When I saw the caption, “Your medical record is worth more to hackers than your credit card” on Reuters, I was caught with fears. This is what many of us never thought of. We think the hospital is just a place where people are given treatment and that ends it. No! Recent studies on the field have upheld the fact that criminals, especially cyber criminals have continually made the hospital their point of target. By the time we are done with this short piece, you will have a better understanding of the message I intend to pass and on the need for you to take some things with all sense of seriousness.
Cyber attacks on hospitals and healthcare providers have become a regular occurrence. On Feb. 1, it was Easton Hospital in Easton, Pennsylvania. On Feb. 4, it was the Catawba Valley Medical Center in Hickory, North Carolina. On Feb. 20, it was the Calbrini Hospital in Melbourne, Australia—all these occurrences happened in 2019 (Patrick, 2019). From the case studies given above, you can see that cyber criminals are renewing their attacks every time. So, we do not have to wait until we become a victim before doing the needful.
As more and more hospitals suffer ransomware attacks, cyber-security experts say the healthcare industry must up its cyber game before their patients suffer the consequences. Stuart Madnick, a professor of information technology and engineering systems at MIT’s Sloan School of Management, said that hospitals are experiencing up to 70 percent of all ransomware attacks. They’re an easy target, he said, because when hackers hold health records and sensitive patient data hostage, hospitals have no choice but to pay the ransom. Refusing to pay means patients could lose control over their personal health information (PHI), or worse, have life-saving surgeries postponed (Patrick, 2019).
In 2017, North Korean hackers used a “WannaCry” ransomware attack on Great Britain’s National Health Service, which resulted in canceled operations and delayed medical appointments.
According to a July 2018 Maturitas study, electronic health records (EHR) and individual medical devices (like pacermakerss) are highly vulnerable to cybercrime. The study concludes that “cyber-security is critical to patient safety, yet has historically been lax,” and the industry may need regulation to make cyber-security “an integral part of patient safety” (Patrick, 2019).
“One of my nephews has diabetes and he has Wi-Fi connected insulin pumps and can control it from his phone, and when he goes to the doctor, the doctor can download the data,” Madnick said while addressing journalists.
Having established this fact, let’s consider some of the major reasons why criminals make the healthcare industry their focus:
Right from time, the industry is not safe: In 2009, the English Congress passed the Health Information Technology for Economic and Clinical Health (HITECH) Act that required hospitals to switch from paper to electronic health records (EHRs). With this came a flood of new health information technology and concerns that some of these vendors were bypassing security measures in order to get their products to market quickly, leaving the already newly digital healthcare institutions open and susceptible to cyber-attacks. Healthcare institutions are still holding on to legacy pieces of software, which makes them a much easier target, says Mike Hanley, director of Duo Labs. He adds that educating users about when it’s time to update software and systems or making them aware of phishing emails can be difficult (Johnson, 2016). This laxity is not limited to Europe alone as it is the practice all over the world; the workers in the industry like cutting corners and doing things as they please. This opens up the industry to undue attacks.
The activities of the industry are connected to life: Because lives are at stake, healthcare professionals and their patients often can’t afford to have systems down or wait for an incident response team to come in and clean up the mess. This makes them prime targets for ransomware attacks. They often pay the ransom in order to get their systems back up and running, Hanley says. It’s front page news if a hospital in a major metropolitan area goes dark due to a cyber-attack, he says, which is bad for the hospital’s reputation and as well as patient well-being – you can’t have people avoiding the hospital for fear of having their patient records stolen or compromised (Johnson, 2016).
Healthcare data is lucrative to criminals: In addition to being ripe for the ransomware-picking due to the need for fast recovery times, hospitals also house a lot of private data. When cybercriminals steal a patient’s healthcare records, they’re often able to acquire multiple pieces of information: social security number, medical history, insurance provider, the patient’s medications, and so on. “There’s a larger concentration of sensitive information [that can be resold],” Hanley says (Patrick, 2016). When they are able to lay their hands on the data, it is like hitting the jackpot.
An application-heavy environment provides a broad attack landscape: According to the Duo Labs report, Duo Security healthcare customers are logging into twice as many applications as the average user in other industries. “This in itself is not a security risk or problem, but more diverse systems … [may] require them to use old systems,” Hanley says, which could put them at risk of attack (Patrick, 2016). Frequenting an application makes one’s data vulnerable to attacks. With this, criminals are being given the free hands to easily access their data.
Windows and out-of-date browsing make it easy for cyber attack: The healthcare industry is still using out-of-date, legacy systems. The report found that 82% of healthcare organizations are using Windows, and 76% are running on Windows 7. They’re also partial to Internet Explorer (IE) 11, and 22% of Duo Security healthcare customers browse on unsupported versions of IE. Hospital employees wash their hands to avoid getting the common cold and they need to employ the same basic measures to keep their information security systems healthy, Hanley says. “[It’s about] getting back to the basics, user education, security hygiene” (Patrick, 2016).
References
Humer, C &Finkle, J (2014). Your medical record is worth more to hackers than your credit card record. Retrieved from https://www.reuters.com/article/us-cybersecurity-hospitals/your-medical-record-is-worth-more-to-hackers-than-your-credit-card-idUSKCN0HJ21I20140924
Johnson, E (2016). 5 reasons cybercriminals target healthcare. Retrieved from https://www.darkreading.com/endpoint/5-reasons-cybercriminals-target-healthcare/d/d-id/1325210
Patrick, K (2019). Hospitals are cyber criminals’ newest, biggest target. Retrieved from https://www.insidesources.com/hospitals-are-cyber-criminals-newest-biggest-target/