Measures You Should be Implementing in Your Organization to Strengthen Your Cybersecurity and Protect Your Patient Data

Despite our focus on security and privacy, cyber threats are continuously increasing in both number and severity. In a much less fun way, cyber threats are on their own Eras Tour. Instead of choreography and songs, we get ransomware and phishing scams, and instead of saving up to try to buy tickets to attend the tour, we need to be spending our time and money to keep the tour away from our organization. But exactly what measures should we be spending our time and money on?

We reached out to our brilliant Healthcare IT Today Community for their insights into this matter. We asked them – with this ongoing era of increasing cyber threats, what measures are organizations implementing or should be implementing to strengthen the cybersecurity of healthcare systems and protect patient data? The following are their answers.

Kayla Underkoffler, Lead Security Technologist at HackerOne
The big issue for healthcare organizations is that their data is highly regulated and confidential, making adopting seemingly cutting-edge cybersecurity best practices intimidating. However, I’d encourage healthcare organizations to consider the downside they’re already facing as the frequency of breaches continues to mount in this industry. Healthcare organizations must find a way to develop more proactivity in their cybersecurity approach. They can look to other industries that face similar obstacles in regulation, data sensitivity, and digital infrastructure complexity for inspiration.

One effective strategy is to incorporate ethical hacking into their security measures. This underutilized approach in the healthcare sector can provide significant protection against cyber threats. Collaborating with ethical hackers can help the healthcare sector prevent cyberattacks before they occur, ultimately safeguarding sensitive patient data, medical devices, and health delivery infrastructure.

In addition, lawmakers can aid the healthcare industry by clarifying that discovering vulnerabilities in good faith does not constitute a breach. Otherwise, the healthcare industry loses a significant advantage in identifying and fixing vulnerabilities before cyberattacks occur. For example, government and financial services are two sectors that have found great success in implementing Vulnerability Disclosure Programs (VDPs).

These “see something, say something” programs facilitate how organizations can empower security researchers to continuously identify and report vulnerabilities before cybercriminals can, and they have become a gold standard for every organization and security program, no matter the vertical. Healthcare organizations that do the work to take the lead now in embracing best practices are likely to see outsized benefits in reducing their own cybersecurity risk and driving the industry toward security maturity.

Mark Dill, Chief Information Security Officer at MedAllies
Having good policies and procedures in place is important – and having a yearly role-based training plan is even better. Investing in quality learning management systems affords an organization the ability to assign appropriate modules that provide simple awareness, education, or deep-dive training. To address the root causes of most healthcare data breaches, organizations should focus on social engineering (including phishing), ransomware and malware, theft and loss of device and media, accidental and malicious data loss, and secure operations of biomed assets, as well as encourage a “see something, say something” culture. It’s also vital that organizations are aware of behaviors to avoid (“The Human Element”) and ensuring phishing click rates are within or better than the 4-6% healthcare average.

Yuval Wollman, Chief Cyber Officer at UST
Many healthcare organizations today are implementing several critical measures to enhance cybersecurity, especially in light of incidents like the recent Change Healthcare attack in February 2024. Maintaining system hygiene with regular updates, testing incident response plans, and employee training are all critical components of ensuring proper communication and response in the case of an attack. In the Change Healthcare attack, for example, coordinated action was necessary to manage the fallout from the ransomware incident. Adopting a layered security approach with multiple defense mechanisms can provide increased resilience, reducing the potential impact on business operations in the wake of an attack.

Given the fact that the breach had implications on financial processes, sensitive patient data, legal and compliance regulations, and the operations of major healthcare providers, it is essential for healthcare organizations to foster a strong security culture. Open communication and transparency across the organization need to be encouraged, ensuring employees feel comfortable reporting potential vulnerabilities. Clear communication is essential in justifying the business benefits of a robust cybersecurity program and swift response when working with organizational leaders and supervising boards.

Kynan Carver, Managing Director, Cybersecurity Lead at Maximus
Agencies are continuing to make progress along the path to Zero Trust Architecture to ensure authentication, authorization, and continuous monitoring for all users. With these more stringent security protocols, we recommend agencies also take steps to consider the total user experience – employees, providers, and beneficiaries. These measures include prioritizing seamless account and identity management tools, investing in technologies that mitigate login and authentication complexity, and deploying context-based security policies that allow for tagging of beneficiary or patient data to customize access and security levels.

Ryan Hamilton, Chief Technology Officer at MacroHealth
Healthcare is a vast web of interconnected systems consisting of payers, providers, and vendors. It only takes the exploitation of one weak spot to create havoc. Organizations must properly vet all of its partners to ensure each one meets minimum security standards. Where possible, look to unified platforms to minimize the depth and breadth of point-to-point integrations.

