Training Your Staff From Becoming a Vulnerability to Your Healthcare Organization

Tragically, no matter how good you are at your job or how long you’ve done the job, human error is simply unavoidable. Just as many songs have stated, no one is perfect – you have made mistakes at your job in the past and you are going to make some in the future. However, that doesn’t mean that we just give up on trying to prevent the mistakes. This is especially important when it comes to the security of your healthcare organization. We all think that we are too good at our jobs and too smart to ever fall for a scam that will open our organization up to cyber criminals, but again – no one is perfect. But with proper and regularly scheduled training, we can minimize these mistakes. But what should that training look like?

We reached out to our brilliant Healthcare IT Today Community to ask them – what can be done to train your staff from becoming a vulnerability to your healthcare organization? The following are their answers.

Cecil Pineda, Senior Vice President and Chief Information Security Officer at R1
People are your best defense (and vulnerability) to an organization. The number one thing an organization can do is provide regular and current education to employees. Help them understand how to identify potential threats and alert IT quickly. Cybersecurity live events, security bulletins, personalized content, prizes (for submitting phishing emails), and implementing a Cybersecurity Champions Program are all tactics I’ve seen employed that increase engagement across staff to help reduce risks, increase awareness, and strengthen a company’s best line of defense.

Bill Murphy, Director of Security & Compliance at LeanTaaS
Hospitals and health systems store vast amounts of sensitive data, and data security breaches have far-reaching consequences. When compromised, a hospital’s capacity for patient care is severely impacted. Critical data such as upcoming appointment schedules, health histories, and treatment plans become inaccessible, drastically slowing care delivery and significantly elevating risks to patients. The human factor remains a top vulnerability in healthcare, necessitating comprehensive security training for staff is crucial.

Doctors, nurses, and administrative staff are the heart of healthcare operations, but they are also extremely busy. Their frequent “multitasking” can turn routine activities like checking their email into security risks. Organizations must ensure their staff fully understands the importance of data privacy, recognizes cybercriminal tactics, and actively participates in mitigating cybersecurity threats. Once ransomware infiltrates a system, the hospital loses much of its capacity to provide patient care. When bed coordination and delivering lab results must be delivered by hand, the entire system slows to a crawl. Inaccessible health histories and treatment plans jeopardize patient safety. During “offline operations,” physicians struggle to prescribe new medications safely or determine unconscious patients’ allergies without electronic records.

The impact of a data breach on an organization’s reputation and bottom line is also profound. Patients who lose confidence in an organization’s ability to protect their data will “vote with their feet” while independent surgeons may choose to practice at hospitals with more reliable systems. The financial ramifications of data security failures, which may take years to calculate, often vastly outweigh the costs of implementing proactive protections.

Mike Donahue, Chief Delivery Officer at CloudWave
To effectively mitigate the impact of a cyberattack, the entire organization must recognize its primary role in safeguarding patients when orchestrating a response. For example, clinical staff should have defined actions to take once a cyberattack is known to be in process (for example, immediately take current vital signs of patients connected to medical devices). To prevent staff from becoming a vulnerability to the healthcare organization, supporting and empowering them during a cyberattack is essential. This includes:

• Addressing their concerns and uncertainties
• Ensuring that everyone is aware of how to respond and can stay focused on patient safety
• Providing training and education on incident response and cybersecurity best practices
• Encouraging a culture of cybersecurity awareness and responsibility among staff members

Marcus Flack, CTO/Chief Technology Officer at CenTrak
Even the most safeguarded team can accidentally run into pitfalls and become a vulnerability to the organization. Training staff to avoid becoming a security vulnerability involves several key practices, beginning with an awareness campaign and educational programs. Conducting regular awareness campaigns helps keep employees informed about cybersecurity threats and best practices. These training sessions should include ongoing education about emerging threats and new security practices, promoting a culture of security within the organization, simulation phishing exercises, and providing incident response drills to prepare staff for real-life security incidents. Additional efforts can include discussions around good password hygiene practices, including the use of strong passwords and MFA. These measures collectively help build a robust cybersecurity posture and reduce the risk of vulnerabilities in healthcare organizations.

