Healthcare Cybersecurity

What Can Small Healthcare Providers Do To Prevent Ransomware Attacks?

Posted by HIPAA Journal

Ransomware attacks on healthcare providers are occurring with alarming frequency. Figures from the FBI suggest as many as 4,000 ransomware attacks are occurring every day.

Healthcare organizations are targeted because they hold large volumes of data and access to those data is required to provide medical services to patients. Without access to patients’ health information, healthcare services can be severely disrupted. Such reliance on data makes healthcare providers attractive targets as they are more likely than other companies to give in to ransom demands to obtain keys to unlock their data.

All businesses, and healthcare organizations especially, should implement a number of defenses to prevent ransomware attacks. Policies and procedures should also be developed to ensure that in the event of an attack, business operations are not severely disrupted and data can be recovered quickly.

There is no one technology solution that can be deployed to prevent ransomware attacks from occurring, although there are a number of actions that can be taken to improve resilience against ransomware attacks and ensure a fast recovery can be made at minimal cost.

How to Prevent Ransomware Attacks

Listed below are some of the steps that healthcare providers should take to improve their defenses against ransomware:

  • Deploy and configure an anti-spam solution – Consider all of the email attachments that are likely to be required by employees and block all others, especially JavaScript (JS) and Visual Basic (VBS) files, executables (.exe), screensaver files (SCR)
  • Configure computers to display file extensions. Double extensions are often used to trick end users into believing files are harmless. Invoice.xlsx.scr for example. Displaying file extensions will help users to identify malicious files
  • Ensure Office installations are configured to block macros, or at least ensure macros must be run manually. Make sure all employees are warned of the dangers of enabling and running macros
  • Ransomware infections often occur via Windows PowerShell. Unless PowerShell is essential, consider disabling it
  • Ensure all software is kept up to date and patches are applied promptly
  • Segment your network – An attack on one device should not allow all of the company’s data to be encrypted
  • Provide training to all employees on security best practices and instruct them never to open email attachment – or visit links – contained in emails from unknown senders
  • Consider an Internet filtering solution that can be used to block end users from visiting malicious websites
  • Ensure anti-virus software is installed and virus definitions are set to update automatically. Consider installing a popup blocker in web browsers
  • Block all unused ports on computers
  • Train all staff members on basic cybersecurity and best practices
  • Conduct dummy phishing email tests to ensure training has been effective
  • Ensure all employees are trained on the correct response to a potential attack. Ensure staff members are made aware of the importance of reporting any suspicious emails and how to respond if they believe they may have inadvertently installed ransomware
  • Ensure that policies and procedures are developed that can be instantly implemented in the event of an attack. Fast reaction can limit the harm caused and will ensure the fastest possible recovery from an attack
  • Consider encrypting data. While this will not prevent a ransomware attack, if an attack does occur and encrypted data are encrypted by ransomware, patient notifications will not need to be issued and a breach report will not need to be submitted to Office for Civil Rights

Most important of all is to ensure data are backed up daily. Backups should be stored securely in the cloud. Local backups should be stored on air-gapped devices. Backup drives should not be left connected after backups have been performed. Backup drives can also be encrypted by ransomware.

Reporting Ransomware Attacks and Notifying Patients

HIPAA Rules require ransomware attacks to be reported if the protected health information of patients has been accessed or encrypted, unless the covered entity can demonstrate there was a low probability that patient data were compromised in an attack.

While some healthcare organizations have disclosed ransomware attacks, many are not reporting the incidents. The failure to report a ransomware attack and notify patients that their ePHI has been compromised can potentially result in financial penalties for noncompliance with HIPAA Rules.

To avoid a HIPAA penalty, a covered entity must be able to demonstrate there was a low probability of patient data being accessed or copied during an attack. The Department of Health and Human Services’ Office for Civil Rights released guidance for covered entities on ransomware infections last year. In the guidance, covered entities are advised of the steps that should be taken following a ransomware attack and the criteria for determining whether patient notifications must be issued. The guidance can be downloaded/viewed on this link.

The post What Can Small Healthcare Providers Do To Prevent Ransomware Attacks? appeared first on HIPAA Journal.

WEDI Offers Healthcare Cybersecurity Tips to Improve Resilience Against Cyberattacks

Posted by HIPAA Journal

WEDI, the Workgroup for Electronic Data Interchange, has issued a new white paper exploring some of the common cybersecurity vulnerabilities that are exploited by threat adversaries to gain access to healthcare networks and patient and health plan members’ protected health information.

The white paper – The Rampant Growth of Cybercrime in Healthcare – is a follow up to a primer released in 2015 that explored the anatomy of a cyberattack.

WEDI points out the seriousness of the threat faced by the healthcare industry. Cyberattacks are costing the healthcare industry around $6.2 billion each year, with the average cost of a healthcare data breach around $2.2 million.

Cyberattacks and other security incidents having risen sharply in recent years. More records are now being exposed than at any other time in history and the number of healthcare data incidents being reported reached record levels last year.

The Department of Health and Human Services’ Office for Civil Rights received 315 reports of major healthcare data breaches last year and recent research by Fortinet showed that in the final quarter of 2016, the U.S. healthcare industry was being attacked more than 700,000 times per minute.

