The News
The news is notoriously famous for covering large enterprise stories but very rarely talks about the small practices. This leads many to believe that small organizations are ignored by hackers and very rarely susceptible to malware attacks. It is commonly believed that only large organizations are the target of cyber attackers due to the volume of sensitive, confidential, or proprietary information they possess. In reality, small practices are seen as an easy means of entry to breach a larger organization. Not only do small practices suffer more cyber attacks than large scale operations but they also take longer to recover, if at all.
Legacy Medical Hardware and Software
Healthcare organizations must constantly balance the need for advanced equipment with the need for everything else; everything from magazines in the waiting room to a network security firewall. Because of these expenses, organizations cannot afford to replace medical systems every. Some may even have the same for decades leaving software that is no longer supported by the manufacturers. The same goes for computer systems such as the unsupported Windows XP platform and soon to be Windows 7 platform. Legacy systems create a large numbers of vulnerabilities and few modern solutions. The older the equipment, the greater chance of susceptibility to compromise.
Lack of Resources
Without experiencing a breach or data loss, many healthcare organizations have difficulty demonstrating the importance of cyber protections. It is hard for them to justify the “what if” mentality. It’s also difficult to prove that proactive risk mitigation can save money and protect against reputation damage.
This problem is likely to fade for large institutions, but for smaller organizations, the problem may continue to persist. While small practices and rural hospitals dominate the healthcare industry, these groups do not have the resources needed to stop ongoing cyber threats, especially ones that change tactics and attack vectors quickly. Even if a small healthcare organization invests in technology to monitor attacks, it’s unlikely to have the staff or expertise necessary to act on the information quickly and correctly.
Stolen Healthcare Data is Valuable
Stolen credit card and bank account numbers are sold online every day. They can be used for many schemes, but banks often quickly detect the fraudulent activity and cancel the account, thus rendering it useless to cyber criminals.
Medical history can last much longer. Many details such as a person’s diagnoses, treatments, full name, and social security number never change. For this reason, cyber criminals can use stolen medical data for decades. A medical fraud scheme can last for years before it’s discovered, netting thieves a fortune and making patient data a high value target.
Lack of Cybersecurity Education
Cybersecurity is largely considered an IT problem, including in healthcare. Other staff members, such as nurses, doctors, and administrators, often don’t understand the risk of a data breach. They also don’t realize everyone, not just healthcare IT staff, plays a role in keeping an organization secure. Lack of awareness is huge vulnerability to small organizations.
Many security professionals have difficulty demonstrating the importance of cyber protections to healthcare organizational leadership, including how risk mitigation can save money and protect against reputational damage in the long-term. Making the decision to prioritize cybersecurity within the healthcare industry requires culture shifts and increased communication to and from leadership, as well as changes in the way providers perform their duties in the clinical environment.
Without a proper remediation plan to address these five issues, your organization could be at risk. If you feel that your practice faces these same struggles, you could also be subject to noncompliance. Check out our latest webinar on aligning your data security with HIPAA compliance. You can watch the webinar here or click the icon below.