William Ogle, Senior Director of Governance, Risk, and Compliance at Nordic Consulting
To train staff and prevent them from becoming a vulnerability to a healthcare organization, several key strategies should be implemented:

• Regular Cybersecurity Training
  • Conduct frequent training sessions on cybersecurity best practices, including recognizing phishing attempts, using strong passwords, and safe internet browsing habits
  • Use interactive and engaging training methods, such as simulations and gamified learning modules, to improve retention and understanding
• Phishing Simulations
  • Run regular phishing simulations to test employees’ ability to identify and report suspicious emails
  • Provide immediate feedback and follow-up training for employees who fall victim to simulated attacks
• Security Policies and Procedures
  • Clearly communicate organizational security policies and procedures to all staff members
  • Ensure employees understand the importance of these policies and how to follow them in their daily activities
• Role-Based Training
  • Tailor training programs to specific roles within the organization, addressing the unique security challenges and responsibilities of each position
  • Include specialized training for high-risk roles, such as IT staff and executives, who may have access to more sensitive information
• Incident Reporting and Response Training
  • Train staff on how to recognize and report security incidents promptly
  • Conduct regular drills to practice the organization’s incident response procedures and ensure staff are prepared to act quickly in the event of a breach
• Security Awareness Campaigns
  • Implement ongoing security awareness campaigns to keep cybersecurity top-of-mind for employees
  • Use posters, newsletters, and intranet resources to reinforce key security messages and updates
• Access Control and Privilege Management
  • Train staff on the principles of least privilege and the importance of accessing only the information necessary for their role
  • Regularly review and adjust access controls to prevent unauthorized access to sensitive data
• Third-Party Risk Management
  • Educate employees on the risks associated with third-party vendors and the importance of adhering to security protocols when interacting with external partners
  • Ensure staff understand the procedures for vetting and managing third-party relationships

Users and staff are critical control points in every information security program as a company’s technical tools can only go so far. Currently, hackers are focusing heavily on social engineering tactics to gain access through email, text, and calls. By implementing these comprehensive training and awareness strategies, healthcare organizations can significantly reduce the risk of staff becoming a vulnerability and enhance their overall cybersecurity posture.

Jerry Mancini, Senior Director, Office of the CTO at NETSCOUT
Today’s healthcare environments are complex, with workers accessing patient-care applications through numerous medical applications across private and public clouds, software as a service, and Wi-Fi, all while using various medical devices. This complexity makes troubleshooting network disruptions challenging and time-consuming. To reduce vulnerabilities from staff, healthcare organizations should conduct regular training and simulated phishing exercises. This training should emphasize recognizing phishing emails, avoiding malicious links, updating passwords, backing up systems, and encrypting data. Strengthening these basic practices helps mitigate risks like security breaches and DDoS attacks.

To minimize the impact of cyber attacks, healthcare organizations need to implement adequate data backup, network segmentation, and recovery programs. Additionally, having a robust DDoS protection plan is essential to avoid DDoS extortion. By training staff effectively and adopting these safeguards, healthcare organizations can significantly reduce the risk of vulnerabilities and enhance their overall security posture.

Pratik Maroo, Head of Healthcare and Life Sciences at Zensar
An internal risk committee should be formed, consisting of the company’s operational leadership team and risk experts, potentially at different levels of the organization. This helps ensure accountability for assessing and managing risk across the company and also updates on the training requirements. The committee should have strong analytic capabilities and access to tools that provide useful data. It’s important to establish strong connections with existing governance forums to secure ownership of risk by functional leaders. To increase transparency, leadership teams should map out production sites, distribution centers, and material flows against potential hazards. To achieve this objective, regular training for employees on Disaster Recovery Plans, roles, and responsibilities is crucial and teaches them to spot any suspicious activities. Additionally, conducting mock drills to assess and improve response is recommended apart from regular email campaigns.

Yuval Wollman, Chief Cyber Officer at UST
Beyond training, continuous education of staff on the latest cyber threats is needed to prevent them from becoming vulnerabilities. For example, employees should be trained to recognize phishing attempts, a common attack vector used in the Change Healthcare attack. Cross-training teams to cover a broad range of skills reduces reliance on key individuals and enhances the overall security posture. This can help ensure that all staff members play a proactive role in maintaining cybersecurity standards.

