The healthcare industry’s rapid and widespread adoption of digital technologies is transforming care delivery. However, it also creates a number of new and potentially damaging cyberthreats that threaten to impact organizations’ activities and put patients at risk.
Cybersecurity is now a critical part of the healthcare industry — from safeguarding sensitive patient data to ensuring that all healthcare operations are resilient, protected, and available.
Healthcare delivery organizations — hospitals, acute care facilities, urgent care clinics, and doctors’ offices — rely heavily on digital technology for a wide range of clinical, diagnostic, and business activities.
Digital technology is also essential to ensure efficient and trouble-free operations of healthcare critical infrastructure, such as power, HVAC, and communications systems. Additionally, a wide range of smart, “connected things” such as medical IoT devices — known as the internet of medical things (IoMT) — are tightly integrated into a provider’s digital infrastructure.
This wide range of digital technology comes with a vast array of hardware, software, and cloud services — all of which are potential targets for hackers. Whether those hackers are out for financial gain, to disrupt vital healthcare delivery or some other motive, their cyberattacks represent a dangerous threat to every part of care continuity. This makes cybersecurity mission critical for healthcare leaders.
Healthcare cybersecurity is about ensuring that care delivery organizations have the right strategy, process, technology, and people in place to recognize and assess threats, prevent threats from impacting healthcare operations and quickly and fully recover in the event of an attack.
Additionally, healthcare security elements include a range of external factors, including regulatory compliance, legal responsibilities, and even the healthcare organization’s brand reputation.
One of the most essential functions of healthcare cybersecurity is to protect patient data. Protected health information (PHI) and personally identifiable information (PII) are popular targets of hackers, and any healthcare provider’s cybersecurity strategy must account for these requirements.
These smart, connected things range from medical devices such as infusion pumps and heart monitors to critical infrastructure such as air filtration systems and water purification pumps.
Manufacturers design these devices with a baseline level of cybersecurity, but small memory footprints limit their capabilities. It is essential for healthcare cybersecurity officials to layer additional security technologies onto these devices.
Healthcare operations must continue smoothly and reliably in the event of a cyberattack, whether that attack targets patient data or seeks to interrupt medical operations. A business continuity plan must be an integral part of any healthcare organization’s cybersecurity strategy, including such aspects as hardware failover, data recovery, and restore and back up to off-site systems or cloud platforms.
The Health Insurance Portability and Accounting Act (HIPAA) Security Rule was enacted in 2005, 9 years after the U.S. Congress passed HIPAA. According to the U.S. Department of Health and Human Services, the Security Rule establishes national standards to protect individuals' electronic personal health information created, received, used, or maintained by a covered entity. The Security Rule is a subset of the HIPAA Privacy Rule, which provides standards for PHI.
The HHS defines a data breach as an impermissible use or disclosure under the Privacy Rule that compromises the security or privacy of PHI. Data breaches can occur as a result of a broad — and growing — range of factors. These include:
Business continuity is the ability for an organization to maintain critical operations in the event of an unanticipated event, such as natural disasters, human error, or a cyberattack. While business continuity is essential for any organization in any industry, the implications of service disruptions that affect day-to-day healthcare operations are both unique and potentially devastating.
In a hospital setting, uninterrupted operations are an absolute necessity, and there must be systems, processes, and rules in place in the event of a disruption. Hospital data security covers an extensive list of issues, including:
Protected health information (PHI) is any information that must be protected and secured to safeguard a patient’s healthcare privacy. Regulations require that covered entities — people or organizations that provide healthcare — protect information related to a patient’s past, present, or future physical or mental health. Any patient’s health plan must take into account the assurance of reliable, consistent protection of PHI.
As defined under HIPAA and its Privacy Rule, PHI is “individually identifiable information transmitted by electronic media, maintained in electronic media, or transmitted in any other form of media.”
The kinds of information covered under PHI provisions have been steadily expanding over the past 20 years. The scale and scope of PHI certainly will continue to increase as technology for capturing, storing, and sharing PHI advances, and as the regulatory compliance environment for patient confidentiality evolves.
Ensuring efficient, effective, and reliable healthcare cybersecurity is a “team sport” that involves everyone in an organization. The threat landscape changes daily, and every staff member needs to understand the latest attack vectors.
As the number of people employed by hospitals and other care delivery organizations expands rapidly, organizations must spend more time training employees on everything from regulatory compliance covering PHI and PII.
This training should not only be part of any new employee onboarding process but should be delivered in a regular, ongoing process to reinforce best practices and update employees on changes and new threats.
All healthcare “covered entities” must follow the requirements set down under HIPAA, which has been updated and expanded multiple times since it was first enacted in 1996. Failure to comply with its processes and regulations may result in fines or other sanctions deemed appropriate by the U.S. Department of Health and Human Services.
Regulatory compliance covering patient information privacy, such as Europe’s General Data Protection Regulation (GDPR) and similar privacy laws passed in the U.S., also govern healthcare organizations.
Digital transformation is hugely important in healthcare as organizations explore ways to improve patient outcomes and increase revenue. At the same time, healthcare digital transformation led to the adoption of a wide range of new devices, applications, and services — each representing a potential point of attack for hackers.
There are a number of essential steps healthcare organizations should undertake — either internally or with the help of trusted third parties — to procure, implement, and optimize their cybersecurity strategies and solutions.
Training should be mandatory, done at regular intervals, and consistently updated to reflect a heightened understanding of new threats, regulatory requirements, and best practices on smart cybersecurity hygiene.
The rapid, ceaseless introduction of new threats into the cybersecurity environment puts the onus on security administrators and SOC engineers to regularly update systems. And while patching is often minimized as a strategic cybersecurity defense measure, it is a highly essential — part of an organization’s risk posture.
While healthcare organizations are spending more on cybersecurity, it is also important to evaluate where to get the most ROI out of cybersecurity investments.
For example, rather than deploying an army of point solutions — each aimed at a single threat — a platform approach combines multiple tools and services into a single, unified cybersecurity platform. This approach closes vulnerability gaps and uses security automation to supercharge incident response.
Healthcare cybersecurity will continue to become more complex, and thus more important than ever. The threat landscape is evolving faster than ever, making it essential to find trusted technology partners and advisors that act as force multipliers to virtually expand their defenses.
Many organizations also grapple with a shortage of cybersecurity talent, making outsourcing some aspects of cybersecurity defense planning, implementation, monitoring, and management necessary.
Additionally, organizations need to ensure that they have set aside the right budgetary resources for tools, systems, and services to strengthen their systems' perimeters and internal systems against rapidly expanding threats.
Learn about how Palo Alto Networks is the cybersecurity leader of choice for hospitals and health systems around the world. Visit www.paloaltonetworks.com/healthcare.
Every organization has different business needs and will require different solutions. For example, large health systems looking to reduce their vendor blueprint can consider security consolidation and partner with just a few vendors. Small hospitals looking to secure specific areas such as IoT can consider best-of-breed security solutions.
What’s more important is finding a cybersecurity provider with a proven track record in the healthcare industry — and the cyber industry in general. One with an extensive number of customer testimonials.
These are the top 5 threats, according to the U.S. Department of Health and Human Services:
