A new report published by Censinet, KLAS Research, the American Hospital Association, Health-IASAC, and the Healthcare and Public Health Sector Coordinating Council has revealed insights into the current state of cybersecurity preparedness within the healthcare sector. The report, compiled through a survey conducted in November 2023, involved executives and cybersecurity professionals from various healthcare subsectors, including providers, pharma, payers, medical device manufacturers, and health IT. The survey, which received responses from 396 individuals, aimed to identify the top cybersecurity concerns facing healthcare organizations in both 2023 and 2024. Key findings from the survey highlight persistent and emerging threats, as well as notable trends in cybersecurity preparedness within the healthcare industry.
One alarming trend revealed by the report is the increasing frequency and severity of cyber-attacks targeting healthcare organizations. Analysis of data from the Department of Health and Human Services Office for Civil Rights (OCR) shows a staggering increase in data breaches affecting protected health information (PHI). Over the past 13 years, the OCR website has listed 5,558 breach events, compromising nearly 438 million PHI records. What is particularly concerning is the accelerating rate of incidents, with 2,209 reported in the last three years alone, compared to 3,349 incidents in the preceding 10 years. The survey also highlights the evolving nature of cybersecurity threats, with ransomware attacks emerging as a predominant concern for healthcare organizations. Executives across the sector identified ransomware deployments as the top cybersecurity threat going into 2024, reflecting the growing frequency and impact of these attacks on patient care and safety. The report emphasizes the detrimental effects of ransomware attacks on healthcare delivery, citing instances of ambulance diversions, canceled surgeries, and delayed treatments due to the unavailability of electronic medical records.
The report also examines the mechanisms behind ransomware attacks, noting the rise of Ransomware-as-a-Service (RaaS) groups that facilitate and monetize these malicious activities. These groups, such as Lockbit 3.0, ALPHV/BlackCat, and Cl0p, target healthcare entities with a clear understanding of the sector’s vulnerabilities and the potential impact of ransomware on patient care. The report emphasizes the need for collaborative efforts among healthcare stakeholders to combat these threats effectively. The report notes other cybersecurity challenges facing healthcare organizations, including phishing/spear phishing attacks, data breaches, and third-party/partner breaches. It highlights the importance of comprehensive cybersecurity strategies, investment in advanced threat detection and response capabilities, and ongoing collaboration to mitigate risks and enhance resilience.
The report emphasizes the urgent need for healthcare organizations to embrace innovative cybersecurity measures while prioritizing data security, governance, and responsible application. It advocates for the adoption of integrated solutions with SOAR capabilities to improve operational efficiency and mitigate risks. Modernizing defense mechanisms by transitioning to XDR platforms is highlighted, alongside prioritizing data protection through robust asset management and access controls. Leveraging cloud-based solutions, securing APIs, and exploring emerging architectures like SASE, CASB, DLP, and CAASM are recommended to address evolving threats effectively. Continuous evaluation, adaptation, and proactive defense strategies are highlighted by the report as necessary to stay ahead of emerging threats and safeguard healthcare systems and sensitive data.
The insights provided by the report serve as a valuable resource for identifying emerging threats, prioritizing cybersecurity initiatives, and building a robust defense posture against cyber-attacks. By proactively addressing cybersecurity challenges, healthcare organizations can mitigate risks, uphold patient trust, and safeguard the integrity of healthcare delivery in the modern digital health sector.