Ron Moser, CISSP, CISA, CRISC, CCSFP, CHQP, Technical Product Director and Senior Assessor at DirectTrust
In considering how healthcare organizations can better focus on security and privacy, one essential measure is enhancing workforce awareness and training. Every employee has a role in safeguarding patient data, and it’s crucial that they understand the risks and their responsibilities. Organizations should not only provide regular cybersecurity training but also make it engaging and relevant by highlighting the latest real-world threats. For example, examining recent data breaches and other security incidents in our industry can make staff more vigilant and help them recognize the potential dangers of not using standard industry practices like multifactor authentication, or seemingly innocuous actions such as sharing information on social media or not being cautious with email links.

Additionally, it’s vital to communicate not only the incidents but also the causes and vulnerabilities that were exploited. Understanding the specific weaknesses that led to breaches can make the training more impactful and actionable.

This topic also reminds me of a past visit to my doctor, where we discussed the risks of certain medical tests. Just as unnecessary tests can lead to false positives and unnecessary stress, inadequate or misdirected training can create confusion rather than clarity. Effective training should be practical and tailored to the specific needs and vulnerabilities of the organization. Ultimately, this proactive approach helps create a security-conscious culture, where employees are not just complying with rules but actively participating in protecting sensitive information. This awareness is crucial, as bad actors, including those with no moral code, constantly seek to exploit weaknesses. By staying informed and vigilant, the entire workforce can act as a first line of defense against cyber threats.

Theresa Payton, Founder & CEO at Fortalice Solutions
One exemplary healthcare firm I admire emphasizes employee training that begins with teaching staff how to protect their loved ones from cybercrime. This approach naturally transitions into training on cybersecurity best practices to safeguard the organization, including recognizing phishing attempts and securing sensitive information. Regular simulations and drills further reinforce these lessons, ensuring employees are well-prepared to handle potential cyber threats. Providing regular security and privacy training to all employees in the healthcare system is also important. Sometimes, we see only certain segments of the organization being trained; however, it never hurts to spend time educating your entire workforce, from the doctors and nurses to the finance and human resources teams. Everyone can be a target of a cybercriminal.

Yigal Rozenberg, SVP Technology at Protegrity
Training staff to prevent them from becoming a security vulnerability is crucial for healthcare organizations. Organizations must implement a comprehensive and ongoing security awareness program tailored to different roles, incorporating phishing simulations, role-based and hands-on training, and regular updates on emerging threats. Emphasize password management, mobile device security, social engineering awareness, and data handling best practices. Ensure clear incident reporting procedures, physical security awareness, secure communication practices, and third-party risk awareness. It’s also important to engage leadership in promoting cybersecurity, for example, using gamification and incentives to increase engagement, and continuously measure and evaluate the program’s effectiveness.

There is a lot of good advice here! Huge thank you to Cecil Pineda, Senior Vice President and Chief Information Security Officer at R1, Bill Murphy, Director of Security & Compliance at LeanTaaS, Mike Donahue, Chief Delivery Officer at CloudWave, Marcus Flack, CTO/Chief Technology Officer at CenTrak, William Ogle, Senior Director of Governance, Risk, and Compliance at Nordic Consulting, Jerry Mancini, Senior Director, Office of the CTO at NETSCOUT, Pratik Maroo, Head of Healthcare and Life Sciences at Zensar, Yuval Wollman, Chief Cyber Officer at UST, Ron Moser, CISSP, CISA, CRISC, CCSFP, CHQP, Technical Product Director and Senior Assessor at DirectTrust, Theresa Payton, Founder & CEO at Fortalice Solutions, and Yigal Rozenberg, SVP Technology at Protegrity for taking the time out of your day to submit a quote! And thank you to all of you for taking the time out of your day to read this article! We could not do this without all of your support.

What do you think can be done to train your staff from becoming a vulnerability to your healthcare organization? Let us know either in the comments down below or over on social media. We’d love to hear from all of you!