Yigal Rozenberg, SVP Technology at Protegrity
In response to increasing cyber threats, healthcare organizations are implementing several measures to strengthen cybersecurity and protect patient data. Key strategies include multi-factor authentication (MFA), end-to-end encryption, regular security assessments, and advanced threat detection. They are adopting Zero Trust Architecture, ensuring cloud security, and segmenting IoT devices. Employee training, data backup, and access control are prioritized, along with network segmentation and vendor risk management. Patch management, mobile device management, compliance monitoring, secure development practices, endpoint detection and response (EDR), and cybersecurity insurance are also critical. These measures collectively enhance cybersecurity posture and safeguard patient data.

John Chenoweth, Chief Product Security Officer at Elekta
The critical mission for cyber security in healthcare is protecting patient data and ensuring continuity of care. To accomplish this, it takes a complete team effort, from device manufacturers to software developers and hospital IT security teams. Guarding the identity of all users with effective multi-factor authentication (MFA), protecting the boundary of the systems, maintaining all software components, and actively monitoring the network are essential steps. Medical device manufacturers must integrate and support these capabilities in their products, while health delivery organizations are responsible for securing the environment.

Dave Bailey, Vice President of Security Services at Clearwater Security
Organizations must implement reasonable and appropriate measures based on the outcome of a comprehensive and on-going risk analysis. It is critical to understand the threats to the organization, the business functions, and the information systems that store, process, and transmit protected health information. The top priorities based on the types of disruptive cyber-attacks include a trained workforce, strong identity protection, endpoint detection and response, and well-rehearsed incident response and recovery playbooks.

Lance Reid, CEO at Telcion
In the current landscape of increasing cyber threats, healthcare organizations must implement multiple layers of security to protect patient data effectively. Crucial measures include multi-factor authentication, advanced email, and DNS security, and employing a third-party SOC/SIEM for 24/7 monitoring of security events. As the sector embraces digital transformation, particularly with connected medical devices and IoT systems, regular vulnerability scanning is essential. These devices should be kept on separate VLANs to limit their interaction with critical on-premise systems. Additionally, ongoing security awareness training for staff is vital. This training should be mandatory, short, and conducted monthly, often including simulated phishing tests to enhance user awareness. These comprehensive strategies are essential for strengthening the cybersecurity posture of healthcare organizations and protecting sensitive information.

Pratik Maroo, Head of Healthcare and Life Sciences at Zensar
The first step is to assess its vulnerabilities and strengths. The second step is prioritizing initiatives to address the gaps, reinforce strengths, and monitor critical external events. The final step is to implement, monitor, and adapt the initiatives and learnings to the resilience and recovery plans, making this an ongoing process. Preparedness, response, and recovery strategies must be meticulously laid out to face any eventuality and to reduce the impact, with patient safety at the forefront of these measures.  These steps can be encapsulated into a robust Information Security Management System (ISMS). A pharma organization should do the following to establish ISMS:

• Establish policies with clear roles and responsibilities
• Identify and assess information security risks
• Implement controls and safeguards to mitigate identified risks and protect information assets
• Develop procedures for detecting and responding/recovering from information security incidents
• Monitor the effectiveness of information security controls through regular reviews and audits
• Ensure compliance with relevant legal, regulatory, and contractual requirements related to information security

Rob Stuart, CEO at Claim.MD
The rising tide of cyber threats in healthcare underscores the critical importance of secure data transmission in claims processing. As healthcare entities strive to meet HIPAA’s privacy and security mandates, they must prioritize evaluating IT vendors not just for functionality but for robust security measures. Medical practices should tailor their IT solutions to their unique needs, ensuring secure connections among systems. This involves assessing vendors’ security protocols, certifications, and the handling of sensitive data. Recent large-scale breaches have demonstrated the risks of relying on a single vendor. In case of a prolonged outage or disruption, providers should prepare a contingency plan to migrate clearinghouses. More important, is the payer’s ability to exchange data from more than one clearinghouse. Having more than one clearinghouse ensures continuity of operations and timely revenue flow even in the event of an industry disruption.

Everyone in the industry has a shared responsibility to maintain security standards, keep health data safe, and keep it moving. Continuous monitoring, regular software maintenance, and updating administrator-level passwords post-implementation are crucial. Moreover, employee training on cybersecurity best practices, including the use of strong passwords and recognizing phishing attempts, is vital to safeguard against cyber threats. Two-factor authentication can further enhance security, helping protect patient data and ensure the financial stability of healthcare organizations.

