Healthcare Cyber Security Doesn’t Have to be Hard

Lack of awareness training • Lack of IT resources for managing suspicious emails • Lack of software scanning emails for malicious content or bad links • Lack of email detection software testing for malicious content • Lack of email sender and domain validation tools

Loss of reputation in the community (referrals dry up, patients leave the practice) • Stolen access credentials used for access to sensitive data • Erosion of trust or brand reputation • Potential negative impact to the ability to provide timely and quality patient care • Patient safety concerns

Be suspicious of e-mails from unknown senders • Train staff to recognize suspicious emails and to know where to forward them • Never open attachments from unknown senders • Implement advanced technologies for detecting and testing e-mail for malicious content or links

Lack of system backup • Lack of anti-phishing capabilities • Unpatched software • Lack of anti-malware detection and remediation tools • Lack of testing and proven data back-up and restoration • Lack of network security controls such as segmentation and access control

Partial or complete clinical and service disruption • Patient care and safety concerns • Expenses for recovery • The presence of ransomware (or any malware) on a covered entity’s or business associate’s computer systems is a security incident under the Health Insurance Portability and Accountability Act (HIPAA) Security Rule

Patch software • Be clear which computers may access and store sensitive or patient data • Use strong/unique username and passwords with MFA • Limit the rate of allowed authentication attempts to thwart brute-force attacks • Deploy anti-malware detection and remediation tools • Maintain updated inventory of assets • Implement proven and tested incident response procedures

Lack of asset inventory and control • Lack of encryption • Lack of physical security practices • Lack of simple safeguards such as computer cable locks to secure devices within office environments • Lack of awareness that theft of IT assets from the office accounts for nearly as much as from cars • Lack of effective vendor security management, including controls to protect equipment or sensitive data • Lack of “End-of-Service” process to clear sensitive data before IT assets, including medical devices, are discarded or transferred to other users or other organizations

Inappropriate access to or loss of sensitive patient information occurs • Theft or loss of unencrypted PHI or PII; may result in a data breach requiring notification to affected patients, relevant regulatory bodies, and the media • Lost productivity • Damage to reputation

Encrypt sensitive data, especially when transmitting data to other devices or organizations • Implement proven and tested data backups, with proven and tested restoration of data • Acquire and use data loss prevention tools • Implement a safeguards policy for mobile devices supplemented with ongoing user awareness training on securing these devices • Promptly report loss/theft • Maintain a complete, accurate, and current asset inventory to mitigate threats • Encrypt data at rest on mobile devices to be inaccessible to anyone who finds the device

Files containing sensitive data accidentally e-mailed to incorrect or unauthorized addressees • Lack of adequate monitoring, tracking, and auditing of access to patient information on EHR systems • Lack of adequate logging and auditing of access to critical technology assets, such as e-mail and file storage • Lack of technical controls to monitor the e-mailing and uploading of sensitive data outside the organization’s network • Lack of physical access controls • Lack of training about social engineering and phishing attacks

Accidental loss of PHI or PII through e-mail and unencrypted mobile storage, resulting in reportable data breaches • Reportable incidents involving patients who are victims of employees who inappropriately view patient information • Financial loss from insiders being socially engineered into not following proper procedures • Financial loss due to an employee inadvertently giving an attacker access to banking and routing numbers because the attacker used a phishing e-mail disguised as originating from the bank • Patients given the wrong medicines or treatment because of incorrect data in the EHR

Train staff and IT users on data access and financial control procedures to mitigate social engineering or procedural errors • Implement and use workforce access auditing of health record systems and sensitive data • Implement and use privileged access management tools to report access to critical technology infrastructure and systems • Implement and use data loss prevention tools to detect and block leakage of PHI and PII via e-mail and web uploads

Patches not implemented promptly • Equipment not current, or legacy equipment that is outdated and lacks current functionality • Most medical devices, unlike IT equipment, cannot be monitored by an organization’s intrusion detection system (IDS); safety of patients and protection of data integrity are dependent on identifying and understanding the threats and threat scenarios. • Heterogeneity of medical devices means that the vulnerability identification and remediation process is complex and resource intensive

Broad hospital operational impact due to unavailable medical devices and systems • Medical devices do not function as required for patient treatment and recovery • Patient safety compromised due to breach

Assess current security controls on networked medical devices • Implement information security assurance practices, such as security risk assessments of new devices and validation of vendor practices on networks or facilities • Engage information security as a stakeholder in clinical procurements • Use a template for contract language with medical device manufacturers and others • Implement security operations practices for devices, including hardening, patching, monitoring, and threat detection capabilities • Develop and implement network security applications and practices for device networks