Interested in learning more about cybersecurity concerns facing healthcare organizations? Read more about the top three issues that healthcare organizations face daily.
Technology offers the healthcare industry massive benefits but also poses many risks.
These risks can lead to data breaches that damage the reputation of your company while also forcing you to pay significant fines. Cybercriminals continually devise new schemes to gain access to patient information, and these threats only continue to grow more complex.
However, an outsourced security service provider like Cybriant can play a crucial role in keeping all of your patient information well-protected while ensuring that your IT infrastructure is operating efficiently without any potential security concerns.
Here are the top three cybersecurity issues that healthcare organizations face each day.
#1 Maintaining HIPAA Compliance
Following all of the HIPAA compliance regulations is a top priority for any healthcare organization. Addressing any potential vulnerabilities and continually assessing your system is essential in keeping Patient Health Information (PHI) secure. An IT service provider gives your company the best protection against cybercriminals while continually looking for ways to improve your IT security. A managed service provider can also create a detailed plan HIPAA compliance checklist to ensure that you avoid cybersecurity incidents that can result in costly violations.
A managed IT service provider can play a crucial role in keeping your healthcare company safe from ransomware and phishing scams. These cybersecurity threats can result in significant data breaches while also costing your organization thousands of dollars. Employee security awareness training is one of the most powerful ways to counteract these threats, as it educates employees on the best way to handle a wide range of situations. Cloud computing can also play a key role in preventing the success of a ransomware scheme by allowing you to access data backups from an off-site cloud server.
Cybriant offers PREtect that will help lay a secure foundation for all cybersecurity issues. Learn more about PREtect here.
#3 Keeping Medical Devices Secure from Hackers
Medical devices use the latest technology to provide invaluable services to each patient. However, these medical devices are prone to numerous vulnerabilities, especially with the rise of the Internet of Things (IoT). A managed service provider can implement various security controls to ensure that these devices remain secure and out of the hands of hackers.
Encrypting communication with these devices and developing authentication services are all key steps in protecting medical devices from malicious threats. An IT service provider can also routinely monitor these devices to ensure that everything is working correctly without any unusual activity.
Technology plays a key part in the success of healthcare organizations across the entire globe. Understanding these various cybersecurity concerns facing healthcare is essential in keeping all of your patient data confidential and out of the hands of cybercriminals. A managed IT service provider will ensure that you remain in HIPAA compliance, prevent cybersecurity attacks, and keep all of your medical devices safe from cybercriminals. Staying up to date with the latest tech in the industry and keeping all of your information secure is one of the main advantages of using an IT provider in the healthcare industry.
Last week there was quite a bit of discussion in the news concerning the Hollywood hospital hack. So, this week we’re going to take a brief break from our NSA Watch Your Back series to discuss why this attack is more important than most people realize.
As a quick refresher, on February 5th, 2016 Hollywood Presbyterian Medical Center experienced a large breach in security when ransomware hit the medical center’s network. Note: Many news organizations were referring to Hollywood Presbyterian Medical Center as Hollywood Hospital and so we will do so as well for familiarity to the reader. NBC Los Angeles was one of the first news organizations to report the breach.
For those of you who haven’t heard of ransomware, it is one of the new evolutions of viruses that is now being regularly seen on the internet. Typically, what happens is that the ransomware will do one of a couple of things: lock the user out of their computer until they pay a ransom, or the ransomware will encrypt all of the files on the computer (and reachable network drives) and then require the owner to pay a ransom in Bitcoin. In the end the Hollywood hospital hack cost the medical center $17,000 (40 Bitcoins).
Ransomware is a (dis)reputable business from the criminal hacking world. Disreputable in that what they’re doing is just plain wrong. But, reputable in that if you pay the ransom then the attackers will release your computer from being held hostage. It’s just business to them. The attackers want everyone to know that if you pay the ransom then access to your data will be restored. The executives in charge were probably informed of this and so made the decision to simply pay the ransom in the Hollywood hospital hack.
Analysis of Situation
There are security professionals on both sides of the fence on whether the ransom should have been paid in the Hollywood hospital hack (or any other ransom attempt). From a business actuarial perspective I agree with their decision to pay the ransom. Here is why: This is conjecture, but I’m guessing their decision was guided by several basic assumptions:
As a medical center the first and foremost mission is to ensure the safety of the patients and those under their care.
It is both costly and dangerous to transport patients to other medical institutions (in spite of the fact that they had to do this).
If the computer systems are inoperable for more than one day patients in critical care must be transported to other medical institutions.
The medical center is a business, and must be operationally functional in order to be financially successful.
The operational costs of the medical center for one day exceed the ransom by some amount X.
The medical center’s security is inadequate to repel this attack.
Restoring the infrastructure will take longer than one day.
These assumptions enable the business to perform a basic cost/benefit analysis to determine whether they should pay the ransom or restore service via standard IT recovery procedure. To demonstrate why I say that what they did makes financial sense we can do a quick calculation. According to item 17 on Becker’s Hospital Review the cost of a for profit bed is $1,629 per day. Let’s assume that 20% (I don’t actually know the actual number) of their 434 beds were being utilized, so 87 beds. That means their per day cost is: $1,629 * 87 = $141,723. Now, if we add in the cost of an $800 ambulance ride for 10 patients (while it was reported that some patients were moved the number wasn’t specified) that must be moved after one day: 10 * $800 + $141,723 = $149,723.
