Across every industry, cybersecurity attacks have increased in recent years. The healthcare industry was the most attacked by hackers and cyber criminals in recent years, and only heightens the importance of healthcare cybersecurity moving forward. With both public and government officials asking why increased spending needs to be set aside, we will highlight why increased investment in the healthcare cybersecurity industry is so important.
Cybersecurity as an industry has been around since the first computer worm invented by Robert Morris in the late 80s. The internet was still being developed at the time and wasn’t nearly as large as it is today. Cybersecurity is just one division of information technology that has been expanding rapidly as the healthcare industry looks to add new features and systems to deliver care to patients faster and more efficiently than ever.
This means that the first computer worm spread quickly and nearly shut down much of the internet at the time. In order to combat future attacks, a new wave of passionate individuals set out to find ways to protect the internet and its users and the cybersecurity industry was born.
The healthcare cybersecurity industry is no different to the rest of the cybersecurity industry. As technology increasingly enters our lives in new ways and we replace archaic measures of doing things with digital solutions, a need for healthcare cybersecurity arose to protect healthcare and hospital companies, healthcare professionals, and patients.
The healthcare cybersecurity industry is any advanced digital measure or digital solution that is put in place to prevent hackers or cyber criminals from accessing critical data that would otherwise be protected. Creating new cybersecurity digital measures against hackers and cybercriminals are the most common threats to information security in an organization moving forward in the digital world.
Healthcare cybersecurity digital measures could potentially be any network security, application security, operational security, and information security. Each one of these present challenges in different ways, and each one has to be solved with increasingly more complex measures moving forward.
Now that we understand what healthcare cybersecurity is, we have to determine what effect the threat of the lack of healthcare cybersecurity measures poses on the healthcare industry. IBM released a Cyber Security Intelligence Index in 2016 that showed that the healthcare industry was the most attacked industry when it came to cyber attacks.
When looking at the report published by IBM, the healthcare cybersecurity statistics are certainly cause for concern. The report highlighted that the attacks the healthcare industry experienced contained data breaches, and increased existing vulnerabilities in the hospital and healthcare industry. When comparing other industries to the healthcare industry, the healthcare industry experienced the most attacks. The startling data doesn’t stop there. Not only did healthcare top the list in cyber attacks, but all other industries combined didn’t surpass the number of attacks the healthcare industry faced.
In 2015, roughly 1,596 attacks were targeted for the healthcare industry alone. When all other industries were combined only 1,157 attacks occurred over the same time period.
The report doesn’t stop there when comparing recent attacks to previous years. In 2014, the healthcare industry didn’t even make the Top 6 list of attacked industries, in one year it jumped to number 1.
In addition, five of the eight largest healthcare cybersecurity breaches since 2010 all came in 2015. This means that the breaches are becoming more frequent, more expansive, and cause greater damage to both healthcare professionals and patients than ever before.
In 2015, the 1,596 attacks compromised over 100 million healthcare records from over 8,000 devices in over 100 countries. In addition, it is estimated that these data breaches cost over $6.2 Billion to the healthcare industry.
The $6.2 Billion in damages to the healthcare industry were broken down to estimated cost per record. In the Ponemon 2016 Cost of Data Breach report done in conjunction with IBM, the average cost per stolen record in the healthcare industry was $355 - nearly twice the average cost of a stolen record of $158.
This cost per stolen record is something that increasingly hospitals need to forecast into their annual budgets in case an attack were to happen. Which means that over time as their expected expenses rise, they need to raise prices on patients doing business in their particular hospital and healthcare system.
While these are just one of the many reasons that healthcare premiums are raising, it is a reversible trend with additional investment into future security measures to reduce the rate of potential attacks a hospital or healthcare system could be exposed to.
The next question one has to answer in regards to healthcare cyber security is how is data being stolen? Each year as new potential security measures roll out to safeguard against future attacks, hackers and cyber criminals continue to innovate their malicious attacks.
Several of the different types of attacks that hospitals and healthcare systems are facing are:
Almost everyone in the modern age is familiar with malware. Malware is any form of malicious software that enters a system and can contain viruses or spyware that can affect services or obtain information that individuals or organizations were hoping to hide.
Some of these services that malware uses could include a keylogger which tracks information input into the system, or a virus that can help unlock and gain access to previously restricted files.
One more modern addition to these malware attacks is the recently coined Ransomware. Ransomware is a relatively new form of malware where systems are bogged down or completely held hostage for a fee.
Hackers and cyber criminals then have leverage against healthcare and hospital systems to pay, otherwise the hackers will not release the system or information that was previously stolen.
Brute force attacks are generated codes or software packages that have been designed to force entry through vulnerabilities in a system. Some common brute force attacks are targeted against password protected mechanisms that have outdated protection measures.
Social engineered cyber fraud is becoming more prevalent with each day, as new technology solutions make it easier for hackers to use for malicious intent. One example for social engineered cyber fraud is receiving an email from a human resources representative or executive who has a question about some personal or professional information.
Healthcare professionals read the email “from” line or the name that could be obtained from a staff directory and respond to the email with delicate information that could then be used to create future vulnerabilities.
With recent advancements in email functionality, email providers have been enabling users to create custom “from” fields that will display emails differently in an inbox than the original email destination.
This means that hackers can have an email and display it as an email from the hospital or healthcare system, making it appear as a professional email and creating victims from unsuspecting individuals.