Bill Olsen, Co-Founder and CTO at UptimeHealth
Organizations should think holistically about the data they are protecting, accessing, and its traceability. Too many times, I see an overemphasis on perimeter protection and keeping the “bad actors” out. While this is important, most data breaches come from the inside. Data should be classified at its origin, with access by level only given to systems and people who require it. If data needs to be shared outside this entitlement chain, for analytics or other business purposes, as an example, then create anonymized versions that protect the data. Do not rely on NDAs or other enforcement mechanisms that can be circumvented. With a strong data access policy in place, implement software and systems to ensure the data is securely delivered. There are many well-proven technologies to secure data transmission, such as SSL. Once this is in place, establish monitoring and prevention mechanisms to detect if a violation occurs.

Jerry Mancini, Senior Director, Office of the CTO at NETSCOUT
First, in the healthcare industry, most investments are made in medical equipment and clinical technology, not in cybersecurity solutions. Moreover, the emphasis in hiring is placed on doctors, nurses, and researchers, not on cybersecurity experts. As a result, many healthcare organizations (especially smaller hospitals, clinics, and doctor’s offices) do not have adequate staff or resources to proactively address cybersecurity. We’ve seen firsthand how that has led to a virtual epidemic in the rise of ransomware and DDoS attacks against healthcare providers in recent years.

All that said, enhancing visibility and compliance through network monitoring is crucial. By understanding activity on the network, IT management teams can better understand and identify abnormal network behavior for analysis. And, when issues are identified early, healthcare IT departments can proactively address vulnerabilities and prevent disruptions, ensuring the continuous operation of critical healthcare systems and the protection of sensitive patient data.

Additionally, as attackers grow in sophistication, healthcare systems must reconsider their security posture. Zero-trust (ZT) architecture was designed to rethink the security paradigm, enabling services that drive digital transformation while also improving organizations’ security posture. ZT principles provide comprehensive protection of digital assets, services, and communications by limiting access and reducing the impact of potential breaches, even if attackers gain initial access. This approach is vital as many healthcare systems currently lack adequate protection against common vulnerabilities and the visibility to identify suspicious and malicious network activity. Investing in these measures is essential to safeguard sensitive patient information and maintain the integrity of healthcare operations in an increasingly vulnerable digital environment.

William Ogle, Senior Director of Governance, Risk, and Compliance at Nordic Consulting
In the face of increasing cyber threats, healthcare organizations are adopting several crucial measures to strengthen cybersecurity and protect patient data, including implementing robust data encryption, employing multi-factor authentication, and utilizing role-based access control to limit data access based on job roles. Regular security audits, vulnerability assessments, and employee training programs are vital to maintaining a strong security posture. Additionally, developing and rigorously testing incident response and disaster recovery plans ensure quick recovery from potential breaches. Other key strategies include network segmentation, advanced endpoint protection, and adherence to a security framework, such as NIST CSF. An emerging practice today is leveraging advanced technologies like AI for threat detection. Hospital organizations will have a different starting point to accomplish this extensive list of controls, but by prioritizing and strategically adopting these comprehensive measures, they can better safeguard sensitive patient information against cyber threats.

Marcus Flack, CTO/Chief Technology Officer at CenTrak
Organizations should implement a range of cybersecurity measures to enhance the protection of healthcare systems and patient data. Related to Real-Time Location Systems (RTLS) specifically, what should customers seek? For me, one of the top priorities should be implementing multifactor authentication (MFA). MFA makes it more difficult for bad agents to access an account and reduces password fatigue and data theft while increasing customer trust. It may not be universally applied, but integrating MFA across all systems is crucial to strengthen access controls.

In addition to MFA, regular risk assessments are another key tool. Conducting regular risk assessments of organization systems helps identify and mitigate potential vulnerabilities. After an assessment, it’s important to follow through with regular patching as necessary and continually monitor the systems. These steps are essential to addressing any assessed vulnerabilities and detecting potential threats early.

Even with the strongest security systems and frequent risk assessments, healthcare organizations must invest in redundant data backups. Maintaining well-replicated and redundant data backups (e.g., using OneDrive) ensures data recovery in case of an attack. If an attack were to occur, segmented networks can limit the spread of threats within an organization, and implementing a structured approach for end-of-life management of systems can prevent the exploitation of any outdated technology.

Finally, one of the most crucial measures organizations must implement is the ongoing development and frequent testing of incident response plans to help teams react effectively to any security breaches. I believe a timely and thoughtful response is key to protecting patient data as well as the overall healthcare system.

