Healthcare companies are using electronic records and tapping digital services more than ever. That is also creating more opportunities for cybercriminals, who already have exposed the private medical information of millions of patients and bolsters the case for the industry to make security priority No. 1, experts say. Healthcare breaches have exposed 385 million patient records from 2010 to 2022, federal records show, though individual patient records could be counted multiple times.
Hacking incidents, a type of breach, at healthcare firms have skyrocketed in the past five years as cybercriminals demand ransoms in exchange for restoring access to sensitive medical data.[1]
While healthcare companies have to improve their cybersecurity given the rise in breaches and cyberattacks, regulators need to raise the bar on cybersecurity standards, experts told Healthcare Dive. “Could all these organizations do a better job? Absolutely,” said the former assistant director of the Cyber Division at the Federal Bureau of Investigation (FBI) and who is now a senior vice president of Aon Cyber Solutions, a global professional services firm.
Disrupting any one of the nation’s 16 critical infrastructure sectors, including the healthcare industry, poses a national security threat. These sectors are vital to daily life for millions of Americans and disabling them would have a debilitating effect on society, according to the Cybersecurity and Infrastructure Security Agency, or CISA, the country’s cyber defense agency.
Cyber attacks that disrupt hospital operations put patients’ lives at risk. The FBI said that the healthcare industry was hit the hardest by ransomware attacks in 2021 compared to other critical infrastructure. And the threats come as hospitals struggle with staffing shortages and financial pressures exacerbated by the COVID-19 pandemic.
In the wake of a ransomware attack on one of the nation’s largest hospital operators last year, Healthcare Dive analyzed more than 5,000 breaches reported over the past 13 years to the HHS Office for Civil Rights, the agency tasked with enforcing privacy and security laws in the healthcare sector.
A breach is a broad term for when protected health information that can identify patients is improperly revealed or used. A hacking or IT incident is a type of breach that involves a technical intrusion, according to the HHS, and is just one type of breach tracked by the agency.
The number of breaches has increased almost every year since reporting first began in 2009. Healthcare Dive confined its analysis to breaches that affected more than 500 people in each incident. The number of breaches reported each year more than tripled from nearly 200 in 2010, the first full year that data was available, to more than 700 in 2022.
More than 52 million people* had their private health information exposed in 2022 in more than 700 breaches, up from about 6 million people in 2010.
*One person could be counted multiple times if exposed within multiple breaches.
The upward trend is more apparent if the 2015 Anthem breach is excluded. The size of each breach, or the median number of people affected in each incident, has also jumped since 2018. The median is the midpoint between the largest and smallest breach and is less distorted by outliers.
Last year, the median breach affected more than 6,200 people, more than twice the size of the median breach in 2018. Breaches can dramatically range in size in terms of the number of people affected in each incident.
Most reported breaches affect fewer than 65,000 people. The second-largest breach disclosed since reporting first began in late 2009 affected 11.5 million individuals.
The largest reported breach occurred in 2015 and exposed the private health information of almost 79 million people through a cyberattack against Anthem, one of the nation’s largest insurers. An investigation by regulators found that Anthem, now known as Elevance, did not have adequate protections in place to ward off cyberattacks. Anthem later agreed to pay a $16 million settlement with HHS OCR.
Cyber attackers infiltrated Anthem’s IT systems through spear phishing emails sent to an Anthem subsidiary. Attackers stole patient information including full names, social security numbers, addresses, birth dates, emails and employment information, according to HHS OCR.
Health insurers, providers, clearinghouses and business associates are required to notify the HHS OCR when breaches occur. If a breach affects the private health information of more than 500 people, covered entities have 60 days to notify regulators.
The rise in breaches comes as healthcare companies have increasingly adopted digital services over the past decade, leaning more heavily on health information technology. The use of electronic health records by hospitals, especially, has soared since 2010, when providers began to take advantage of federal incentive programs that made billions of dollars available to those that opted to use EHRs. EHR adoption rate jumped to almost 100% within four years. Still, that connectivity can lead to cyber vulnerabilities and create avenues to access protected data, they said.
During just one episode of care, multiple entities may access a patient’s information, including doctors, hospitals, X-ray facilities and insurance companies, Aon Cyber Solutions. “The complexity of the network to facilitate the events is unbelievable,” the retired FBI agent said.
The current rush to remote work has fueled more entry points for attackers. The hospital sector became even more vulnerable during the pandemic, which dramatically accelerated the use of network- and internet-connected devices, said An advisor to the American Hospital Association (AHA) on cybersecurity and risk. As non-clinical employees pivoted to working from home, hospitals increased their reliance on third-party and cloud services. It led to an “expanded digital attack surface,” he said, who previously served as an FBI section chief overseeing cyber issues.
Hospitals’ dependency on third-party technology also makes them more vulnerable because they don’t have total control over the security of third-party tools. As a result, hospitals must wait for vendors to send patches for connected medical devices and are prohibited from patching problems themselves. “The key is we are being attacked by foreign adversaries. Most compromised records are from hostile acts, meaning foreign-based adversaries that even the FBI can’t put their hands on,” the advisor said. “It becomes very, very difficult to secure this expanded attack surface under increased fire during a pandemic,” he added.
