Disruptions in recent years have shown how vulnerable medical devices and services are to cybersecurity threats that can endanger patient health, safety, and privacy. In fact, experts have recently concluded that healthcare is one of only two distinctly vulnerable sectors in the face of ransomware attacks. The other is manufacturing, which places our complex industry in the crosshairs and demands a concerted focus on cybersecurity.
What are the Dangers to Medical Information Security?
Information security is of utmost importance in general, and even more so in the healthcare industry. Without proper security education and measures in place, the convenience and ease of process we offer throughout the industry can also be our weakness. Any guest, patient, or staff device connecting to an organization’s network is a potential gateway for digital infection.
Human error, security complacency, and technical deficiencies are the most common ways in which our guard is too low to prevent a digital security breach, also referred to as a “cyber-attack.” This can be a hack that covertly identifies and retrieves confidential patient, organization, or manufacturer information and is only uncovered after some time, if at all. However, in most recent cases the breach has been what is referred to as a “ransomware attack,” whereby malicious software is covertly installed and activated in a way that blocks the use of medical devices and networks and holds access hostage in return for ransom.
Why are Medical Devices Likely Targets for Cyber Attacks?
One of the key reasons that make healthcare and manufacturing disproportionately susceptible to breaches of cyber security is that they both have a very low tolerance to disruption. Moreover, as medical devices become more advanced, they are increasingly connected to the internet, hospital networks, mobile phones, and other such portals, to share information most efficiently.
As such, the value of medical data continues to rise, which makes it an increasingly lucrative target for ransomware attackers. The massive shift to telemedicine over the past couple of years — although a highly efficient and beneficial improvement to delivering U.S. health care — has not been concurrent with sufficient cybersecurity control.
Healthcare disruption first and foremost results in loss of access to patient data and vital medical technology. This holds targeted medical institutions in a delicate position wherein they cannot choose a standoff that may cost lives.
Without proper consideration for and investment in cybersecurity advances, digitalization can act as a double-edged sword.
Top 3 Essential Defensive Investments: Training, Upgrades, Backups
These three key elements may feel too basic to mention, but the reality is that the great majority of digital security breaches are facilitated by a lack of proper staff training regarding secure web browsing while using the organization’s network, such as:
- Caution around free program downloads
- Correct identification of phishing email
- Accessing compromised websites
- Exposure to “malvertising” (infected advertisements displayed on legitimate websites)
- Using outdated browsers, network platforms, or hardware that are not up-to-date on the latest security patches
It is important that you do not underestimate the value of an in-house or contracted specialized technical assistance and training staff. Much like a medical stitch in time saves nine, the effectiveness of proactive investment in digital security training cannot be overstated. Dedicated training teams that are up to date on the relevant literature and routinely run digital safety training for all staff, as well as regularly test training comprehension and defensive reflexes of any and all employees that use any devices connected to the network you should be safeguarding.
Similarly, it is never too early to invest in the dedicated technical staff that routinely verifies the information integrity of all your organization’s access points, as well as ensures that all technical gateways are up to date with their respective software versions and security patches.
Safeguarded, uncompromised backups are also increasingly essential to consider. This lapse in healthcare information infrastructure is one of the main reasons why ransomware attacks are lucrative enough to proliferate. When an organization is blocked from using critical care tools unless a ransom is paid, more often than not it pays to regain access because there is no safe backup to turn to. Consider rather, that it pays to invest in a multi-layered information security infrastructure that is properly guarded, updated, and sufficiently easy to access in critical situations.
There is No Master Key to Digital Security – it’s a Team Effort
It is important to acknowledge that, while preventing attacks altogether is almost impossible at this time, a significant drive to shore up defenses can make a big difference across the board. Our increased interconnectedness means any element can be a target or a conduit, from medical software solutions providers to device manufacturers, health care institutions, administrative services firms, security researchers, government regulating bodies, and other agencies. Equally, the entire system is stronger against an attack when each piece puts in the work to reduce the risks.
A broad approach to digital security includes ways to deter intrusions, disrupt attacks as they are happening, as well as prepare all susceptible parties to anticipate and minimize the effects of any disruption.
Rigorous Testing, Early Disclosure & Scaled Up Educational Efforts Improve Everyone’s Safety
It is essential that manufacturers and software developers monitor and assess cybersecurity vulnerability risks, and that they are open and proactive about disclosing suspected weaknesses and research solutions to address them.
Guidelines provided by agencies such as the U.S. Food and Drug Administration, which regulates medical devices, do an okay job of covering some of the basics of digital safety education. However, collaborative initiatives from private enterprises and early vulnerability disclosure can vastly improve the educational standard and the speed with which it can be employed for a wider, better understanding of how to avoid digital security pitfalls.
Ultimately, we must not fear the great technological progress that we can achieve. Rather, we need only ensure that we take every possible timely measure to uphold and support it.
