6 Hidden Vulnerabilities Healthcare Should Address for Cybersecurity Efforts

Cyberattacks on hospital IT systems have increased considerably, compromising the privacy of medical data. The most frequent attacks are ransomware — which blocks access to the system and encrypts files until a certain amount of money is paid to the criminals.

According to the Association of American Medical Colleges (AAMC), more than 18 million patient records were compromised in 2020 in the United States alone, causing a loss of more than $20 billion. In the same year, on a global scale, 1 in 3 healthcare organizations reported being victims of ransomware.

While other fields have established policies and invested heavily in cybersecurity, the health sector continues to struggle in this department. Hospital administrators, managers of medical clinics/private practices need to understand that cybersecurity in the health sector needs urgent attention.

Let’s take a look at six IT vulnerabilities that healthcare administrators need to look at.

1. Poorly Trained Staff on Cybersecurity Measures
The lack of training on how to deal with security issues is one of the main causes of cyberattacks.
With more and more healthcare organizations using electronic health records (EHRs), hospitals need to provide adequate training to their staff on cybersecurity measures and data protection.

The HIPAA Security Rule requires three kinds of safeguards to ensure the security of medical data: administrative, physical, and technical. Each safeguard has its actions and practices. Workforce training is one of them, but often the least remembered.

As the user is the weakest link in an IT system, establishing a security culture through cybersecurity training can help make your system more secure.

2. Mediocre Antivirus and Encryption Software
In the old days, a single antivirus software protected computers for years. Today, with the increasing reliance on mobile devices and tablets, hospitals must implement top-of-the-line antivirus software and encryption systems.

With hackers using state-of-the-art equipment and software, hospitals now need multi-tiered IT protection systems to secure their data and infrastructure.

According to the NY Times, almost all antivirus software was proven vulnerable in the face of new threats. It’s important to consult experts and adopt the best combination of antivirus, anti-malware, and encryption programs to ensure the security of your data.

3. Outdated Software
According to a 2020 information security study, 83% of the US Healthcare Systems are still running on old computers and using outdated software, making the system more vulnerable to hackers.

The same study identified that 57% of IT systems used by healthcare providers are vulnerable to medium or high severity hacker attacks. Keeping operating systems and hardware up to date are important in keeping hackers out of your system.

4. Poorly Restricted Access to Health Data
When you research what are the functions and advantages of using EHRs, the speed of sharing patient data appears at the top of the list. But it’s good to remember that this information shouldn’t be readily available to all employees.

To ensure the security and privacy of personal data, healthcare administrators must establish a zero-trust policy. This is based on the idea that any organization that wants to protect its data must operate under the assumption that devices inside or outside the network cannot be trusted. Therefore, each new component needs to be properly verified before accessing the local network.

Here are some tools that help protect and restrict access to personal data:

• A strong firewall can prevent unauthorized access to your network.
• A spam filter can block malicious emails before your employees open any malware.
• A web filter can prevent employees from accessing malicious websites unintentionally.
• A secure messaging platform can encrypt all communications between your staff.
• Conduct vulnerability scanning tests frequently to identify them before the hackers do.

5. Weak Passwords
As elementary as it may sound, having weak passwords is like inviting hackers into your house. Avoid passwords that are too short or too obvious — such as a loved one’s name or their date of birth.

A strong password must belong (the longer the better). Mix uppercase and lowercase letters with numbers and symbols, that have nothing to do with anybody’s personal information. If the letter combinations don’t form any particular word, even better.

6. Lack of Data Recovery Plan
Even after addressing the previous five vulnerabilities, a ransomware attack can still occur. At this point, hospitals must have a data recovery plan after a breach.
Staff must get into the habit of backing up data frequently. Ideally, these backups must be disconnected from the network. Keeping them on external hard drives or other security providers could be an option.

Cyberattacks Have a Cure Too
When a credit card gets stolen, the owner can simply call the bank to cancel it. But in data breaches in hospitals and clinics, the solution is not as straightforward. There is no way of changing a patient’s blood type or birth date, for instance, thus exposing them to a range of crimes — from identity theft to medical fraud.

Fortunately, like the diseases being treated daily, cyberattacks are also curable. Identifying vulnerabilities in handling data in healthcare systems is a crucial step in preventing a hacker invasion.

Originally published at Entrepreneur News and Startup Guide.