Diana Zuskov, MPH, Associate Vice President of Healthcare Strategy & Innovation at LexisNexis Risk Solutions
Increasing cyber threats have led to heightened awareness of the need for more robust controls. We’re seeing healthcare organizations strengthen their identity verification for patients and staff to ensure that only authorized individuals can access patient data. However, organizations must account for the complexities related to access and ‘techquity’ unique to healthcare. Cumbersome processes, such as document authentication, can limit or deter individuals from using digital health tools or messaging their provider through their EHR portal. Organizations should consider modernized, frictionless, digital methods that leverage digital identity and behavioral assessments used in e-commerce and other industries that can authenticate a patient’s identity without creating an additional burden to accessing care.

Cecil Pineda, Senior Vice President and Chief Information Security Officer at R1
Cybersecurity leaders recognize the threat posed to them as well as the tools available to help protect patient information. To protect organizations and their data, cybersecurity leaders are leaning on data security controls like DSPM, DLP, and data security controls. However, this is not enough. Organizations must implement layers upon layers of technologies to fight against advanced adversaries and malware. They must also remember to leverage people and processes to compliment these layers of technology, as it is the strategies in place and the people to execute those strategies that ensure both protection and resolution to this threat.

Mike Donahue, Chief Delivery Officer at CloudWave
As cyberattacks rise in scope and severity, it has become evident that traditional healthcare cybersecurity methods have been ineffective. A significant shift is necessary to combat increasingly sophisticated attacks. For example, to strengthen healthcare systems’ cybersecurity and protect patient data, organizations should implement a patient-centric incident response plan that prioritizes patient care and well-being as the top priority. The plan should ensure that there is no impact on patient care, support and empower staff, proactively address concerns of patient families and friends, and restore and protect IT systems in a way that aligns with clinical guidance and patient care objectives.

Theresa Payton, Founder & CEO at Fortalice Solutions
We have watched as healthcare organizations increasingly adopt multi-layered security frameworks, including advanced encryption, access controls, and regular internally-run and third-party security audits to protect the resiliency and safety of their systems and patient data. Implementing robust incident response plans and fostering a culture of cybersecurity awareness among staff are also critical measures to fortify defenses against cyber threats. If an organization only has time and resources to do one thing in the next six months, I highly recommend practicing a digital disaster scenario via a tabletop exercise (or series of exercises) that impacts the ability to deliver quality healthcare so you can identify any gaps in your response.

Keavy Murphy, Vice President of Security at Net Health
As an industry that handles vast amounts of data, healthcare is particularly vulnerable to security threats. Organizations should operate from a mindset of preparedness, following the Assume Breach Paradigm. This proactive mindset not only prepares teams to respond effectively but also helps mitigate the panic that a sudden breach could cause. Key preparation steps like making sure team members understand their roles, securing cyber insurance, having system recovery methods in place, and identifying a forensics team are crucial for protecting sensitive data and ensuring the privacy of both organizations and patients.

There are so many good suggestions here! Huge thank you to Kayla Underkoffler, Lead Security Technologist at HackerOne, Mark Dill, Chief Information Security Officer at MedAllies, Yuval Wollman, Chief Cyber Officer at UST, Kynan Carver, Managing Director, Cybersecurity Lead at Maximus, Ryan Hamilton, Chief Technology Officer at MacroHealth, Yigal Rozenberg, SVP Technology at Protegrity, John Chenoweth, Chief Product Security Officer at Elekta, Dave Bailey, Vice President of Security Services at Clearwater Security, Lance Reid, CEO at Telcion, Pratik Maroo, Head of Healthcare and Life Sciences at Zensar, Rob Stuart, CEO at Claim.MD, Bill Olsen, Co-Founder and CTO at UptimeHealth, Jerry Mancini, Senior Director, Office of the CTO at NETSCOUT, William Ogle, Senior Director of Governance, Risk, and Compliance at Nordic Consulting, Marcus Flack, CTO/Chief Technology Officer at CenTrak, Diana Zuskov, MPH, Associate Vice President of Healthcare Strategy & Innovation at LexisNexis Risk Solutions, Cecil Pineda, Senior Vice President and Chief Information Security Officer at R1, Mike Donahue, Chief Delivery Officer at CloudWave, Theresa Payton, Founder & CEO at Fortalice Solutions, and Keavy Murphy, Vice President of Security at Net Health for taking the time out of your day to submit a quote! And thank you to all of you for taking the time out of your day to read this article! We could not do this without all of your support.

In this era of increasing cyber threats, what measures do you think organizations are implementing or should be implementing to strengthen their cybersecurity and protect their patient data? Let us know either in the comments down below or over on social media. We’d love to hear from all of you!

