Cyberattacks: Top 4 healthcare security trends

Healthcare cybersecurity in 2021: Incidents mounting daily

In a recent three-day span, healthcare cybersecurity news site HealthITSecurity reported three troubling incidents for healthcare organizations: a hacking attempt on the fourth-largest community health center in Mississippi, a data breach exposing protected health information (PHI) of oncology patients at nine Illinois hospitals, and a ransomware attack targeting both patients and employees of a practice management vendor. This sampling represents a much larger trend that threatens the industry. 

“Data security is becoming incredibly complex and expensive, and it's going to continue on that trajectory.”

Ethan Bing, Practice Administrator, Medical Colleagues of Texas

“Data security is becoming incredibly complex and expensive, and it's going to continue on that trajectory,” said Ethan Bing, Practice Administrator, Medical Colleagues of Texas. In this blog, Ethan described how his practice responded to a data breach by moving to a cloud-based EHR solution.

Here are four key healthcare security trends to note:

1. 

   Healthcare had the highest breach costs of any industry for the tenth year in a row.
   The average cost of a healthcare data breach climbed to $7.13M in 2020, up 10.5% from 2019, according to a report from IBM and the Ponemon Institute. Second to healthcare was the energy industry, with a $6.39M average breach cost, followed by the financial industry, with a $5.85M average breach cost.

2. Year over year, healthcare experienced the second-largest data breach cost increase of any industry.
   Climbing 10.5%, healthcare ranked behind the energy industry, which climbed 14.1% year over year, but ahead of retail, which climbed 9.2%. Of 17 industries analyzed by IBM and the Ponemon Institute, only these three saw data breach cost increases.

3. 

   The number of healthcare data breaches has risen every year for the last decade.
   In 2020, there were 642 reported healthcare breaches involving 500 or more records, according to the HIPAA Journal. By contrast, there were only 199 reported breaches in 2011. Hacking, unauthorized access, and PHI theft were top cybersecurity threats in healthcare during this period.

4. Penalty totals continue to climb.
   HIPAA fines and settlements reached $13.6M in 2020, up from $12.3M in 2019, but down from the all-time high of $28.7M in 2018. A settlement paid by Anthem, Inc. contributed to the spike in 2018. In addition, HIPAA enforcement activity has risen steadily over the past 12 years — up from a mere $100,000 in 2008, as the HIPAA Journal reports. The HIPAA news source dedicated a page to detailing OCR fines and settlements during this time frame.

 
Cybersecurity trends: What makes healthcare the top target

Healthcare is by far the biggest target for cybercriminals. But why?

Whether due to budget limitations or hesitancy to disrupt established routines, many healthcare organizations continue to use outdated and unsupported software and operating systems, leaving themselves vulnerable to cyber threats.

“Attackers have expanded phishing and social engineering efforts, preying on the anxiety and fear caused by the coronavirus.”

Brian Bobo, Chief Information and Security Officer, Greenway Health

Meanwhile, the protected health information (PHI) these systems use has immense value to cybercriminals. They can use it for extortion, fraud, identity theft, and other malicious purposes.

Cybercriminal gangs, as well as nation-state sponsored hacking groups, target healthcare organizations that store great quantities of data.

Amid the pandemic, threats increased as cybercriminals took advantage of an overwhelmed healthcare system.

“Attackers have expanded phishing and social engineering efforts, preying on the anxiety and fear caused by the coronavirus,” Brian Bobo, Greenway Chief Information and Security Officer, told Authority Magazine.

In addition, the shift to remote work — including increased use of unsecured WiFi and lack of enterprise virtual private networks (VPNs) — opened the door to increased cybercrime, Brian said.

Cybersecurity for healthcare providers: What can my practice do?

All of this makes cybersecurity an urgent priority for healthcare organizations, whether they are large health systems or small practices.

“Cybersecurity in healthcare never stays the same — there’s always a new threat or twist in which we have to respond.”

Brian Bobo, Chief Information and Security Officer, Greenway Health

Small and even medium-sized practices may lack the resources to guard against cyberattacks. For these practices, a cloud-based EHR solution such as Greenway Secure Cloud offers needed data protection, incident detection and response, and continuous monitoring.  Learn more about how practices benefit from Greenway Secure Cloud.

“Cybersecurity in healthcare never stays the same — there’s always a new threat or twist in which we have to respond,” Brian said.