Over the last few years, technological advances have gained a massive entry into the healthcare scene with tech companies revolutionizing health with digitalized healthcare innovations, telemedicine services, wearable health devices, and other AI-driven tech initiatives.
More investments are being channeled into healthcare as healthcare providers and insurers are beginning to see how effective tech makes healthcare delivery and how much it saves employers in administrative costs. Expenditure in healthcare technology is, therefore, growing significantly and in 2017, it rose to $100 billion.
As a result of these tech initiatives, patients share information through telemedicine platforms on their smartphones, and in healthcare facilities, patient data is made easily accessible to their providers via connected medical devices. No doubt, as technology expands, it will create new frontiers in healthcare, however, there is a growing concern for the security of the enormous amount of patient information these tech innovations contain – Big data.
Factors Responsible for Healthcare Cyber Attacks
According to findings by FortiGuard Labs, the number of cyberattacks in healthcare organizations was two times more than the average number in other organizations in the vertical market and these cyber security issues take different dimensions. According to the Identity Theft Resource Center (ITRC), data breaches in the healthcare industry accounted for 22.6 percent of the total reported cases in 2017.
Mergers and Acquisitions (M&A) in health care is one of the most important factors predisposing to cyber attacks. M&A creates vulnerabilities that often promote breaches of health cybersecurity. These M&A activities have been growing stronger in recent years and are expected to gain more strength as healthcare providers expand their services.
Mergers and Acquisitions involve the use of a wide range of medical technologies and digitalized platforms through which vital information about healthcare services, providers, and patients are transferred between the newly merged organizations, and this creates an easy target for cybercriminals.
Furthermore, health data is vulnerable for a number of reasons. First, health data tends to be of more value than financial services and medical identity theft usually takes a longer time to detect than any other type of fraud. Coupled with this is that fact that cybersecurity is still in an early stage of maturation and cybercriminals have developed more sophisticated ways of breaching this security.
In 2017, for instance, FortiGuard Labs reported that healthcare data experienced an average of almost 32,000 cyber attacks every day per healthcare organization as compared to an average of over 14,300 per organization in other industries.
Another important factor influencing the rapid rise in cases of cyber attacks in healthcare is the growing increase in development and number of malware families. According to Fortinet’s Q4 2017 Global Threat Landscape Report, the number of existing malware families increased by 25% while the number of unique malware units rose by 19%, the volume of which triggers an increase in cyber attacks.
Data encryption has also seen widespread incorporation in health systems. Although encryption protects data, it also triggers cyber criminals to hide malware using encryption. This, in turn, increases the need for inspection of encrypted data which in itself may cause certain mishaps and create weak points through which cyber attacks could be carried out.
Approaches to Protecting Health Data
Software and hardware make up the channels through which most transactions in healthcare are conducted, and these channels are vulnerable. Therefore, it’s vital for providers and insurers to fortify their cyber security to safeguard these health data. Some of the recommendations made by cyber security experts are as noted below;
Update HIPAA – The Health Insurance Portability and Accountability Act of 1966 (HIPAA) has provided guidelines or information constituting the HIPAA security rule which protects the privacy of certain health data. The security rule provides national standards of implementing appropriate physical, administrative, and technical security measures to safeguard the integrity of electronically held health information.
Many healthcare organizations are already aware of the framework for the HIPPA safety rule, however, it’s key to update these safety measures, as recommended by HIPPA, for protection of data against new and more sophisticated cyber attacks.
Promoting Good Cyber Hygiene – Healthcare organizations need to improve their update and software patching processes routinely. These organizations need to employ threat intelligence and automation in the software patching process.
Excellent cyber hygiene also includes keeping an inventory of all medical devices used in collecting health data and transferring them. This enables them to track these devices and check for vulnerabilities. Hospitals should ensure strict monitoring of searches and downloads on their IT devices. This provides information for extraction of patient data, financial information, or even research data.
Personnel Training – Training of personnel plays a key role in preventing cyber attacks. Some phishing attacks have succeeded in breakdown cyber security systems because certain personnel was ill-informed.
Regular training of staff on best practices for data security is essential to keep them aware of security threats, what dimensions cyber attacks manifest in, and strategies to prevent such attacks.
Best Practices – There are a number of forums in which organizations can share best practices and successful strategies for preventing cyber attacks. Financial Services Information Sharing and Analysis Center (FS-ISAC) provides a forum for collaboration between organizations in the financial services sector to share best practices on cyber security.
Also, the National Health-ISAC plays a key role in converging organizations and experts in the healthcare industry to discuss strategies for combating cyber attacks.
One of such strategies is using a strong authentication. The Multifactor authentication, for instance, is a form of cybersecurity used in many financial service companies. This technology provides a strong security system to protect vital data.
Cyber Insurance – Cyber insurance is used by many financial organizations to improve the security of financial data. This form of cyber security is still novel and has not been widely used in the healthcare sector. However, the main challenge with cyber insurance is the source of payment and the coverage of security. With regards to the security coverage, the dilemma remains who is to be protected, the institution or the patient.
Advanced Threat Intelligence – With the growing sophistication of cyber attacks, the conventional methods of patching vulnerabilities and correcting intrusions are becoming inadequate. Therefore, advanced intelligence systems are required.
The conventional approaches include using signature-based detection and isolated security devices. However, advanced intelligence not only detects cyber attacks but diagnoses the techniques used in breaching vulnerabilities. Furthermore, certain artificial intelligence-based algorithms can detect anomalies and instantly communicate detected malware and shrink the attack.
In the healthcare industry within the last few years, technology has created a new paradigm. In the future, digitalized healthcare and AI-based models of care will redefine healthcare. However, this growth comes with a risk of data security intrusion. With these measures in place, cyber attacks can be curbed so that technology can be used to its full potential in healthcare.