Despite our focus on security and privacy, cyber threats are continuously increasing in both number and severity. In a much less fun way, cyber threats are on their own Eras Tour. Instead of choreography and songs, we get ransomware and phishing scams, and instead of saving up to try to buy tickets to attend the tour, we need to be spending our time and money to keep the tour away from our organization. But exactly what measures should we be spending our time and money on?

We reached out to our brilliant Healthcare IT Today Community for their insights into this matter. We asked them – with this ongoing era of increasing cyber threats, what measures are organizations implementing or should be implementing to strengthen the cybersecurity of healthcare systems and protect patient data? The following are their answers.

Kayla Underkoffler, Lead Security Technologist at HackerOne
The big issue for healthcare organizations is that their data is highly regulated and confidential, making adopting seemingly cutting-edge cybersecurity best practices intimidating. However, I’d encourage healthcare organizations to consider the downside they’re already facing as the frequency of breaches continues to mount in this industry. Healthcare organizations must find a way to develop more proactivity in their cybersecurity approach. They can look to other industries that face similar obstacles in regulation, data sensitivity, and digital infrastructure complexity for inspiration.

One effective strategy is to incorporate ethical hacking into their security measures. This underutilized approach in the healthcare sector can provide significant protection against cyber threats. Collaborating with ethical hackers can help the healthcare sector prevent cyberattacks before they occur, ultimately safeguarding sensitive patient data, medical devices, and health delivery infrastructure.

In addition, lawmakers can aid the healthcare industry by clarifying that discovering vulnerabilities in good faith does not constitute a breach. Otherwise, the healthcare industry loses a significant advantage in identifying and fixing vulnerabilities before cyberattacks occur. For example, government and financial services are two sectors that have found great success in implementing Vulnerability Disclosure Programs (VDPs).

These “see something, say something” programs facilitate how organizations can empower security researchers to continuously identify and report vulnerabilities before cybercriminals can, and they have become a gold standard for every organization and security program, no matter the vertical. Healthcare organizations that do the work to take the lead now in embracing best practices are likely to see outsized benefits in reducing their own cybersecurity risk and driving the industry toward security maturity.

Mark Dill, Chief Information Security Officer at MedAllies
Having good policies and procedures in place is important – and having a yearly role-based training plan is even better. Investing in quality learning management systems affords an organization the ability to assign appropriate modules that provide simple awareness, education, or deep-dive training. To address the root causes of most healthcare data breaches, organizations should focus on social engineering (including phishing), ransomware and malware, theft and loss of device and media, accidental and malicious data loss, and secure operations of biomed assets, as well as encourage a “see something, say something” culture. It’s also vital that organizations are aware of behaviors to avoid (“The Human Element”) and ensuring phishing click rates are within or better than the 4-6% healthcare average.

Yuval Wollman, Chief Cyber Officer at UST
Many healthcare organizations today are implementing several critical measures to enhance cybersecurity, especially in light of incidents like the recent Change Healthcare attack in February 2024. Maintaining system hygiene with regular updates, testing incident response plans, and employee training are all critical components of ensuring proper communication and response in the case of an attack. In the Change Healthcare attack, for example, coordinated action was necessary to manage the fallout from the ransomware incident. Adopting a layered security approach with multiple defense mechanisms can provide increased resilience, reducing the potential impact on business operations in the wake of an attack.

Given the fact that the breach had implications on financial processes, sensitive patient data, legal and compliance regulations, and the operations of major healthcare providers, it is essential for healthcare organizations to foster a strong security culture. Open communication and transparency across the organization need to be encouraged, ensuring employees feel comfortable reporting potential vulnerabilities. Clear communication is essential in justifying the business benefits of a robust cybersecurity program and swift response when working with organizational leaders and supervising boards.

Kynan Carver, Managing Director, Cybersecurity Lead at Maximus
Agencies are continuing to make progress along the path to Zero Trust Architecture to ensure authentication, authorization, and continuous monitoring for all users. With these more stringent security protocols, we recommend agencies also take steps to consider the total user experience – employees, providers, and beneficiaries. These measures include prioritizing seamless account and identity management tools, investing in technologies that mitigate login and authentication complexity, and deploying context-based security policies that allow for tagging of beneficiary or patient data to customize access and security levels.

Ryan Hamilton, Chief Technology Officer at MacroHealth
Healthcare is a vast web of interconnected systems consisting of payers, providers, and vendors. It only takes the exploitation of one weak spot to create havoc. Organizations must properly vet all of its partners to ensure each one meets minimum security standards. Where possible, look to unified platforms to minimize the depth and breadth of point-to-point integrations.

