Cybersecurity in healthcare: The critical connection to patient safety
With interoperability on the rise, it’s important for CIOs to implement cybersecurity measures and uphold patient safety in a threatening digital landscape.
Cybersecurity can feel like a life-or-death issue with regards to patient safety which can keep CIOs awake at night.
Some hospitals have been offline for days after a cybersecurity event, raising serious patient safety concerns. And sometimes, such an interruption may have dire consequences and trigger lawsuits.
For example, an Alabama woman whose 9-month-old daughter died filed suit against the hospital where she was born, claiming the facility did not disclose that its computer systems had been crippled by a ransomware attack, which resulted in diminished care that led to the baby’s death.
Thankfully, CIOs and other senior executives are becoming far more open to implementing cybersecurity controls as a result of the heightened awareness of patient safety issues.
Aligning with the strategic goals
As always, CIOs need to find ways to tie requests for funding of enhanced controls back to an organization’s strategic goals. And one obvious goal is ensuring patient safety.
To minimize the risks technology can pose to patient safety, CIOs need to take a leadership role, making sure their organization takes several steps, many of which are often overlooked. These include the following:
- • Conducting frequent security awareness training for all staff members.
- • Using state of the art tools and technology to monitor behavioral patterns and detect problems in audit logs before it's too late.
- • Performing a ransomware readiness assessment.
A ransomware readiness assessment is a more in-depth analysis, an expansion of what many organizations already do for their risk assessment. These readiness assessments can spot vulnerabilities that can be mitigated now rather than lamented later after lawsuits have been filed in the wake of a breach.
Cyber insurance companies are tired of paying out claims. As a result, they’ve enhanced their policy renewal questionnaires. One of the questions we frequently hear from these insurers now is, “Have you conducted a ransomware readiness assessment?”
Other action items
Because so many bad state actors and criminals are targeting the healthcare sector to take advantage of so many possible points of infiltration, it’s important to take steps to help prevent and detect breaches, prepare for incident responses, implement recovery plans and take other steps to assure readiness.
Prevention
Detection
Response
Remember: “It’s not the event, but your reaction to the event that people will remember the most.”
Recovery
Assurance
Senator Warner’s white paper
In a detailed report, “Cybersecurity Is Patient Safety,” issued late last year, Sen. Mark Warner, D-Va., summed up important issues:
“Although … cybersecurity vulnerabilities certainly leave healthcare organizations exposed to patient data theft, they often have far-reaching, and more serious, impacts beyond privacy concerns. Cyberattacks can be detrimental to patient safety, as they can lock physicians out of treatment tools, shut down hospital equipment used for care, and create backlogs that delay appointments and treatment. When it comes to cyberattacks affecting patient care, the question is no longer a matter of if or when, but how often and how catastrophic the consequences.”
Cybersecurity needs to be treated as a cost of doing business, and that cost needs to be reflected in Medicare reimbursements. The problem with healthcare cybersecurity is that it is usually part of the IT department budget, which is overhead to the hospital or clinic. Anyone who works in healthcare will tell you that when it is budget planning time, patient care departments and services take a higher priority than departments that are considered mere overhead, such as IT. This is normal because the mission of healthcare is to treat patients.
The federal government has expectations when it comes to data and information sharing, creating more opportunities for data breaches. If the government is promoting data sharing, then it has an obligation to help cover a portion of the costs associated with sharing data securely.
Cybersecurity is essential to patient safety. It is a cost of doing business in the healthcare sector. And CIOs will sleep better at night if they win support for the people, processes, and technologies needed to keep systems reasonably secure.
Tom Walsh, CISSP, is founder and managing partner of tw Security.