There can be no doubt that cybercrime is on the rise. Across all industries, there has been a huge rise in not only the levels of cybercrime but also the sophistication of the attacks being used. Healthcare is certainly not immune from this issue and it is a challenge that only looks set to become more trouble as time goes on.
We need only look to America to see the potential scale of the problem. In 2021, over 40 million individuals had their records breached and exposed. There are many consequences to suffering a breach like this – not only is it damaging for patients and bad for the reputation of the institution, but hospitals and medical facilities often face financial penalties or legal action from the affected individuals.
In this article, we take a look at some of the issues that can hurt healthcare providers in terms of cybersecurity and examine how your IT system could actually be creating a threat to ongoing patient safety.
Still vulnerable to ransomware?
Healthcare providers have unfortunately typically been vulnerable to issues like ransomware attacks, where a virus infects a computer system, locks out users completely and steals the data. Indeed, the famous WannaCry Ransomware attack actually happened all the way back in 2017 – but the problem of ransomware is still present.
Ransomware is typically delivered via phishing emails. So, it is essential that staff are given guidance on how to recognise a scam email.
The threat of shadow IT
Another huge problem for healthcare providers is that of shadow IT. This is an issue throughout many industries, and in some ways it can be traced back to the rise of working from home. Shadow IT refers to any kind of software or application that is used by a member of staff without the knowledge and approval of the IT team.
You might think that this type of software is hardly a major issue, but if the software isn’t approved by the IT team, it can contain flaws and vulnerabilities that can be exploited by criminals.
Misconfigured medical devices
An increasing number of medical care devices are part of the IoT; they are connected to the internet. This means that if they are also connected to your system, they present a potential access point for cybercriminals. However, this is only a problem if the devices are misconfigured or have known weaknesses.
When misconfigurations are not addressed it can lead to serious problems, such as privacy breaches, identity theft and other cyberattacks.
Data protection and the GDPR
The GDPR and its UK equivalent, the Data Protection Act 2018, were introduced to provide customers with greater protection for their private data. However, it is important to recognise that it has a huge impact on security. Under these regulations, it is up to any organisation that stores data to ensure that it is properly protected. Failing to do so can land you with very significant fines for breaching data-protection rules.
Lack of cybersecurity expertise
One of the major problems facing all sectors is the cybersecurity skills shortage. Simply put, there are more cybersecurity positions available than there are skilled and qualified candidates to take them. This problem is significant and has been a challenge for a number of years. Ultimately, it means that it is difficult and expensive to hire cybersecurity staff.
But if you don’t have cybersecurity skills in your team, you put yourself at risk of cyberattacks. This is where it can be sensible to work with outsourced cybersecurity experts.
Overcoming the challenges: what should you invest in?
Of course, it is important for healthcare providers to put more investment into their cybersecurity and the NHS’s Keep I.T. Confidential initiative is a good example of efforts to improve security measures across care settings. But, there is a problem here in that there are many different forms of cybersecurity available. This makes it difficult to understand exactly where your money should go in order for it to be most effective.
Every healthcare provider is different, so it makes the most sense to speak with experienced professionals to come up with a long-term cybersecurity strategy. However, there are a number of different aspects of cybersecurity that are always going to be valuable for healthcare providers. Some of the most important areas to invest in include:
- Staff training. This is an often overlooked issue. Your staff are the key line of defence against cybercrime. If members of staff can’t spot issues or fall for scams, it won’t make a difference what you invest in your cybersecurity system. Make sure that training is updated regularly and carried out on a regular basis.
- Penetration testing. Also known as pen testing, this is a form of cybersecurity assessment that seeks to identify, safely exploit and help remediate vulnerabilities across computer systems, applications and websites. Your system is tested by professionals looking for weaknesses in your defences. When they find them, they can help to deal with the problem before they can be exploited by criminals.
- 24/7 monitoring. Ongoing monitoring is an increasingly important part of cybersecurity. Due to the nature and sophistication of cyberattacks, you can’t assume that your defences will hold up to every type of attack. If your system is professionally monitored, you can combat breaches as fast as possible.
David Tobin did his degree in psychology at the University of Hertfordshire. He is interested in mental health, wellness, and lifestyle.