DDoS or Distributed Denial of Service attacks occurs when a server is overloaded with incoming connections. Ultimately the goal of these attacks is to overload a server’s ability to process the incoming packets and shut down the servers.
When a server shuts down, the business has the potential to shut down if it has any digital server footprint. No industry has much of a digital records history as the healthcare industry, so having servers shut down at a critical time can affect potential care that patients might receive at the worst possible time.
Now that we understand how data is being stolen and how cyber security systems are attacked, we must determine why healthcare data is being stolen. According to the FBI’s Cyber Division, health records fetch a premium price on black markets.
Electronic health records on the black market can fetch upwards of $50 per record. In contrast, other common data breaches not linked to the healthcare industry sometimes fetch only $1 per social security number (SSN) or credit card information.
With electronic health records, hackers and cyber criminals can use the data to file false insurance claims and receive payouts, engage in advanced identity theft, and obtain prescription medication that is then later sold.
With so many measures being set in place over the years for traditional credit card and identity theft that safeguard consumers and businesses, electronic health records don’t nearly have the same protection and take nearly twice as long to detect.
This essentially translates to criminals having twice as much time to eliminate their tracks and get away with the cybercrime in comparison to social security number or credit card theft.
Data is also being stolen because of the budgetary restrictions currently in place as hospitals and healthcare systems find new ways to cut costs. Tight budgets limit healthcare cyber security in a couple different ways. First they limit the advancement of cybersecurity measures by limiting the investment amounts healthcare and hospitals are willing to spend.
With healthcare system and hospital executives looking for additional ways to cut cost and raise profits, many choose to limit budgets in cyber security advancements with the mindset that attack probabilities are low and existing measures should safeguard against incoming attacks.
The problem with this mindset, is that attacks are growing at an alarming rate as we’ve mentioned, and each attack is becoming increasingly complex to the point where cybersecurity measures need to continually advance to keep pace.
Tight budgets also restrict the number of cybersecurity professionals a healthcare system or hospital can keep on staff. With each attack becoming more complex, additional healthcare cyber security jobs are created to help combat the evolving attacks.
In an effort to decrease the length of time that it takes to identify and track cybersecurity attacks, tight budgets restrict the number of healthcare cybersecurity professionals on staff - which then only compounds the problem.
Healthcare cybersecurity is so important because it directly impacts patients in the rate at which they receive care, and the quality of care in which they receive. As an example, if a DDoS attack targets a single hospital and it shuts down the servers, the network the hospital runs on can be shut down.
In the event that the hospital network is shut down, any process in the hospital that requires access to the network is no longer operational. This means that from the data entry clerks who input critical financial data required for treatment, medical coders who help declare ailments treated, registered nurses who log when they visit or treat a patient, physicians checking records to determine a treatment path, and executives who need critical data for management decisions.
As one can imagine, in the event that an entire network were to go down, the rate of care comes to a standstill. As healthcare professionals will be cautious to attempt new treatment methods or move forward with existing measures without checking against their medical records available on the network.
When the rate of care comes to a standstill, the quality of care could also suffer as healthcare professionals would not have access to check previous care records to indicate what has or hasn’t been used in the past.
In addition, patients and customers want to be reassured that when they do seek care for their ailments, that their information will be confidential and safeguarded against attacks. Hospitals and healthcare systems need to ensure that they continue to develop and safeguard the trust consumers place in them with their confidential information.
That’s just an example of one attack, and how important a network for a single hospital experiencing a DDoS attack could impact patients and healthcare professionals. Healthcare cyber security is so important for the rate of care and quality of care received for patients in a world where the healthcare industry is looking to improve quality of care measures.
One primary argument against increasing cybersecurity measures is that belief that existing measures should be enough to hold off current attacks. But as our example and above argument highlights, modern and previous methods won’t be enough to combat future attacks that have evolved.
Even though it might seem that the healthcare cybersecurity industry is dire, there are ways to improve healthcare cybersecurity moving forward. One such way is to improve employee training.
One of the top risks for healthcare systems and hospitals is one of their most important assets, their employed workforce. Employees present an easy opportunity for hackers and cyber criminals to target because of their limited knowledge of vulnerabilities and effective measures to counter those vulnerabilities.
Increased education and dedicated training can help improve and limit the risk that employees present in the cybersecurity realm by teaching them about existing vulnerabilities within the system and modern encryption methods.
Another way to improve cybersecurity moving forward is increased investment to innovation within the industry. Healthcare systems and hospitals can dedicate additional resources available in their projected budgets to combat future cyber crimes before they happen by making it a priority in an effort to offset future costs that might be experienced from attacks.
One great way to improve cybersecurity moving forward is to seek ways to improve existing protection infrastructure and software packages. Due to the fact that new software or infrastructure advancements could be costly, hospitals and healthcare systems can save money by investing into solutions that need modern improvements.
While improving these existing systems might be difficult due to aging programming or work around, it always helps to improve on systems that already exist by improving them and adding additional features versus reworking them completely such as adding modern encryption methods.
Healthcare cybersecurity is so important for healthcare and hospital systems moving forward as they directly impact the level of care they can provide and the trust consumers place in the healthcare industry. Improving healthcare cybersecurity moving forward needs to be on every hospital and healthcare system’s agenda.
To sum up everything in this article, we've also compiled a useful infographic that highlights everything important about cybersecurity in the healthcare industry.
Feel free to share this infographic on your site, blog, or with your audience. All we ask is that you give credit to HospitalCareers and link to this blog post!