Tragically, no matter how good you are at your job or how long you’ve done the job, human error is simply unavoidable. Just as many songs have stated, no one is perfect – you have made mistakes at your job in the past and you are going to make some in the future. However, that doesn’t mean that we just give up on trying to prevent the mistakes. This is especially important when it comes to the security of your healthcare organization. We all think that we are too good at our jobs and too smart to ever fall for a scam that will open our organization up to cyber criminals, but again – no one is perfect. But with proper and regularly scheduled training, we can minimize these mistakes. But what should that training look like?

We reached out to our brilliant Healthcare IT Today Community to ask them – what can be done to train your staff from becoming a vulnerability to your healthcare organization? The following are their answers.

Cecil Pineda, Senior Vice President and Chief Information Security Officer at R1
People are your best defense (and vulnerability) to an organization. The number one thing an organization can do is provide regular and current education to employees. Help them understand how to identify potential threats and alert IT quickly. Cybersecurity live events, security bulletins, personalized content, prizes (for submitting phishing emails), and implementing a Cybersecurity Champions Program are all tactics I’ve seen employed that increase engagement across staff to help reduce risks, increase awareness, and strengthen a company’s best line of defense.

Bill Murphy, Director of Security & Compliance at LeanTaaS
Hospitals and health systems store vast amounts of sensitive data, and data security breaches have far-reaching consequences. When compromised, a hospital’s capacity for patient care is severely impacted. Critical data such as upcoming appointment schedules, health histories, and treatment plans become inaccessible, drastically slowing care delivery and significantly elevating risks to patients. The human factor remains a top vulnerability in healthcare, necessitating comprehensive security training for staff is crucial.

Doctors, nurses, and administrative staff are the heart of healthcare operations, but they are also extremely busy. Their frequent “multitasking” can turn routine activities like checking their email into security risks. Organizations must ensure their staff fully understands the importance of data privacy, recognizes cybercriminal tactics, and actively participates in mitigating cybersecurity threats. Once ransomware infiltrates a system, the hospital loses much of its capacity to provide patient care. When bed coordination and delivering lab results must be delivered by hand, the entire system slows to a crawl. Inaccessible health histories and treatment plans jeopardize patient safety. During “offline operations,” physicians struggle to prescribe new medications safely or determine unconscious patients’ allergies without electronic records.

The impact of a data breach on an organization’s reputation and bottom line is also profound. Patients who lose confidence in an organization’s ability to protect their data will “vote with their feet” while independent surgeons may choose to practice at hospitals with more reliable systems. The financial ramifications of data security failures, which may take years to calculate, often vastly outweigh the costs of implementing proactive protections.

Mike Donahue, Chief Delivery Officer at CloudWave
To effectively mitigate the impact of a cyberattack, the entire organization must recognize its primary role in safeguarding patients when orchestrating a response. For example, clinical staff should have defined actions to take once a cyberattack is known to be in process (for example, immediately take current vital signs of patients connected to medical devices). To prevent staff from becoming a vulnerability to the healthcare organization, supporting and empowering them during a cyberattack is essential. This includes:

• Addressing their concerns and uncertainties
• Ensuring that everyone is aware of how to respond and can stay focused on patient safety
• Providing training and education on incident response and cybersecurity best practices
• Encouraging a culture of cybersecurity awareness and responsibility among staff members

Marcus Flack, CTO/Chief Technology Officer at CenTrak
Even the most safeguarded team can accidentally run into pitfalls and become a vulnerability to the organization. Training staff to avoid becoming a security vulnerability involves several key practices, beginning with an awareness campaign and educational programs. Conducting regular awareness campaigns helps keep employees informed about cybersecurity threats and best practices. These training sessions should include ongoing education about emerging threats and new security practices, promoting a culture of security within the organization, simulation phishing exercises, and providing incident response drills to prepare staff for real-life security incidents. Additional efforts can include discussions around good password hygiene practices, including the use of strong passwords and MFA. These measures collectively help build a robust cybersecurity posture and reduce the risk of vulnerabilities in healthcare organizations.

