Healthcare Riskopolis

Regulation/Compliance:

Data breaches come in many forms, but in the healthcare industry, losing private health information (PHI), as defined by the Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health (HITECH) Act, can be costly. Ensuring compliance with these two regulations can help mitigate risks and avoid regulatory penalties associated with inaction.

Medical Device Vulnerabilities :

Medical devices like X-rays, MRIs, and CT scans rely on computers to image, process, and develop actionable data for doctors. Allowing hackers to infiltrate these machines can pose data breach risks, increase power usage and costs, and serve as an initial access point for network traversal. Segmenting these devices within a network, hardening their base firmware, and leveraging zero-trust architecture for connections are generally considered best practices.

Third-Party Risks :

Third parties providing software as a service (SaaS) can pose cyber risks that often go unrecognized. Many healthcare solutions involve providing PHI to these vendors or within their software. Implementing a process to assess the security posture of these organizations, along with contractual obligations like cyber insurance, indemnification, and security audit provisions, can help ensure your organization is adequately protected from vendor risks.

Business Continuity :

Conducting a business impact analysis helps you identify the systems, platforms, and assets vital to operations. From there, consider developing a strategy to continue operating if one or more of these assets become nonviable. For example, if your electrical power systems are impacted by a cyberattack, having backup generators can keep ventilators running and save patients' lives.

Vehicle Risks :

Ambulances are often owned by a third party but may include technology the hospital relies on to track incoming patients, the location of ambulances, and the management of a fleet across multiple ambulatory organizations. Because of this, hackers can leverage these technologies to disrupt services, cause equipment failures, or access the hospital’s larger network.

Bodily Injury Risks:

Operating rooms (ORs) leverage many tools that support surgical efforts to save lives. Today, many of these tools can act or process data on their own, but having that power comes with additional risks. If these devices have vulnerabilities, they may cause more harm than good. Additionally, ransomware risks come with the potential to "brick" technology.

Medical Fraud:

If a hacker gains access to a network, exfiltrates PII and PHI, and sells it on the dark web, a hospital may unknowingly become a victim of medical fraud. One technique used is billing for patient-related services, which are then paid by the breached hospital. Therefore, it’s important to recognize untimely invoices, establish dual authorization for any transfer of funds, and maintain a relationship with the bank responsible for your transactions for fraud monitoring services.