Essentials: A Cybersecurity Strategy For Healthcare

As worldwide cyber threats shut down organisations and violate privacy left and right, hospitals and health systems need to make sure their cybersecurity strategies are primed to keep them ahead of the threats. 

A Cybersecurity Strategy is the only way to ensure that an organisation can stay up and running while protecting its patients’ privacy and even their well-being.

Progressive health systems see the value of cyber-security as providing a competitive advantage and ensuring better patient care, said Rich Curtiss, a managing consultant at Clearwater Compliance who specialises in cyber-security and health data risk management. “However, considering the healthcare sector is woefully behind in adopting information technology, it is difficult to see a horizon that is able to keep up with the velocity of cyber-security threats,” Curtiss said. “There are a few areas where health systems should be focused on.”

These areas, according to Curtiss, include the need for health systems to establish cyber-security as a strategic objective that is defined and managed by the C-suite and has a board of director’s involvement. This would include assessment of information risk metrics to drive improvements. “Information risk management will inform many decisions that require organisational prioritisation and ensure the C-suite and board are well-informed on threats, vulnerabilities and risks that may adversely impact the organisation,” he said.

Health systems also need to isolate the information security workforce from the information technology workforce to ensure adequate separation of duties and avoid conflicts of interest, Curtiss said. And health systems, he added, must establish a chief information security officer who reports to the COO and CEO; this is a critical step in maintaining vigilance and ensuring information security gets a seat at the table.

Finally, a separate budget and spend plan for cyber-security improvements and maintenance will ensure competing IT or clinical priorities do not erode the ability to effectively address the cybersecurity environment, Curtiss said. The vendors behind the information technology that weaves together today’s health systems play a big part in the cyber-security strategies health systems need to hone. “Hospitals and health systems must be rigorous in assessing the privacy and security controls of the vendors with which it contracts, include robust business associate agreements as part of the vendor contract, and ensure that the vendors have the financial wherewithal to back their contractual obligations,” said Pam Hepp, a shareholder at Buchanan, Ingersoll & Rooney who specialises in data security, HIPAA and patient privacy.

However, provider organisations have not tended to do a good job vetting many of these vendors, largely due to the fact that CIOs, CISOs and privacy officers are not always made aware of all of an organisation’s vendor arrangements; nor do these executives have the resources to devote to assessing each such vendor, Hepp said.

Moving into the future, provider organisations must continue to be proactive to identify risks and vulnerabilities, take reasonable actions to address known risks, continue to educate staff, remain vigilant and promptly take action to address issues that do occur by undertaking remedial measures, provide notices where appropriate, and learn from each incident, Hepp said. “But much more needs to be done with respect to vendor management,” she added. 
“Healthcare organisations need to recognise the risk presented by these vendor arrangements and devote appropriate resources or they may be exposed to even greater financial, as well as reputational, risk that may occur in connection with either a significant operational disruption and/or an OCR enforcement action should an issue occur that the organization easily could have or should have identified and addressed.”

But information security is not simply a compliance issue. “CIOs, CISOs and CCOs need to drop the compliance mindset and realise that information security is necessary to ensure the availability of critical patient care information systems and medical devices,” he concluded.  

“Diverting patients to another hospital due to an uncontrolled and unmanaged malicious software event is unacceptable now and in the future.”

Healthcare IT News

You Might Also Read:

A New Form Of Ransomware Attacks UK Hospital:

Insiders Are The Cause Of Most Healthcare Breaches:

 

« Cyber Vulnerability Affecting 745,000 Pacemakers
Will The CIA Be Run By Robots…? »

CyberSecurity Jobsite
Check Point

Directory of Suppliers

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

Acumin Recruitment

Acumin Recruitment

Acumin is an internationally established Cyber Security recruitment specialist.

CYBERPOL

CYBERPOL

CYBERPOL is the leading Public Utility Agency for investigating cyber crimes and cyber attacks by criminals, international adversaries.

Datiphy

Datiphy

Datiphy's data-centric security platform uses behavioral analytics, and data-centric auditing and protection capabilities to mitigate risk.

Detack

Detack

Detack is an independent supplier of IT security auditing and consulting services.

Watchcom Security Group

Watchcom Security Group

Watchcom is one of Norway's foremost suppliers of information security consultancy services.

Komodo Consulting (KomodoSec)

Komodo Consulting (KomodoSec)

Komodo Consulting specializes in Penetration Testing and Red-Team Excercises, Cyber Threat Intelligence, Incident Response and Application Security.

Exatel

Exatel

Exatel is Poland’s leading provider of ICT security services.

ShadowDragon

ShadowDragon

ShadowDragon develops digital tools that simplify the complexities of modern investigations that involve multiple online environments and technologies.

Assac Networks

Assac Networks

Assac Networks ShieldIT is an app that completely protects any BYOD smartphone from both tapping and hacking.

Tenzir

Tenzir

Tenzir's primary focus lies on network forensics: the systematic investigation of cyber attacks with big data analytics.

IXDen

IXDen

IXDen provides a novel software-based approach to OT systems protection, covering Industrial IoT cybersecurity and sensor data integrity.

Jump Capital

Jump Capital

Jump provides series A and B capital to data-driven tech companies within the FinTech, IT & Data Infrastructure, B2B SaaS and Media sectors.

CYBRScore

CYBRScore

CYBRScore is a premium, performance-based cyber skills training and assessment provider that quantifies a user’s ability to defend a network.

Oort

Oort

Oort is an identity threat detection and response platform for enterprise security. The Oort platform is API-driven, cloud-native and agentless for rapid time to value and high scalability.

Fulcrum IT Partners

Fulcrum IT Partners

Fulcrum IT Partners is the parent company of an expanding portfolio of established IT solution companies around the world with proven expertise in cyber security, cloud, and managed services.

Night Lion Security

Night Lion Security

Night Lion Security provides discreet and bespoke investigation and incident response recovery services.