Issue link: https://viewer.e-digitaledition.com/i/1476559
Healthcare Security: Ransomware Attacks on the Rise BY ELESA SWIRGSDIN D U R I N G T H E F I R S T ha lf of 2022 , electronic data breaches at healthcare organizations significantly increased. In fact, the U.S. Department of Health and Human Services (HHS) reports that between Jan. 1 and May 31, 244 breaches were recorded, as compared to 137 during the same period last year. A large fraction of these breaches have been ransomware attacks. While it may not always be possi- ble to prevent these attacks, strengthening cybersecurity measures and creating comprehensive response plans can help organizations protect patients' safety and privacy. THE DANGERS OF RANSOMWARE While all electronic data breaches cause harm by exposing or distributing sensitive information, ransomware is particularly dangerous. This form of malware gives the hacker access to private data — and it also encrypts the data, blocking access to servers until the victim pays a ransom. Often, if the ransom is not paid, the hacker will sell or publish the information. In a healthcare setting, a ransomware attack can put not only information but also patients' lives at risk. Recent hospital attacks have left patient records inac- cessible, blocking patient care. In some cases, patients have been moved to other facilities. The financial consequences of cyberattacks can also be devastating, especially for small organizations. BEING PREPARED The hea lthcare sector is particularly vulnerable to ransomware attacks due to the number of connected systems and networks that use wireless technology, as well as the sensitive nature of the data. As such attacks become more sophisticated, all stakeholders, including hospitals and clinics, medical device manufacturers, and IT vendors, must coordinate efforts to mitigate attacks. The Cybersecurity & Infrastructure Security Agency (CISA) advises that organizations who are targeted do not pay ransoms. Not only does payment not guarantee a return to data access, but it could also fuel the attackers to expand their operations. CISA recommends that all healthcare organizations take the following measures, in addition to having comprehensive and robust security systems in place: + Ma i nt a i n of f li ne, encr y pted dat a backups a nd test the backups a nd procedures regularly. + Develop a cyber incident response plan that can be implemented in the event of an attack. + Develop a risk management plan that protects critical health services and care by routing them to the appropriate information systems. + Prepare for the possibility of critical systems becoming inaccessible by printing ha rd copies of documents required for cr itica l patient ca re, training staff to re-route patients and coordinating with other local health- care facilities for support. By following mitigation and recovery pla ns, hea lthca re orga nizations ca n protect themselves from the fallout of ransomware attacks. n Fo r m o re info r m at i o n o n m a lw a re attacks, visit cisa.gov/stopransomware/ healthcare-and-public-health-sector. Ransomware attacks have led to delayed or missed care including: + Ambulance diversion + Canceled surgeries + Delayed chemotherapy + Delayed mammograms and other screenings + Late lab results + Postponed appointments, including prenatal appointments R ANSOMWARE AT TACKS CAN BE DE VA STATING TO THE HE ALTHCARE INDUSTRY AND PUT PATIENTS AT RISK. BY BEING PROACTIVE, ORGANIZ ATIONS CAN HELP PROTECT THEMSELVES — AND THEIR PATIENTS. 1 5 M D N E W S . C O M /// M D N E W S C E N T R A L N E W Y O R K n 2 0 2 2