Please support Telehealth.org’s ability to deliver helpful news, opinions, and analyses by turning off your ad blocker. A March 21, 2022 statement from the US Whitehouse was entitled, Statement by President Biden on our Nation’s Cybersecurity, pointing to possible Russian-backed hackers. The President’s statement reads, in part:
This is a critical moment to accelerate our work to improve domestic cybersecurity and bolster our national resilience. I have previously warned about the potential that Russia could conduct malicious cyber activity against the United States, including as a response to the unprecedented economic costs we’ve imposed on Russia alongside our allies and partners. It’s part of Russia’s playbook. Today, my Administration is reiterating those warnings based on evolving intelligence that the Russian Government is exploring options for potential cyberattacks.
In response to Russian and other cyber threats, organizations across the country and the globe are considering how to optimize healthcare cybersecurity because of the many ways that protected health information (PHI) can be compromised. To stay abreast of this growing number of cyberthreats, the Office for Civil Rights (OCR) has issued a public Request for Information (RFI) asking for commentary from the healthcare community to clarify best practices that require attention. The OCR is the US federal office charged with maintaining healthcare cybersecurity and is the enforcement arm of HIPAA.
Healthcare Cybersecurity
The healthcare sector faces several challenges in the race against cybercriminals to improve cybersecurity. Three particular challenges in health information technology (IT) include increasingly complex technology, chronic staff shortages, and ongoing remote work. Concerning increasingly complex health IT systems, many hospitals, agencies, clinics, group practices, and independent practitioners haven’t yet invested in adequately-sophisticated healthcare cybersecurity systems. Instead, they rely on manually managed, labor-intensive processes that often are engaged in the chaos of a cybersecurity attack.
A general shortage of IT staff only exacerbates the issue. All too often, healthcare groups needing IT staff often use temporary employees from outside agencies. This is particularly true in times of emergency related to a system-wide hacking, a ransomware attack, or other broad-scale service interruption. Using IT professionals from outside agencies in times of emergency is expensive. It leaves the group open to human error as temporary staff may not have the depth of knowledge to manage the system properly. Then, existing IT staff are also overburdened with the need for frequent on and offboarding of these temporary workers.
As remote work has increased, so has the need for IT services across industries. The healthcare industry competes with many other growing industries for scarce IT resources. Remote work has also increased the complexity and surface vulnerability of IT systems. Remote employees access systems from computers and networks outside the hospital walls, further challenging security protocols and technologies. Many organizations also are required to allow access to technology suppliers, who add another level of vulnerability to the system. Under these circumstances, healthcare cybersecurity must be re-evaluated by all healthcare systems and professionals to protect their systems.
Other Cyber Authorities
John Riggi, the American Hospital Association’s (AHA) national advisor for cybersecurity and risk, said, “This multi-agency, multi-nation advisory highlights what I refer to as the ‘Russian hybrid cyber threat’ — criminal hacking groups that are ideologically aligned with the Russian government or operating under their safe harbor. These criminal groups may be poised to conduct disruptive or destructive cyberattacks targeting the Western critical infrastructure either independently or at the direction of the Russian government and military.”
Cybersecurity Solutions for Ransomware Attacks and Other Cyber Threats
On April 20, 2022, based on the latest threat intelligence, cybersecurity authorities in the United States, Australia, Canada, New Zealand, and the United Kingdom urged critical infrastructure organizations to protect against potential malware, ransomware, and other cyber threats from the Russian government and associated cybercrime groups. They advised organizations to “patch all systems, enforce multifactor authentication, secure and monitor Remote Desktop Protocol and other risky services, and provide end-user awareness and training.”
These three approaches are some of the most readily implemented cybersecurity solutions for groups to consider.
- Immutable backups protect against cybercrime. Increasingly, there is a need for immutable backups with separate cybersecurity systems. An immutable backup prevents edits and deletes by storing data separately using protocols that are clean and easily capable of restoration. Some hackers are known to target backups because they know that a backup is the organization’s best chance of quickly restoring the system. Without an immutable backup, restoring a system from corrupt files might be necessary. An immutable backup allows for the swift recovery of files and a return to work. Many insurers will insist on immutable backups in the future. They offer the most assured route to escape a ransomware payment when other healthcare cybersecurity fails.
- Proactive healthcare cybersecurity through AI innovation and AI automation. Many healthcare organizations still use reactive technologies to prevent cybercrime. Yet, artificial intelligence (AI) can predict security problems and quickly solve them. AI innovation technologies can help to overcome staff shortages. AI automation can scan the system and produce exception reports to draw attention to cybersecurity problems before they occur and as they occur.
- Healthcare cybersecurity through cloud technology. Cloud technology can offer security advances that a healthcare group might not otherwise afford. Proactive, automated cloud systems help prevent cybercrime by offering the necessary scalability to navigate an increasingly complex world.
Gearing Up Your Cybersecurity in 2022
Healthcare cybersecurity will become increasingly important as the complexity of IT networks rise and the incidence of cybercrime continues to grow. There are many options for the cyber-savvy IT manager or clinician to improve their cybersecurity protections. Immutable backups, AI innovation and AI automation can search for and prevent threats, and cloud solutions can make healthcare cybersecurity more affordable. These healthcare cybersecurity solutions are designed to prevent cybercrime or recover from a cyber threat.
If you seek documentation as to your efforts to improve your healthcare cybersecurity, you may want to consider Telehealth.org’s 1-hour webinar, HIPAA Compliant Cybersecurity for Professionals. The webinar program includes 1 CME or CE credit hour.
HIPAA Compliant Cybersecurity for Professionals
Must-know information about how to protect your telehealth practice from a ransomware attack. Operate w/ EYES WIDE OPEN.
