A Fresh Approach to Safeguarding Healthcare Data

The following is a guest article by Andrea Hopkins, Chief Information Security Officer at Juno Health

Think about what’s in your own health records for a moment: your name, address, Social Security number, insurance information—not to mention diagnoses. Personal health information is a prime target for cyberattacks because there are many ways bad actors can misuse it.

It’s a big deal when a healthcare organization’s cybersecurity is breached because attackers can steal patients’ identities, hijack their insurance info, or worse. A recent attack against Ascension resulted in medication errors, delayed and lost lab tests, and chaotic daily procedures with sometimes fatal results.

Healthcare organizations may face countless cybersecurity challenges, but yours can rise to meet them by implementing multiple layers of security to safeguard critical systems. Research how cybersecurity can go sideways across the healthcare ecosystem and the top measures that you can use to course-correct as needed.

Where Healthcare Institutions Can Go Wrong in Their Cybersecurity Journey

Cybersecurity isn’t exactly second nature to healthcare executives, so the initial execution is often lacking. C-suites often don’t understand the risks or importance of cybersecurity, but you can’t afford to push it aside.

The biggest mistake has dollar signs attached. Organizations often operate on shoestring budgets, running critical systems with a small team and few tools. Good for your spreadsheets? Maybe, but it can be disastrous and very expensive for patients and operations if a breach occurs. Cut corners on stationery but make cybersecurity an ongoing investment.

Navigating the Most Common Healthcare Cyberattacks

Above all other risks—such as malware and phishing—ransomware impacts healthcare organizations the most. Attackers hold your data hostage until you acquiesce to their payment demands, with some even selling the data on the dark web.

Stealing healthcare data in this way and monetizing or using it for extortion has ballooned out of control, with at least a dozen hospitals dealing with ransomware at any given time. Recovery is an ongoing issue, impacting organizations and patients alike:

Clinicians cannot access records during care
Attackers using patients’ insurance create inaccurate medical records, increase rates, or incur medical debt
Hospitals face lawsuits, loss of accreditation, and reputational damage

4 Keys to Implementing Effective Cybersecurity

As the saying goes, “You’re only as strong as your weakest link.” This holds true in cybersecurity, where if one person misuses their access or gets careless, your house of cards can come tumbling down.

Your whole organization has a role to play. The C-suite—especially the chief information security officer—must work closely with cybersecurity teams to stay informed and support investments. Incorporate diverse strategies to improve cybersecurity, including:

Zero-Trust

A zero-trust fabric is your blank slate, starting every person and system at square one. With it, your cybersecurity is configured in such a way that no devices, users, or applications are inherently trusted. Zero-trust is most effective as part of a layered defense strategy, starting with securing the electronic health record (EHR) platform and extending outward.

Training

Help staff learn by doing. Implement regular cybersecurity training to help teams understand and recognize external and insider threats and reinforce secure behavior. Your established policies must define acceptable behavior and outline consequences for violations to ensure accountability.

Technologies and Systems

Because healthcare environments rely on a wide range of connected devices—including EHRs, blood gas analyzers, and prescription dispensers—cybersecurity requires careful planning. Instead of putting the burden on one tool, create redundancies in your security measures. Start with key measures and build on them as necessary:

Conduct regular audits
Maintain up-to-date software
Implement continuous monitoring

For a little extra reassurance, lean on cloud-based systems to minimize the scope of local vulnerabilities.

Outsourcing

Smaller organizations in particular often try to manage everything in-house with limited staff, juggling constraints related to capacity and expertise. The alternative? Outsourcing to specialists or contractors. These experts can save you time and money, configuring cybersecurity systems more efficiently than your busy internal team can.

Lock Down Your Organization with a Fully Defined Cybersecurity Strategy

Commitment to cybersecurity in the healthcare industry is lagging behind—in large part due to financial constraints and lack of understanding. But you can change this and see your organization through to a safer future! Put your foot down in the face of threats such as ransomware by implementing proven measures, such as zero-trust and updated systems.

As you develop your strategy, prioritize EHR safety by choosing a HIPAA-, HITECH-, and FedRAMP-certified EHR. Look for a vendor that demonstrates an eye toward cybersecurity by having robust security measures in place and explore their audit process for further reassurance.

About Andrea Hopkins

Andrea Hopkins is the Chief Information Security Officer at Juno Health and has worked in the IT and cybersecurity fields, primarily in healthcare, for more than 30 years. She has supported DoD, civilian, and international clients and is a subject matter expert in secure infrastructure solution design, ITIL-based management approaches, full S-SDLC solution development and support, and risk management and business strategies in addition to cybersecurity. Personally, Andrea enjoys outdoor activities such as camping, hiking, and diving. She is a board member and singer with the Choral Society of the Palm Beaches and is passionate about animal welfare, children’s causes, veterans’ advocacy, and environmental causes.