How Healthcare Can Strengthen Its Cybersecurity Resilience?
Many healthcare facilities and providers had their systems taken down by malicious intruders in 2020 alone.
Updated
On this page
Updated November 2026. This was first published on 8 September 2022. The idea is the same. Any number below is what the original piece said then. It is not a new count.
Key takeaways
- Many healthcare facilities and providers had their systems taken down by malicious intruders in 2020 alone, and they were demanded to pay to get the care back up and running.
- These establishments have to make challenging decisions.
- Hospitals and other medical service providers are well aware that technical debt is mounting, that there is a significant surge in cyberattacks on healthcare facilities, and that compliance concerns could result from unprotected data-sharing ports.
Many healthcare facilities and providers had their systems taken down by malicious intruders in 2020 alone, and they were demanded to pay to get the care back up and running. These establishments have to make challenging decisions.
Hospitals and other medical service providers are well aware that technical debt is mounting, that there is a significant surge in cyberattacks on healthcare facilities, and that compliance concerns could result from unprotected data-sharing ports. Attackers specifically target healthcare and life science companies now because they are aware of how susceptible they are and how important their job is at all times, but now more than ever.
The only strategy to stop these ongoing threats and maintain patient care and safety is to strengthen the IT systems of healthcare companies, so they are more resilient to attacks. companies must build an ever-evolving security posture to assist them in remaining resilient to emerging attacks since cybersecurity threats are constantly changing. Adopting fundamental security measures and enhancing them over time are essential components of this. Healthcare companies of any size or level of technical skill can start implementing these practices immediately.
Cyberattacks On Healthcare In 2022 So Far: #
Between January 2 and February 9, 2022, the Office for Civil Rights of the U.S. Department of Health and Human Services is looking into 53 different data breaches. 2,432,865 records were made public due to theft, hacking into networks and servers, and unlawful email leaks.
No single method can be used to secure your perimeter, and there is no attack pattern. There should be more to cybersecurity than just technologies. To effectively safeguard their surroundings, healthcare firms need company-wide compliance and training. Every user who has access to sensitive data or medical equipment must pledge to practice good cyber hygiene and the trust-but-verify principle.
Cybersecurity Preparedness and Resilience #
To make matters worse, paying the ransom does not ensure that the stolen information will be returned or that the decryption keys will be provided. The restored data is corrupted and unusable in 46% of ransomware attacks, increasing your costs and downtime as you struggle to deliver patient care without data.
Being ready is crucial since it is not a matter of if but when you will be assaulted. Cybersecurity monitoring with tried-and-true data backup and recovery solutions gives a one-two punch of readiness.
The objective of developing a strategy for cyber resilience is to recover fast from an attack, regardless of whether a ransomware event caused harm, malware on your network, or a data breach.
Your data will be safeguarded from corruption against both internal and external attacks with a reliable data backup and recovery plan.
How To Enhance Healthcare Cybersecurity? #
Healthcare companies should adopt the actions recommended by the Health Sector Cybersecurity Coordination Center (HC3) and the Office of Information Security of the U.S. Department of Health and Human Services (HHS) to strengthen their cyber posture.
Finding where weaknesses are in a healthcare institution requires establishing a baseline for cybersecurity and regularly reevaluating cyber posture. A holistic view of a healthcare company’s cybersecurity posture can be obtained by including all information technology (IT) assets in the assessment, including medical equipment connected to the Internet of Things (IoT) and employee PCs.
2.****Keep an eye out for software and network vulnerabilities:.
It is recommended that staff members keep an eye out for unusual activity on the company’s network. For automated threat detection, healthcare cybersecurity teams can also rely on vulnerability scanning technology, such as the tools made available by the Cybersecurity and Infrastructure Security Agency (CISA).
The success of staff training, the security of IoT devices, and other cybersecurity activities are just a few examples of the cybersecurity metrics that leaders in the healthcare industry should specify because they directly benefit and apply to their enterprises.
4.****Establish a clear chain of command for risk management:.
The report placed a strong emphasis on identifying precisely who inside an company is accountable for each risk that the healthcare facility faces. The company may better track cyber threats and foster a culture of security awareness by clearly defining risk and designating certain people to be responsible for risk management.
5.****Create plans for emergency recovery and incident response:.
A crisis response team that can handle cybersecurity in the case of a security issue should be established, according to the research, by healthcare cybersecurity leaders.
Members of the technology, communications, law, and business continuity departments should be on the team. Healthcare companies might find weaknesses in their emergency response strategy by conducting a tabletop simulation of a hypothetical incident.
Healthcare companies need to treat cybersecurity threats like insecure IoT devices, rogue hackers, and unpatched systems seriously.
Critical procedures include routine cybersecurity awareness training, keeping an eye out for unusual user behavior, regularly taking and validating backups, limiting data egress points like portable storage devices, blocking websites, encrypting sensitive records, limiting administrative access to a minimum, performing regular software updates, disabling default admin accounts, and conducting routine IT security audits to find any unaddressed vulnerabilities.
Questions and answers #
What is the main point? #
Many healthcare facilities and providers had their systems taken down by malicious intruders in 2020 alone, and they were demanded to pay to get the care back up and running.
What else did the original piece say? #
These establishments have to make challenging decisions.