Recently, the U.S. Department of Health & Human Services (“HHS”) issued guidance for healthcare cybersecurity best practices. As required under the Cybersecurity Act (CSA) of 2015, this four-part guidance was generated by a Task Group charged with the following:
- Examining current cybersecurity threats affecting the healthcare and public health sector;
- Identifying specific weaknesses that make healthcare and public health organizations more vulnerable to cybersecurity threats; and
- Providing certain practices that cybersecurity experts rank as most effective against such threats.
This technical assistance comes at a critical time. Healthcare organizations, regardless of size, complexity or sophistication are vulnerable to cyber-attacks. For example, while smaller organizations may think that cyber threats, such as ransomware, tend to affect the larger organizations, approximately 58% of malware attack victims affect small businesses. Furthermore, cybersecurity attacks in 2017 cost small and medium-sized businesses an average of $2.2 million.
Most surprisingly, despite increased frequency of cyber-attacks over the last two years, coupled with cost of data breaches being highest in healthcare, the healthcare industry continues to lag behind in cybersecurity preparedness. About 4-7% of total IT budgets, across healthcare organizations, are being spent on cybersecurity, while other industries spend approximately 10-14%. There is certainly a need and significant room for improvement across the industry.
The main volume of the new HHS guidance document cites the five most prevalent cybersecurity threats as:
- E-mail phishing attacks;
- Ransomware attacks;
- Loss or theft of equipment or data;
- Insider, accidental or intentional data loss; and
- Attacks against connected medical devices that may affect patient safety.
The guidance document also shares ten best practices to mitigate cybersecurity threats (covered in more detail in corresponding Technical Volumes):
- E-mail protection systems;
- Endpoint protection systems;
- Access management;
- Data protection and loss prevention;
- Asset management;
- Network management;
- Vulnerability management;
- Incident response;
- Medical device security; and
- Cybersecurity policies.
With this new cybersecurity guidance from HHS, healthcare companies can be better equipped to strengthen their security and more effectively tackle cyber threats. Companies should prioritize these efforts because cybersecurity preparedness can reduce patient privacy risk, protect patient safety and ultimately preserve an organization’s reputation.