Yigal Rozenberg, SVP Technology at Protegrity
In response to increasing cyber threats, healthcare organizations are implementing several measures to strengthen cybersecurity and protect patient data. Key strategies include multi-factor authentication (MFA), end-to-end encryption, regular security assessments, and advanced threat detection. They are adopting Zero Trust Architecture, ensuring cloud security, and segmenting IoT devices. Employee training, data backup, and access control are prioritized, along with network segmentation and vendor risk management. Patch management, mobile device management, compliance monitoring, secure development practices, endpoint detection and response (EDR), and cybersecurity insurance are also critical. These measures collectively enhance cybersecurity posture and safeguard patient data.

John Chenoweth, Chief Product Security Officer at Elekta
The critical mission for cyber security in healthcare is protecting patient data and ensuring continuity of care. To accomplish this, it takes a complete team effort, from device manufacturers to software developers and hospital IT security teams. Guarding the identity of all users with effective multi-factor authentication (MFA), protecting the boundary of the systems, maintaining all software components, and actively monitoring the network are essential steps. Medical device manufacturers must integrate and support these capabilities in their products, while health delivery organizations are responsible for securing the environment.

Dave Bailey, Vice President of Security Services at Clearwater Security
Organizations must implement reasonable and appropriate measures based on the outcome of a comprehensive and on-going risk analysis. It is critical to understand the threats to the organization, the business functions, and the information systems that store, process, and transmit protected health information. The top priorities based on the types of disruptive cyber-attacks include a trained workforce, strong identity protection, endpoint detection and response, and well-rehearsed incident response and recovery playbooks.

Lance Reid, CEO at Telcion
In the current landscape of increasing cyber threats, healthcare organizations must implement multiple layers of security to protect patient data effectively. Crucial measures include multi-factor authentication, advanced email, and DNS security, and employing a third-party SOC/SIEM for 24/7 monitoring of security events. As the sector embraces digital transformation, particularly with connected medical devices and IoT systems, regular vulnerability scanning is essential. These devices should be kept on separate VLANs to limit their interaction with critical on-premise systems. Additionally, ongoing security awareness training for staff is vital. This training should be mandatory, short, and conducted monthly, often including simulated phishing tests to enhance user awareness. These comprehensive strategies are essential for strengthening the cybersecurity posture of healthcare organizations and protecting sensitive information.

Pratik Maroo, Head of Healthcare and Life Sciences at Zensar
The first step is to assess its vulnerabilities and strengths. The second step is prioritizing initiatives to address the gaps, reinforce strengths, and monitor critical external events. The final step is to implement, monitor, and adapt the initiatives and learnings to the resilience and recovery plans, making this an ongoing process. Preparedness, response, and recovery strategies must be meticulously laid out to face any eventuality and to reduce the impact, with patient safety at the forefront of these measures.  These steps can be encapsulated into a robust Information Security Management System (ISMS). A pharma organization should do the following to establish ISMS:

• Establish policies with clear roles and responsibilities
• Identify and assess information security risks
• Implement controls and safeguards to mitigate identified risks and protect information assets
• Develop procedures for detecting and responding/recovering from information security incidents
• Monitor the effectiveness of information security controls through regular reviews and audits
• Ensure compliance with relevant legal, regulatory, and contractual requirements related to information security

Rob Stuart, CEO at Claim.MD
The rising tide of cyber threats in healthcare underscores the critical importance of secure data transmission in claims processing. As healthcare entities strive to meet HIPAA’s privacy and security mandates, they must prioritize evaluating IT vendors not just for functionality but for robust security measures. Medical practices should tailor their IT solutions to their unique needs, ensuring secure connections among systems. This involves assessing vendors’ security protocols, certifications, and the handling of sensitive data. Recent large-scale breaches have demonstrated the risks of relying on a single vendor. In case of a prolonged outage or disruption, providers should prepare a contingency plan to migrate clearinghouses. More important, is the payer’s ability to exchange data from more than one clearinghouse. Having more than one clearinghouse ensures continuity of operations and timely revenue flow even in the event of an industry disruption.

Everyone in the industry has a shared responsibility to maintain security standards, keep health data safe, and keep it moving. Continuous monitoring, regular software maintenance, and updating administrator-level passwords post-implementation are crucial. Moreover, employee training on cybersecurity best practices, including the use of strong passwords and recognizing phishing attempts, is vital to safeguard against cyber threats. Two-factor authentication can further enhance security, helping protect patient data and ensure the financial stability of healthcare organizations.

