-factor authentication to enhance security
- Employee training and awareness is essential to protecting your data and should include regular training programs, phishing simulations, and cybersecurity drills for employees.
Evaluate your current cybersecurity strategy
Cybercriminals are no longer lone wolf bad actors working in the shadows. They are sophisticated, well-funded, and organized groups, which means your team must be innovative, aware, and alert. To minimize the damage caused by cybersecurity threats in healthcare, hospitals and health systems must adopt a philosophy of continuous evaluation and improvement.
Conduct a cybersecurity audit
Your leadership team should commit to conducting comprehensive security audits to help enhance data protection. The steps for conducting an audit may include:
- Define the scope of the audit by identifying key systems and data, outline the objectives, and create the audit team.
- Identify IT assets, including hardware, software, networks, and data.
- Perform risk assessment to identify threats and assess vulnerabilities.
- Conduct a policy and procedure review to evaluate existing policies, assess compliance, and identify gaps.
- Complete a technical assessment, which includes evaluating network, data, and medical device security.
- Identify vulnerabilities and conduct penetration testing.
- Evaluate incident response plan and procedures.
- Design and implement employee training and awareness.
- Create a detailed report outlining results, vulnerabilities, and risks, and provide recommendations.
- Implement recommendations and continuously monitor the security environment.
Benchmark against industry standards
Benchmarking cybersecurity standards in healthcare is crucial for identifying gaps, prioritizing improvements, and enhancing overall security posture. There are three resources that can help you compare your organization’s cybersecurity initiatives to others in the healthcare industry:
- The National Institute of Standards and Technology (NIST) developed a cybersecurity framework (CSF) to provide a common vocabulary and methodology for managing cybersecurity risk.
- Developed by the Department of Health and Human Services (HHS), Health Industry Cybersecurity Practices (HICP) provides practical cybersecurity guidance for healthcare organizations.
- The Healthcare Cybersecurity Benchmarking Study is collaborative effort by Censinet, KLAS Research, and the American Hospital Association to provide industry-specific benchmarks based on NIST CSF and HICP.
- Founded in 2007, HITRUST developed an assurance program to help organizations prioritize security, manage data and compliance, and mitigate information risk.
Enhance your healthcare cybersecurity strategy
Although attacking U.S. organizations may be more lucrative, no health system in the world is immune from the reach of cybercriminals. There has been incredible focus on improving cybersecurity in healthcare globally, with governments and worldwide organizations throwing their full effort into minimizing risk. This focus has led to partnerships among public and private organizations to utilize innovations in AI, machine learning, and blockchain to take on the challenge.
Invest in advanced healthcare cybersecurity solutions
Many health systems have become early technology adopters to address the rise in cybersecurity threats in healthcare, and the advancements are helping to address the challenges. Investing sooner in these technologies can realize cost savings and develop processes to stay ahead of new threats.
Build a culture of cybersecurity
Culture starts at the top, so it’s vital that management leads by example. With leadership 100% onboard, it’s easier to get buy-in from clinical and non-clinical staff to adopt a security-first mindset.
Incident response planning
Cybersecurity for patient safety is a priority for every healthcare organization. In addition to building a culture around safety, you should prioritize developing and testing an incident response plan, along with maintaining a dedicated response team. Although there are many moving parts, boiled down to its most simplistic basis, your cybersecurity philosophy should focus on developing awareness, improving prevention, and learning from mistakes (yours and others).