Note, this calculation doesn’t take into account the cost of administration fees to move the patients, or the negotiations involved in the cost for other medical institutions to accept the patients. Nor do we make any attempt to a calculate necessary network cleanup or brand reputation damage. Finally, it was claimed that care was not disrupted for patients (although I find this claim suspect due to the fact that they had to move patients to other medical institutions). So, we’ll be charitable and say that the Hollywood hospital hack resulted in the reduction of 20% effectiveness to perform their mission, leaving us with the cost of one day at .2 * $149,723 = $29,944.60. By paying the ransom the medical center would save $29,944.60 – $17,000 = $12,944 for the first day alone ($29,944.60 would be added to the cost for each additional day of delay).
Please be aware that the above calculations are simply an exercise (albeit realistic) to determine why it made business sense for them to pay the ransom. All in all, this was a cheap lesson for them; well, it is if the Office of Civil Rights (OCR) doesn’t ask the Department of Justice to investigate their organization for HIPAA violations. And, due to the fact that their Electronic Health Records were at significant risk during the compromise I don’t think that an investigation is out of the question. According to the 2015 Cost of Data Breach Study: the United States by the Ponemon Institute the cost per capita for a healthcare record breach in 2015 was $398. Let’s say that we later discover that 10,000 patient records were breached. The Hollywood hospital hack could cost the organization up to 10,000 * $398 = $3,980,000. You read that right; it could cost them up to $3.9 million dollars. Let me be clear: no one has said that any records have been breached, but if a breach in records is discovered through forensic study then this situation could turn very nasty for the medical center.
But wait, I said that all in all paying the ransom was a cheap lesson. $3.9 million definitely doesn’t sound like a cheap lesson. Here’s why I said it’s cheap: so far as the only costs we know the medical center has suffered have been the following (not limited to): ransom, costs associated with transporting patients, forensic recovery experts from a security firm, cost of lost effectiveness, cost of having to turn patients away during the outage, the cost of remediating the infiltrated infrastructure, and brand reputation damage. Yes, that number is easily going to be north of $80,000 in total, but it’s a heck of a lot better than $3.9 million if the records weren’t breached.
The Important Lessons Learned
Okay, so we now understand why the lesson was cheap, but what was the lesson? What should they have learned during this experience? I would suggest that they and every other healthcare organization should begin by recognizing the fact that they must take security seriously and readily allocate more than an adequate budget to cover their needs. The hospital’s security must be prevalent in every aspect of the organization. The reason is simple: the electronic equipment in a hospital is responsible for keeping patients alive, and yet the standards to protect hospital networks are infantile in comparison to the standards protecting simple credit card data theft.
The security issue becomes terrifying once you realize that many life support systems are built on Microsoft Windows or Linux, and both of those two operating systems are the largest malware targets. An attacker doesn’t have to be intentionally attempting to harm someone like in the show Homeland where the attackers targeted the Vice President’s pacemaker. Instead, malware and viruses simply need to do what they do best: infect entire networks, move laterally, and render the user’s computer unusable.
Except, in this case, the user’s computer could be a blood transfusion device or an IV infusion pump. No one would be the wiser until a nurse or doctor visually inspected and confirmed that the equipment was or wasn’t working exactly as expected. Here’s another possibility: the malware infects the IV infusion pump and the monitoring station and simultaneously locks them. A patient could very possibly die during the time it takes to resolve the malware issue.
There are many more cases where viruses, malware, and ransomware could do catastrophic damage to patients and yet no one would be the wiser. According to the Online Trust Alliance (OTA) over 90% of data breaches could be easily prevented. So, how can you minimize the bull’s eye on your organization? Begin with a Security Assessment; not a HIPAA assessment. HIPAA assessments help you check boxes and pass muster with auditors; Security Assessments take a holistic view of your organization’s security posture. I recommend that a third party performs the Assessment simply because they look at your organization with fresh eyes, and they will definitely see things to which the internal staff is blind.
Next, realize that operationally the traditional IT security paradigm won’t protect you. I won’t go into depth on these as each on their own could be multiple multipage articles. Here are the highlights: Antivirus, perimeter firewalls, and sacrificing chickens DO NOT PROTECT YOUR INFRASTRUCTURE! You need to move to application white-listing, malware hunting, unified firewall orchestration, IDS/IPS, and SIEM to watch everything going on in your network. I would argue these newer approaches are fundamental to IT security, but they are not all-encompassing. There are many solutions that provide these types of functionality, and each solution has its pros and cons. It’s important to weigh those pros and cons carefully, and if your staff doesn’t have direct experience working with those types of technologies find a solution provider who can help you.
The Hollywood hospital hack was just the tip of the iceberg. I hope it serves as a wakeup call to the medical industry that what happened was simply an inconvenience. Furthermore, losing patient medical records isn’t good either, but it’s nothing compared to the fact that at some point in the next year or two patient lives will be held for ransom. Sadly, the hacker on the other side of the world probably will not realize that they are potentially harming or killing innocent people by their actions. They’ll just know that they’ve had another successful day of collecting Bitcoins, and then will proceed to build even more dangerous malware variants. Remember, it’s nothing personal; it’s just business.
Protect your healthcare organization by contacting Cybriant, your competent security solution provider.