The healthcare industry is in a unique position. Healthcare organizations hold data that is more valuable to cybercriminals that held by other industries. Healthcare organizations also typically have a much larger attack surfaces to defend and more attack vectors to block.

WEDI points out that “attack surfaces have multiplied as organizations cobbled together a health information technology (health IT) infrastructure comprised of new components, legacy hardware and antiquated software from multiple vendors.”

Yet while healthcare IT systems require increased investment, many healthcare organizations are relying on basic security tools to defend their networks and keep data secure. Those tools focus on “antivirus, malware and firewall vulnerabilities, but lack a deeper set of prevention, encryption, detection, authentication and protection strategies.”

In the report, WEDI explores the most common types of threat adversaries, their characteristics and the level of threat that each poses. The report also details the types of vulnerabilities and attacks that most commonly occur, including zero-day vulnerabilities in software, phishing, spear phishing and whaling attacks, and malicious software such as viruses, worms, malware and ransomware.

WEDI sought advice from industry stakeholders in roundtable discussions between November 2015 and April 2016 and identified best practices that can be adopted by healthcare organizations to mitigate risk and keep networks and data secure.

WEDI suggests a cultural change is required and healthcare cybersecurity must have a higher profile. That process should start by raising awareness and educating stakeholders of the unique threats faced by the healthcare industry and the cost of cyberattacks and other data breaches.

Cybersecurity must become a C-suite matter, not an area dealt with by IT departments. Strategies must be effectively planned and sufficient resources devoted to protecting networks from attack. WEDI suggests healthcare organizations should also adopt cybersecurity frameworks to improve reliance against cyberattacks and apply the lessons learned from other industries.

The post WEDI Offers Healthcare Cybersecurity Tips to Improve Resilience Against Cyberattacks appeared first on HIPAA Journal.

Snapshot of Healthcare Data Breaches in February 2017

Posted by HIPAA Journal

The Protenus Breach Barometer healthcare data breach report for February includes some good news. Healthcare data breaches have not risen month on month, with both January and February seeing 31 data breaches reported.

The report offers some further good news. Healthcare hacking incidents fell in February, accounting for just 12% of the total number of breaches reported during the month. There was also a major fall in the number of healthcare records exposed or stolen. In January, 388,207 healthcare records were reported as being exposed or stolen. In February, the number fell to 206,151 – a 47% drop in exposed and stolen records. However, February was far from a good month for the healthcare industry.

IT security professionals have long been concerned about the threat from within, and last month clearly showed those fears are grounded in reality. February saw a major increase in the number of incidents caused by insiders. Insider breaches in February accounted for 58% of the total number of incidents reported for which the cause was known; double the number reported the previous month.

Insider wrong-doing was behind eight of the 18 incidents caused by insiders and nine were the result of errors by employees. One of the incidents could not be classified due to a lack of information about the exact nature of the breach.

Preventing insider breaches can be a major challenge for healthcare organizations, as can detecting breaches when they occur. Small to mid-sized organizations often do not have the resources to allow them to continuously monitor for the inappropriate accessing of healthcare records by employees. However, if continuous monitoring is not possible, covered entities must ensure that regular audits of access logs take place. Fast detection of improper access can greatly reduce the harm that those incidents cause. Regular reviews of access logs will also reduce the risk of a OCR HIPAA fine or settlement

HIPAA requires covered entities to maintain access logs and regularly check for inappropriate ePHI access, although the frequency of those checks and audits is left to the discretion of the covered entity. The frequency of audits should be dictated by the results of an organization’s risk analysis.

Last month showed that while some healthcare organizations are complying with 45 CFR § 164.308(a)(5)(ii)(C) – log-in monitoring – and 45 CFR § 164.312(b) – Audit controls – and are keeping logs, they are failing on Section 45 CFR § 164.308(a)(1)(ii)(D) by not regularly conducting information system activity reviews.

One incident reported in February involved an employee improperly accessing ePHI for more than five years (2,103 days) before the improper access was detected. HIPAA Rules may not stipulate how frequently access logs should be checked, but it would be difficult to argue that a check every five years constituted ‘regular’.

That was not the only long delay in detecting a breach. A second incident was also reported in February that took more than five years to detect (1,952 days). In that case the incident involved a system glitch that left ePHI exposed.

Overall, the breaches and security incidents reported in February took far longer to identify than those reported in January. It took an average of 478 days from the date the incident occurred to the date OCR was notified of the breach; that said, the average time was increased considerably by the two 5-year+ delays in detection. In January, the average time from the initial event to reporting was 174 days.

Breaches of electronic protected health information made up the bulk of incidents, although a third of incidents involved paper records, highlighting the importance of implementing physical controls to keep physical PHI secured.

While California usually tops the list for the number of incidents reported each month, this month Texas earned the title of the worst hit state with 4 reported breaches. California, Arizona, and New York shared second place with three incidents apiece.

Healthcare providers were the worst affected in February, accounting for 77% of the month’s incidents. Health plans reported 13% of breaches and business associates and vendors accounted for 3%. The remaining 3% were reported by other organizations.