William Ogle, Senior Director of Governance, Risk, and Compliance at Nordic Consulting
To train staff and prevent them from becoming a vulnerability to a healthcare organization, several key strategies should be implemented:

• Regular Cybersecurity Training
  • Conduct frequent training sessions on cybersecurity best practices, including recognizing phishing attempts, using strong passwords, and safe internet browsing habits
  • Use interactive and engaging training methods, such as simulations and gamified learning modules, to improve retention and understanding
• Phishing Simulations
  • Run regular phishing simulations to test employees’ ability to identify and report suspicious emails
  • Provide immediate feedback and follow-up training for employees who fall victim to simulated attacks
• Security Policies and Procedures
  • Clearly communicate organizational security policies and procedures to all staff members
  • Ensure employees understand the importance of these policies and how to follow them in their daily activities
• Role-Based Training
  • Tailor training programs to specific roles within the organization, addressing the unique security challenges and responsibilities of each position
  • Include specialized training for high-risk roles, such as IT staff and executives, who may have access to more sensitive information
• Incident Reporting and Response Training
  • Train staff on how to recognize and report security incidents promptly
  • Conduct regular drills to practice the organization’s incident response procedures and ensure staff are prepared to act quickly in the event of a breach
• Security Awareness Campaigns
  • Implement ongoing security awareness campaigns to keep cybersecurity top-of-mind for employees
  • Use posters, newsletters, and intranet resources to reinforce key security messages and updates
• Access Control and Privilege Management
  • Train staff on the principles of least privilege and the importance of accessing only the information necessary for their role
  • Regularly review and adjust access controls to prevent unauthorized access to sensitive data
• Third-Party Risk Management
  • Educate employees on the risks associated with third-party vendors and the importance of adhering to security protocols when interacting with external partners
  • Ensure staff understand the procedures for vetting and managing third-party relationships

Users and staff are critical control points in every information security program as a company’s technical tools can only go so far. Currently, hackers are focusing heavily on social engineering tactics to gain access through email, text, and calls. By implementing these comprehensive training and awareness strategies, healthcare organizations can significantly reduce the risk of staff becoming a vulnerability and enhance their overall cybersecurity posture.

Jerry Mancini, Senior Director, Office of the CTO at NETSCOUT
Today’s healthcare environments are complex, with workers accessing patient-care applications through numerous medical applications across private and public clouds, software as a service, and Wi-Fi, all while using various medical devices. This complexity makes troubleshooting network disruptions challenging and time-consuming. To reduce vulnerabilities from staff, healthcare organizations should conduct regular training and simulated phishing exercises. This training should emphasize recognizing phishing emails, avoiding malicious links, updating passwords, backing up systems, and encrypting data. Strengthening these basic practices helps mitigate risks like security breaches and DDoS attacks.

To minimize the impact of cyber attacks, healthcare organizations need to implement adequate data backup, network segmentation, and recovery programs. Additionally, having a robust DDoS protection plan is essential to avoid DDoS extortion. By training staff effectively and adopting these safeguards, healthcare organizations can significantly reduce the risk of vulnerabilities and enhance their overall security posture.

Pratik Maroo, Head of Healthcare and Life Sciences at Zensar
An internal risk committee should be formed, consisting of the company’s operational leadership team and risk experts, potentially at different levels of the organization. This helps ensure accountability for assessing and managing risk across the company and also updates on the training requirements. The committee should have strong analytic capabilities and access to tools that provide useful data. It’s important to establish strong connections with existing governance forums to secure ownership of risk by functional leaders. To increase transparency, leadership teams should map out production sites, distribution centers, and material flows against potential hazards. To achieve this objective, regular training for employees on Disaster Recovery Plans, roles, and responsibilities is crucial and teaches them to spot any suspicious activities. Additionally, conducting mock drills to assess and improve response is recommended apart from regular email campaigns.

Yuval Wollman, Chief Cyber Officer at UST
Beyond training, continuous education of staff on the latest cyber threats is needed to prevent them from becoming vulnerabilities. For example, employees should be trained to recognize phishing attempts, a common attack vector used in the Change Healthcare attack. Cross-training teams to cover a broad range of skills reduces reliance on key individuals and enhances the overall security posture. This can help ensure that all staff members play a proactive role in maintaining cybersecurity standards.