The chief information security officer (CISO) at Cybereason, a cybersecurity firm based in Boston, added that many healthcare companies lack robust cybersecurity programs. “The chain is only as strong as its weakest link and there are so many weak links,” he said. “This makes healthcare an easy and profitable target for cyber attackers,” he added.
When breaches do occur, “the blast radius is bigger because of the information sharing,” said a partner at West Monroe who leads the firm’s Cybersecurity Advisory for Private Equity Program. That may explain why the average breach size has surged in recent years, Powers added.
To be sure, that not all breaches are the result of cyber attackers. The US federal government tracks a handful of breach types: hacking/IT incident, which can include cyberattacks; improper disposal; loss; theft; and unauthorized access/disclosure.
The second-most common type of breach in recent years is the result of unauthorized access or disclosure, which can occur when an employee accesses records outside of their job duties, according to Healthcare Dive’s analysis. It can also include when patient information is exposed through misdirected communications. Other types include loss or theft, such as when laptops or thumb drives are left in public places or stolen.
Hospitals have rich data, providing profitable targets. Ransomware attacks are a top threat facing the industry because healthcare organizations are profitable targets, according to security experts. In a ransomware attack, hackers lock out healthcare institutions from critical files and information and hold it hostage while demanding a payment in exchange for a decryption key to unlock the files.
Cybercriminals know healthcare organizations will feel pressure to rapidly restore access to lifesaving systems and technology. Providers are more likely to pay a ransom when the disruption threatens patient care, such as when emergency rooms are shut down or when facilities are forced to reroute patients, Aon Cyber Solutions’ said. The FBI has additionally warned that these attacks can put patients at risk by delaying access to care and vital information.
A newborn died allegedly as result of a ransomware attack that disabled computers on every floor of an Alabama hospital and strained resources, according to The Wall Street Journal. The report said that baby died months after she was delivered with the umbilical cord around her neck.
A 2021 survey of nearly 600 IT and health executives at provider organizations showed that ransomware attacks had a significant impact on patient care. Of those that experienced a ransomware attack, the majority reported longer lengths of stay; delays in procedures and tests; and diversions. More than one-third of respondents cited increased complications and almost one-quarter flagged increased mortality rates.
For ransomware criminals, ‘it’s all about ROI – Return on Investment’ Ransomware attacks on healthcare organizations have increased in frequency and severity since 2016, researchers found and tracked through the database, THREAT, or Tracking Healthcare Ransomware Events and Traits. “It’s all about ROI” for these criminals, Aon said. In addition, it can be difficult to deter bad actors, who can launch attacks from other countries and are often outside the reach of U.S. law enforcement, according to security experts.
In September of 2022, three Iranians were charged with attempting to launch a cyber-attack on Boston Children’s Hospital, one of the largest pediatric medical centers in the country. The FBI Director later characterized the foiled incident as “one of the most despicable cyber-attacks I’ve ever seen.” While the FBI was able to intervene before the attack was committed, the incident raised concerns about nation-state attacks on healthcare operators in the US.
“I do think we need to be prepared about the possibility of disruptive or destructive attacks by nation-states on healthcare, too,” said a threat intelligence analyst for IronNet, a cybersecurity firm based in McLean, Virginia. Attacks can be motivated by cyberespionage as well, she said. Some nation-states aimed to steal vaccine-related information and other medical research linked to the coronavirus to boost their own commercial sector, she added. Amid this threat landscape, healthcare firms should upgrade their cyber preparedness and may need a push from federal regulators, security experts said.
On 1 March, the US President revealed a sweeping national cybersecurity strategy that seeks to improve the nation’s cyber defenses. The policy goal calls for establishing minimum cybersecurity standards across critical infrastructure, including the healthcare industry. The policy plan, while not an executive order, will serve as a guide for federal agencies and lawmakers to enact cyber requirements. Raising the bar on cybersecurity standards is critically important for healthcare companies, security experts said. “I think we need to set a higher regulatory standard for healthcare organizations,” Cybereason said.
To be sure, raising the bar will likely come with financial consequences for hospitals and may raise healthcare prices, Aon said. Still, it added, “the level of security across the industry is not where it needs to be to protect patients’ healthcare information.”
Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization. For questions, comments or assistance, please contact the office directly at 1-844-492-7225, or feedback@wapacklabs.com
Weekly Cyber Intelligence Briefings:
- Reporting: https://www. redskyalliance. org/
- Website: https://www. wapacklabs. com/
- LinkedIn: https://www. linkedin. com/company/64265941
Weekly Cyber Intelligence Briefings:
REDSHORTS - Weekly Cyber Intelligence Briefings
https://attendee.gotowebinar.com/register/5504229295967742989
[1] https://www.healthcaredive.com/news/cybersecurity-hacking-healthcare-breaches/643821/
Comments