Healthcare Facilities Need To Focus On Cyber Security
From small-town dental offices to major hospitals, healthcare facilities of all kinds need to be safe, secure, and protected. Security guards are often needed in emergency departments, quality doors and windows need to be installed to prevent unwanted entry or escape, and employees need to handle every situation with care to avoid malpractice claims. These aspects are crucial for a medical facility's success, however, there is another major factor that needs to remain top of mind: cybersecurity.
Importance of cybersecurity in healthcare
According to a Healthcare Industry Cybersecurity Report by SecurityScorecard, over 75% of the entire healthcare industry has been infected with some kind of malware over the last year. The study examined 700 healthcare organizations including health insurance agencies, healthcare manufacturing companies, and medical treatment facilities. The report revealed that the healthcare sector is lacking basic cybersecurity awareness - putting the entire medical infrastructure at risk.
The healthcare sector relies much more on technology than ever before. Devices that are connected to the internet are crucial for not only employee convenience but patient's wellbeing and safety, as well. From patient data and lab results to radiology equipment /and hospital elevators - everything needs to be functioning properly in order to ensure maximum efficiency across each facility. Sadly, those technologies are often vulnerable to cyberattacks, which can lead to hacked patient data, hijacked drug infusion devices, cryptocurrency scams, and even shut down an entire facility.
Over 75% of the entire healthcare industry has been infected with some kind of malware over the last year
Hospitals try to improve security, but in practice, these measures can get bypassed by clinicians, and then they're not as effective"
"Hospitals try to improve security, but in practice, these measures can get bypassed by clinicians, and then they're not as effective," said Sung Choi, assistant professor at the University of Central Florida's department of health management and informatics. "Security adds inconvenience by design. The next step is figuring out how to improve it without the inconvenience."
Healthcare cybersecurity facts
Here are some interesting facts pertaining to cybersecurity within the healthcare sector:
63% of the 27 largest U.S. hospitals have a C or lower in Patching Cadence, which measures a facility's ability to implement security software patches in a timely fashion.
Over 50% of the healthcare industry has a Network Security score of a C or lower.
96% of all ransomware targeted medical treatment centers.
According to CynergisTek's survey of 60 C-level healthcare executives: 40% of respondents stated that third-party risks are the most concerning cyber threat.
CynergisTek's survey: 33% of respondents reported that medical device security is one of the top five risks facing the healthcare sector.
CynergisTek's survey: 54% of respondents said the biggest barrier to meeting security challenges was due to lack of adequate resources.
In 2017, the healthcare industry saw an average of almost 32,000 cyberattacks per day.
According to the Journal of the American Medical Association: healthcare delivery organizations (HDOs) were the fastest growing targeted group, accounting for over 70% of the 2,149 breaches tracked.
The global healthcare Internet of Things (IoT) market is expected to grow with a 12.5% compound annual growth rate (CAGR) to $136 billion by 2021.
95% of all cybersecurity breaches are caused by human error.
Thankfully, there are plenty of things that healthcare executives can do to fight back against digital threats
"It is safe to say that costs to healthcare organizations will continue to rise as one of the fastest-growing threats, ran ransomware, successfully wreaks havoc in the industry," said authors of a recent IBM X-Force Research report.
Steps to enhance cybersecurity
Thankfully, there are plenty of things that healthcare executives can do to fight back against these digital threats. Here are some of the best security practices for healthcare facilities in 2019:
1. Risk Assessment
First, an organization needs to evaluate any and all risks associated with the entire operation. From digital security to equipment theft, here are some of the most common risks to consider:
Distributed Denial-of-Service (DDOS) attacks (attempting to crash servers).
Viruses, malware, and ransomware threats by unintentional internet use.
Active attempts to infiltrate network security.- Deliberate theft or corruption by employees.
Data loss through software issues or hardware failures.
Accidental unauthorized viewing of confidential data.
A healthcare center needs to have all of its security and privacy policies documented, printed out, and visible
2. Continuous Education and Training
Healthcare employees are critical to a facility's success. Investing in their education and training will surely pay off in the long run. Regular training will help them not only perform better but give them the ability to handle issues competently when something goes wrong.
Investing in healthcare employees education and training will pay off in the long run
3. Document Everything
A healthcare center needs to have all of its security and privacy policies documented, printed out, and visible. Doing this will ensure compliance with legislation and will serve as a reference point for the entire staff throughout the training process.
4. Assign a Security Specialist
No matter how large your medical operation is, it's always a good idea to designate a specific individual (or team) to handle your in-house and digital security. Since tech security is so complex, your specialist will likely need to research the government's compliance information to ensure that every staff member follows the guidelines.
5. Develop a Back-Up Plan
No matter how well prepared you are, something will always go wrong
From the moment people started using computers, backing up data has been a crucial step. No matter how well prepared you are, something will always go wrong. Every practice needs to develop - and document - a detailed back-up plan to avoid serious issues. Not only that, but it's just as important to develop a comprehensive procedure for restoring back-ups after an issue has occurred.
6. Handle the Basics
Many of these might seem obvious, but they are extremely important and often forgotten. Here are some general and everyday practices that should be performed:
Updating and strengthening user passwords.
Using security logs to monitor suspicious network activity and login attempts.
Preventing unauthorized software installations.
Removing unnecessary browser plugins and software.
Restricting access to social media, chat, and dubious websites.
Disabling or removing unnecessary accounts (ex-employees).
Restricting access to physical ports on company machines.
"If executive leadership truly understood the business risks posed by inadequate cybersecurity and realised the major operational, financial, and patient safety implications a security incident can have, they would ensure any and all resources needed were available," added David Finn, Executive Vice President of Strategic Innovation at CynergisTek. "We need to make sure we are effectively communicating these issues to executive leadership, so they make cybersecurity a business priority."