Bill Olsen, Co-Founder and CTO at UptimeHealth
Organizations should think holistically about the data they are protecting, accessing, and its traceability. Too many times, I see an overemphasis on perimeter protection and keeping the “bad actors” out. While this is important, most data breaches come from the inside. Data should be classified at its origin, with access by level only given to systems and people who require it. If data needs to be shared outside this entitlement chain, for analytics or other business purposes, as an example, then create anonymized versions that protect the data. Do not rely on NDAs or other enforcement mechanisms that can be circumvented. With a strong data access policy in place, implement software and systems to ensure the data is securely delivered. There are many well-proven technologies to secure data transmission, such as SSL. Once this is in place, establish monitoring and prevention mechanisms to detect if a violation occurs.

Jerry Mancini, Senior Director, Office of the CTO at NETSCOUT
First, in the healthcare industry, most investments are made in medical equipment and clinical technology, not in cybersecurity solutions. Moreover, the emphasis in hiring is placed on doctors, nurses, and researchers, not on cybersecurity experts. As a result, many healthcare organizations (especially smaller hospitals, clinics, and doctor’s offices) do not have adequate staff or resources to proactively address cybersecurity. We’ve seen firsthand how that has led to a virtual epidemic in the rise of ransomware and DDoS attacks against healthcare providers in recent years.

All that said, enhancing visibility and compliance through network monitoring is crucial. By understanding activity on the network, IT management teams can better understand and identify abnormal network behavior for analysis. And, when issues are identified early, healthcare IT departments can proactively address vulnerabilities and prevent disruptions, ensuring the continuous operation of critical healthcare systems and the protection of sensitive patient data.

Additionally, as attackers grow in sophistication, healthcare systems must reconsider their security posture. Zero-trust (ZT) architecture was designed to rethink the security paradigm, enabling services that drive digital transformation while also improving organizations’ security posture. ZT principles provide comprehensive protection of digital assets, services, and communications by limiting access and reducing the impact of potential breaches, even if attackers gain initial access. This approach is vital as many healthcare systems currently lack adequate protection against common vulnerabilities and the visibility to identify suspicious and malicious network activity. Investing in these measures is essential to safeguard sensitive patient information and maintain the integrity of healthcare operations in an increasingly vulnerable digital environment.

William Ogle, Senior Director of Governance, Risk, and Compliance at Nordic Consulting
In the face of increasing cyber threats, healthcare organizations are adopting several crucial measures to strengthen cybersecurity and protect patient data, including implementing robust data encryption, employing multi-factor authentication, and utilizing role-based access control to limit data access based on job roles. Regular security audits, vulnerability assessments, and employee training programs are vital to maintaining a strong security posture. Additionally, developing and rigorously testing incident response and disaster recovery plans ensure quick recovery from potential breaches. Other key strategies include network segmentation, advanced endpoint protection, and adherence to a security framework, such as NIST CSF. An emerging practice today is leveraging advanced technologies like AI for threat detection. Hospital organizations will have a different starting point to accomplish this extensive list of controls, but by prioritizing and strategically adopting these comprehensive measures, they can better safeguard sensitive patient information against cyber threats.

Marcus Flack, CTO/Chief Technology Officer at CenTrak
Organizations should implement a range of cybersecurity measures to enhance the protection of healthcare systems and patient data. Related to Real-Time Location Systems (RTLS) specifically, what should customers seek? For me, one of the top priorities should be implementing multifactor authentication (MFA). MFA makes it more difficult for bad agents to access an account and reduces password fatigue and data theft while increasing customer trust. It may not be universally applied, but integrating MFA across all systems is crucial to strengthen access controls.

In addition to MFA, regular risk assessments are another key tool. Conducting regular risk assessments of organization systems helps identify and mitigate potential vulnerabilities. After an assessment, it’s important to follow through with regular patching as necessary and continually monitor the systems. These steps are essential to addressing any assessed vulnerabilities and detecting potential threats early.

Even with the strongest security systems and frequent risk assessments, healthcare organizations must invest in redundant data backups. Maintaining well-replicated and redundant data backups (e.g., using OneDrive) ensures data recovery in case of an attack. If an attack were to occur, segmented networks can limit the spread of threats within an organization, and implementing a structured approach for end-of-life management of systems can prevent the exploitation of any outdated technology.

Finally, one of the most crucial measures organizations must implement is the ongoing development and frequent testing of incident response plans to help teams react effectively to any security breaches. I believe a timely and thoughtful response is key to protecting patient data as well as the overall healthcare system.

