Healthcare organizations face a growing list of cybersecurity challenges, including compromises to system integrity, threats to patient data privacy, and distributed denial of service (DDoS) attacks that disrupt a provider’s ability to deliver patient care.
Becker’s Hospital Review has compiled examples of 10 successful or attempted ransomware attacks on healthcare organizations in 2022 thus far, but the number doesn’t begin to tell the story. An HHS newsletter reported a 69% increase in cyberattacks targeting the healthcare sector in the first half of 2022 compared to 2021. Additionally, HHS says that 74% of the reported data breaches affecting 500 or more patients involved hacking and information technology (IT) incidents.
Hacking is now considered the greatest threat to the privacy and security of protected health information (PHI) in healthcare.
Cybersecurity and healthcare
Although the financial sector has battled hackers for decades, many health systems are new to cybercrime and aren’t as adept at deterring attacks. Cyber-attacks have escalated rapidly over the last few years, with some analysts believing cybercriminals no longer follow the unwritten “code of honor” that has protected hospitals in the past.
Cyber-attacks on hospitals are becoming more common for one primary reason: The bad actors are finding success. These cybercriminals seek to exploit the vulnerabilities inherent in healthcare’s complex network of clinical, financial, and administrative systems. The sheer volume of data and the continuous shift of operations to the cloud, married with the fact that many health systems haven’t fully invested in cloud security, help make this sector a prime target.
Furthermore, healthcare is a very lucrative target. Personal health information is estimated to be 10 to 40 times more valuable than financial information on the illegal market.
The cost of cyber-attacks on healthcare
According to a 2021 IBM report, healthcare breaches are the costliest of any industry at an average of $9. 23 million per incident, up $2 million over the previous year. The report estimates the average ransomware attack on healthcare cost $4.6 million.
Due to its mission, healthcare has unique cybersecurity challenges that go beyond financial loss and breach of privacy. The loss of patient data can threaten patient safety and put lives at risk.
In a recent Healthcare Information and Management Systems Society survey, 61% of respondents said cyberattacks had disrupted non-emergency clinical care, and 28% reported those attacks disrupted emergency services. In another study, about a quarter of healthcare IT professionals reported that ransomware attacks had led to increased mortality rates at their hospitals.
Who’s at risk?
Healthcare organizations both large and small are targets for attacks. The vulnerabilities of smaller hospitals result from smaller staff and resources to defend against cyberattacks, whereas larger hospitals and health systems present more entry points for attackers to find vulnerabilities.
In an annual survey of 641 healthcare IT professionals, nearly 90 percent reported their facilities had experienced a cyber incident in the previous year—proving no one is immune. More than half of the facilities stated they’d experienced a ransomware attack over the previous two years.
Healthcare organizations have complex supply chains made up of an extensive web of internal and external systems, components, and processes that work together to ensure the highest level of efficiency and quality. The resulting complexities require healthcare leaders to protect their institutions from not only the inside but also from vulnerabilities at their outside vendor partners.
How to combat cybersecurity risk
One way to effectively address cybersecurity risk is to partner with a vendor that has robust cybersecurity programs in place and can prove it. One good sign is Health Information Trust Alliance (HITRUST) certification, the most rigorous certification program available to healthcare organizations. The program contains various automated and manual quality assurance checks.
Aspirion’s HITRUST Risk-based, 2-year Certification attests to the high quality of our information risk management and compliance program. It’s proof that we are committed to safeguarding our healthcare partners’ data against potential cyberattacks. As the most streamlined and all-encompassing framework in the healthcare industry, HITRUST is a win-win for us and our partners:
- Risk Reduction: Our holistic understanding of data integrity enables us to address any risks and vulnerabilities to reduce the potential for future issues.
- Industry-leading: HITRUST-CSF is the leading standard for data security in the healthcare sector. Our certification proves our best-practice utilization and ability to effectively tackle requirements across various regulatory standards.
- Competitive advantage: Our ability to ensure the security of healthcare partner patient data sets us above our competitors.
For internal security system enhancements, health systems must develop strong defenses and build detailed recovery plans. They should reach out to federal authorities for guidance and best practices. They also need to sell the importance of cybersecurity to everyone in the organization.
Additionally, commit to greater collaboration, including with other hospitals and businesses in the area and with partners such as Aspirion. By collaborating more, you build greater protection against today’s modern cyber threats.
Are you looking for a vendor partner with robust cybersecurity programs in place and who can prove it? Look no further and reach out to Aspirion today here.