Ron Moser, CISSP, CISA, CRISC, CCSFP, CHQP, Technical Product Director and Senior Assessor at DirectTrust
In considering how healthcare organizations can better focus on security and privacy, one essential measure is enhancing workforce awareness and training. Every employee has a role in safeguarding patient data, and it’s crucial that they understand the risks and their responsibilities. Organizations should not only provide regular cybersecurity training but also make it engaging and relevant by highlighting the latest real-world threats. For example, examining recent data breaches and other security incidents in our industry can make staff more vigilant and help them recognize the potential dangers of not using standard industry practices like multifactor authentication, or seemingly innocuous actions such as sharing information on social media or not being cautious with email links.

Additionally, it’s vital to communicate not only the incidents but also the causes and vulnerabilities that were exploited. Understanding the specific weaknesses that led to breaches can make the training more impactful and actionable.

This topic also reminds me of a past visit to my doctor, where we discussed the risks of certain medical tests. Just as unnecessary tests can lead to false positives and unnecessary stress, inadequate or misdirected training can create confusion rather than clarity. Effective training should be practical and tailored to the specific needs and vulnerabilities of the organization. Ultimately, this proactive approach helps create a security-conscious culture, where employees are not just complying with rules but actively participating in protecting sensitive information. This awareness is crucial, as bad actors, including those with no moral code, constantly seek to exploit weaknesses. By staying informed and vigilant, the entire workforce can act as a first line of defense against cyber threats.

Theresa Payton, Founder & CEO at Fortalice Solutions
One exemplary healthcare firm I admire emphasizes employee training that begins with teaching staff how to protect their loved ones from cybercrime. This approach naturally transitions into training on cybersecurity best practices to safeguard the organization, including recognizing phishing attempts and securing sensitive information. Regular simulations and drills further reinforce these lessons, ensuring employees are well-prepared to handle potential cyber threats. Providing regular security and privacy training to all employees in the healthcare system is also important. Sometimes, we see only certain segments of the organization being trained; however, it never hurts to spend time educating your entire workforce, from the doctors and nurses to the finance and human resources teams. Everyone can be a target of a cybercriminal.

Yigal Rozenberg, SVP Technology at Protegrity
Training staff to prevent them from becoming a security vulnerability is crucial for healthcare organizations. Organizations must implement a comprehensive and ongoing security awareness program tailored to different roles, incorporating phishing simulations, role-based and hands-on training, and regular updates on emerging threats. Emphasize password management, mobile device security, social engineering awareness, and data handling best practices. Ensure clear incident reporting procedures, physical security awareness, secure communication practices, and third-party risk awareness. It’s also important to engage leadership in promoting cybersecurity, for example, using gamification and incentives to increase engagement, and continuously measure and evaluate the program’s effectiveness.

There is a lot of good advice here! Huge thank you to Cecil Pineda, Senior Vice President and Chief Information Security Officer at R1, Bill Murphy, Director of Security & Compliance at LeanTaaS, Mike Donahue, Chief Delivery Officer at CloudWave, Marcus Flack, CTO/Chief Technology Officer at CenTrak, William Ogle, Senior Director of Governance, Risk, and Compliance at Nordic Consulting, Jerry Mancini, Senior Director, Office of the CTO at NETSCOUT, Pratik Maroo, Head of Healthcare and Life Sciences at Zensar, Yuval Wollman, Chief Cyber Officer at UST, Ron Moser, CISSP, CISA, CRISC, CCSFP, CHQP, Technical Product Director and Senior Assessor at DirectTrust, Theresa Payton, Founder & CEO at Fortalice Solutions, and Yigal Rozenberg, SVP Technology at Protegrity for taking the time out of your day to submit a quote! And thank you to all of you for taking the time out of your day to read this article! We could not do this without all of your support.

What do you think can be done to train your staff from becoming a vulnerability to your healthcare organization? Let us know either in the comments down below or over on social media. We’d love to hear from all of you!