Diana Zuskov, MPH, Associate Vice President of Healthcare Strategy & Innovation at LexisNexis Risk Solutions
Increasing cyber threats have led to heightened awareness of the need for more robust controls. We’re seeing healthcare organizations strengthen their identity verification for patients and staff to ensure that only authorized individuals can access patient data. However, organizations must account for the complexities related to access and ‘techquity’ unique to healthcare. Cumbersome processes, such as document authentication, can limit or deter individuals from using digital health tools or messaging their provider through their EHR portal. Organizations should consider modernized, frictionless, digital methods that leverage digital identity and behavioral assessments used in e-commerce and other industries that can authenticate a patient’s identity without creating an additional burden to accessing care.

Cecil Pineda, Senior Vice President and Chief Information Security Officer at R1
Cybersecurity leaders recognize the threat posed to them as well as the tools available to help protect patient information. To protect organizations and their data, cybersecurity leaders are leaning on data security controls like DSPM, DLP, and data security controls. However, this is not enough. Organizations must implement layers upon layers of technologies to fight against advanced adversaries and malware. They must also remember to leverage people and processes to compliment these layers of technology, as it is the strategies in place and the people to execute those strategies that ensure both protection and resolution to this threat.

Mike Donahue, Chief Delivery Officer at CloudWave
As cyberattacks rise in scope and severity, it has become evident that traditional healthcare cybersecurity methods have been ineffective. A significant shift is necessary to combat increasingly sophisticated attacks. For example, to strengthen healthcare systems’ cybersecurity and protect patient data, organizations should implement a patient-centric incident response plan that prioritizes patient care and well-being as the top priority. The plan should ensure that there is no impact on patient care, support and empower staff, proactively address concerns of patient families and friends, and restore and protect IT systems in a way that aligns with clinical guidance and patient care objectives.

Theresa Payton, Founder & CEO at Fortalice Solutions
We have watched as healthcare organizations increasingly adopt multi-layered security frameworks, including advanced encryption, access controls, and regular internally-run and third-party security audits to protect the resiliency and safety of their systems and patient data. Implementing robust incident response plans and fostering a culture of cybersecurity awareness among staff are also critical measures to fortify defenses against cyber threats. If an organization only has time and resources to do one thing in the next six months, I highly recommend practicing a digital disaster scenario via a tabletop exercise (or series of exercises) that impacts the ability to deliver quality healthcare so you can identify any gaps in your response.

Keavy Murphy, Vice President of Security at Net Health
As an industry that handles vast amounts of data, healthcare is particularly vulnerable to security threats. Organizations should operate from a mindset of preparedness, following the Assume Breach Paradigm. This proactive mindset not only prepares teams to respond effectively but also helps mitigate the panic that a sudden breach could cause. Key preparation steps like making sure team members understand their roles, securing cyber insurance, having system recovery methods in place, and identifying a forensics team are crucial for protecting sensitive data and ensuring the privacy of both organizations and patients.

There are so many good suggestions here! Huge thank you to Kayla Underkoffler, Lead Security Technologist at HackerOne, Mark Dill, Chief Information Security Officer at MedAllies, Yuval Wollman, Chief Cyber Officer at UST, Kynan Carver, Managing Director, Cybersecurity Lead at Maximus, Ryan Hamilton, Chief Technology Officer at MacroHealth, Yigal Rozenberg, SVP Technology at Protegrity, John Chenoweth, Chief Product Security Officer at Elekta, Dave Bailey, Vice President of Security Services at Clearwater Security, Lance Reid, CEO at Telcion, Pratik Maroo, Head of Healthcare and Life Sciences at Zensar, Rob Stuart, CEO at Claim.MD, Bill Olsen, Co-Founder and CTO at UptimeHealth, Jerry Mancini, Senior Director, Office of the CTO at NETSCOUT, William Ogle, Senior Director of Governance, Risk, and Compliance at Nordic Consulting, Marcus Flack, CTO/Chief Technology Officer at CenTrak, Diana Zuskov, MPH, Associate Vice President of Healthcare Strategy & Innovation at LexisNexis Risk Solutions, Cecil Pineda, Senior Vice President and Chief Information Security Officer at R1, Mike Donahue, Chief Delivery Officer at CloudWave, Theresa Payton, Founder & CEO at Fortalice Solutions, and Keavy Murphy, Vice President of Security at Net Health for taking the time out of your day to submit a quote! And thank you to all of you for taking the time out of your day to read this article! We could not do this without all of your support.

In this era of increasing cyber threats, what measures do you think organizations are implementing or should be implementing to strengthen their cybersecurity and protect their patient data? Let us know either in the comments down below or over on social media. We’d love to hear from all of you!