Agencies, Practices Grapple With Increased Health Care Cybersecurity Threats

Heightened preparedness

Following the Change Healthcare cyberattack, the IT staff at NANI made several adaptations, Udani said. Previously, he and other physicians could log onto the system from any location or device. Now, they are required to conduct work only on practice-issued computers from a secure location. If they access patient records from a nonsecure location outside of a hospital, they are required to use a virtual private network, or VPN, to protect data from being intercepted. The practice is also instituting cybersecurity courses for staff to maintain compliance and periodically sending test emails with suspicious links to assess their savvy in recognizing potential spam. Steps like these are among a number of procedures that medical offices can adopt to protect patient data, say experts interviewed for this article. It starts with user education.

Most breaches occur as a result of an employee unwittingly responding to a phishing request (a scam in which attackers deceive people into revealing sensitive information), said Emily Jones, principal practice leader for the Warren Averett Technology Group, an IT consulting firm in Montgomery, AL. “People don't necessarily have ill intent, but they don't realize that what they just clicked on in a phishing email or something they just downloaded actually was malware [malicious software],” she said.

Generative artificial intelligence programs often used by hackers to send phishing emails are getting more sophisticated and more difficult to detect, said Chris Callahan, chief of cybersecurity for the Cybersecurity and Infrastructure Security Agency (CISA) Region 10, which covers the Pacific Northwest. CISA is a federal agency that helps protect the country from cyberattacks and other threats. “We used to say, ‘Oh, look at the language,’ because it might be a little bit off, but now they’re doing a really good job with that,” Callahan warns. “Don't click on any attachments or any links within a suspicious-looking email.”

ASPR released a list in January of voluntary health care-specific cybersecurity performance goals (https://hphcyber.hhs.gov/performance-goals.html) and a new website (https://hphcyber.hhs.gov/) to help health care organizations prioritize implementation of high-impact cybersecurity practices. It includes 10 essential goals, such as mandating basic cybersecurity training for staff and using strong encryption to share sensitive data, as well as 10 enhanced goals, including establishing processes to discover and respond to known threats, Mazanec explained. “They were developed to try to demystify the multiple, more complicated sets of best practices that exist,” he said. “We recognize that small clinics and underresourced rural hospitals don't have dedicated cybersecurity teams.”

Jones suggests four key steps that organizations of any size can take:

1. Educate. Educate all employees who work for your practice about cybersecurity practices, and repeat it frequently.

2. Maintain infrastructure. Keep up to date on all software patches for your devices and servers.

3. Create a disaster recovery plan and backup procedures to operate in downtime. “It's not if you’re breached, it's when you’re breached,” said Jones, “and when you’re breached, you definitely don't want to be without some type of plan.” Ensure all employees know where to find your plan and are able to work to the best of their abilities.

4. Test your systems. Testing should be thorough and frequent. “There are various types: backup and recovery testing, security assessments, vulnerability scanning, and penetration testing that can give you a clear picture of your practice's security footprint,” Jones said. CISA and other cybersecurity companies perform such services, looking for vulnerabilities in need of patching.

Additionally, Jones advises that employees use complex passwords and are prohibited from using the same passwords for personal and work-related devices. Organizations should use multifactor authentication to verify users allowed onto the network, and they should establish separate wireless networks for patient versus business use. In testing scenarios, Jones has seen computer-savvy individuals sit in an organization's lobby and gain access to accounting and employee records.

Breach response

Through a free service called the Pre-Ransomware Notification Initiative (3), CISA representatives can monitor networks at small- to medium-sized medical practices and alert them if it finds malware on their system, so the practice can fix the problem. The challenge is that a breach will often occur after hours or on a weekend, Callahan said, and contacting the appropriate IT person or third-party vendor can take time.

If you are impacted by a breach, disconnect your system, and do not panic, he said. Report the breach to CISA by emailing report@cisa.gov, calling 1-844-say-CISA, or filling out an incident report online at https://www.cisa.gov/report. Also, contact your attorney if you have cybersecurity insurance. CISA can keep your identification anonymous while still alerting others about the breach as well as trends that it may observe. There may be other state oversight or Health Insurance Portability and Accountability Act-related regulations that CISA or an attorney can help you understand.

Should you pay a ransom? The federal government advises against it, Callahan said. “But at the end of the day, it's a business decision that has to be made within these organizations.” Even if the attackers provide a decryption key, it is likely that they already have copied patient information like birth dates or Social Security numbers that could be sold on the dark web, Jones cautioned.

Do not be ashamed if a breach occurs, Callahan added. Some organizations do not want to talk about cyberattacks, but by sharing information, they can help protect others.