This past year the very real danger that cybersecurity threats pose to healthcare delivery organizations made big headlines—there was the cyber attack on the 10-hospital MedStar Health system and the ransomware attack on Los Angeles-based Hollywood Presbyterian Medical Center. In the case of Hollywood Presbyterian, the attack shut down the organization’s information systems for about two weeks before hospital officials admitted that they agreed to pay a $17,000 ransom.
Most cybersecurity experts predict that data security threats against the healthcare industry will only continue to evolve in 2017 as widespread malicious and criminal hacking poses an increased risk to protected health information (PHI) and healthcare organizations’ information systems. Beyond the financial impact, cyber attacks that shut down information systems, such as electronic health records (EHRs), can disrupt clinical operations and pose significant patient safety risks.
And while these headlines about ransomware attacks against hospitals have been a disturbing wake-up call for the industry, many hospitals and health systems are still not doing enough to strategically address data security, according to many cybersecurity experts. “There are organizations adopting a more proactive approach to data security, but for the most part, we’re still a very reactive industry,” says Mac McMillan, CEO of the Austin, Tex.-based CynergisTek consulting firm.
“Ransomware will continue to be a threat, as long as it’s effective,” he says. “I think I would broaden it beyond ransomware, and I would say, any attack that presents an opportunity for the attacker to disrupt services and data and extort the victim. So, it could be ransomware or a zero day attack. At the end of the day, as long as the attacker can use it to extort money, they are going to continue to use it.”
According to cybersecurity experts, there is some good news. Healthcare delivery organizations are increasing their investments in technologies and solutions to help improve malware detection on their networks and to quickly mitigate when a problem arises to limit the damage.
Gregg Mohrmann, a director with The Chartis Group, a Chicago-based consulting firm, who focuses on the strategic and operational use of IT, says he sees three major data security risks facing healthcare organizations that are getting their boards’ attention due to the financial and patient safety risks. “There are data breaches and the notifications to HHS (U.S. Department of Health and Human Services). The HHS Office for Civil Rights’ wall of shame reported 328 reportable incidents in 2016, a 21 percent uptick from the previous year. And, the cost to remediate a breach is $350 per record and there’s often fines, which are expensive. There’s medical identity theft and there were about 3,100 incidents serviced by Experian in 2014 and 81 percent had some sort of employee negligence. And, then, of course, ransomware.”
John Petersen, an Albany, N.Y.-based consultant with The Chartis Group and senior manager leading the consultancy’s cybersecurity capabilities in the informatics and technology practice, says the total cost impact of ransomware to healthcare organizations is significantly less than other issues, such as data breaches and medical identity theft. “Some of these ransoms have actually been very low, and not a motivating factor for healthcare organizations to do anything about it other than pay the ransom,” he notes.
Chief information security officers (CISOs) and CIOs face significant challenges in their work to strengthen data security, and one major challenge is that, despite the very real threat of internal and external data breaches, investments in data security can be a tough sell.
“Security, like any other non-revenue producing function, has the pressure of being a cost center, for the business,” McMillan says. “In other words, the people who are trying to make decisions on how best to spend dollars that they have are looking at options that can generate more revenue and more business. These organizations are running against very tight budgets, they are running up against very low reimbursement and they are running against a lot of the financial pressures that healthcare has today. And, they are asking for dollars that don’t contribute to production of revenue,” McMillan says.
Making a Strong Business Case for Cybersecurity
Many CISOs report that board-level discussions about data security threats and security strategies have increased and become more involved in the past few years, likely due to the high profile ransomware attacks.
“The questions are getting deeper,” Ron Mehring, CISO at Dallas-based Texas Health Resources, says, regarding executive-level discussions. “The board is asking more follow-up questions and so are the executive leaders. Where five years ago we might have been talking about passwords, and simple, access management concepts, now we’re talking about deep technical attacks and how things are getting broken into with big healthcare delivery networks. They want to understand risk profiles and where do we really stand. Questions such as, ‘what is our real risk posture in that area? Are we vulnerable to a phishing attack, or are we not? What are the three to five things we need to do better?’”
Get the latest information on Health IT and attend other valuable sessions at this two-day Summit providing healthcare leaders with educational content, insightful debate and dialogue on the future of healthcare and technology.