The post Snapshot of Healthcare Data Breaches in February 2017 appeared first on HIPAA Journal.

OIG Discovers Multiple Security Vulnerabilities in the Massachusetts’ Medical Management Information System

Posted by HIPAA Journal

The Department of Health and Human Services’ Office of Inspector General has published the results of an audit of the Massachusetts’ Medical Management Information System (MMIS).

The MMIS is maintained by the Massachusetts’s Executive Office of Health and Human Services which administers the State Medicaid program (MassHealth). The MMIS supports 1.67 million beneficiaries and processed around $13.8 billion in fiscal year 2015. The MMIS is used for the processing of Medicaid claims and recovery of claims’ reimbursement from third parties, healthcare authorization services, managed care, and the provider self-service portal.

The auditors looked at MassHealth websites, databases and the supporting IT systems to determine whether data and associated systems had been safeguarded in accordance with National Institute of Standards and Technology guidelines and federal requirements.

Auditors assessed MassHealth’s system security plan, risk assessments, use of data encryption, web applications, vulnerability management processes, and database applications.

The auditors discovered numerous information security failures that could potentially have been exploited to gain access to the sensitive information of Medicaid recipients and could have compromised the integrity of the MassHealth program.

According to the report, the auditors discovered vulnerabilities existed in security and configuration management, system software controls and website and database integrity scanning. While no evidence was uncovered to suggest any of the vulnerabilities had already been exploited, OIG said “the vulnerabilities were collectively and, in some cases, individually significant and could have potentially compromised the confidentiality, integrity, and availability of MassHealth’s MMIS.” Those vulnerabilities existed as a direct result of a lack of sufficient control measures to safeguard information systems and Medicaid data.

Details of the vulnerabilities were passed to MassHealth to allow action to be taken to correct the security failures and ensure information systems and data are appropriately secured. MassHealth did not explicitly agree or disagree with any of the eight recommendations issued by OIG, although details of actions that had been taken to remediate all of the discovered vulnerabilities were provided to OIG.

The post OIG Discovers Multiple Security Vulnerabilities in the Massachusetts’ Medical Management Information System appeared first on HIPAA Journal.

68% of Healthcare Organizations Have Compromised Email Accounts

Posted by HIPAA Journal

Evolve IP has published the results of a new study that has revealed the extent to which healthcare email credentials are being compromised and sold on the dark web.

Email credentials are highly valuable to cybercriminals. A compromised email account can be plundered to obtain highly sensitive data and an email account can be used to gain access to healthcare networks.

63% of data breaches in the United States occur as a result of compromised email credentials and healthcare email credentials are being sold freely on the dark web.

Evolve used its Dark Web ID analysis technology for the study and reviewed 1,000 HIPAA covered entities and business associates. Evolve discovered 68% of those organizations had employees with visibly compromised email accounts. 76% of those compromised accounts included actionable password information and that information was freely available on the dark web.

Depending on the industry segment, between 55.6% and 80.4% of organizations had compromised email accounts. Medical billing and collections organizations fared the best, with 55.6% of organizations having at least one compromised account, while regional healthcare plans the worst affected with 80.4% of organizations having compromised email accounts.

Evolve points out that in many cases the passwords associated with the email accounts were outdated, but explained that even outdated passwords are valuable to hackers.

Passwords are often recycled, so an old password could allow a hacker to gain access to other online accounts. Evolve also says “hackers can create a user profile and determine a person’s new password fairly accurately by using simple guessing or sophisticated automated algorithms.” Even when passwords are hashed, hackers can crack the hash, conduct brute force attacks and use lookup, reverse lookup, and rainbow tables to guess the passwords.

In the majority of cases, email accounts were compromised as a result of a data breach (55% of compromised accounts). While just 6% of compromised accounts were the result of a phishing attack, Evolve points out that equated to 450 separate email accounts that were compromised as a direct result of phishing attacks.

Preventing email compromise incidents is an essential part of any cybersecurity strategy. Evolve suggests three main methods that all healthcare organizations should embrace to reduce risk: Proactive threat intelligence, continuous security management, and rapid incident response and recovery.

By obtaining up to date threat intelligence, healthcare organizations can discover the latest vulnerabilities and threats before they are exploited by criminals. Continuous security management should involve real-time security analyses and infrastructure management, which will help healthcare organizations stay one step ahead of hackers.

Even if security best practices are adopted and the latest cybersecurity technologies are implemented, it will not be possible to prevent all security breaches. Organizations must therefore have the policies and procedures in place to ensure a quick recovery. Fast action following a security breach will limit the harm caused.

The EvolveIP Report can be found on this link.

The post 68% of Healthcare Organizations Have Compromised Email Accounts appeared first on HIPAA Journal.

Redington-Fairview General Hospital Targeted with New Telephone Phishing Scam

Posted by HIPAA Journal

Patients who have previously received medical services at Redington-Fairview General Hospital in Skowhegan, Maine have been targeted with a new telephone phishing scam.

The criminals behind the phishing scam are attempting to get patients to reveal sensitive financial information and credit card numbers over the telephone by impersonating the hospital.

Two patients have complained to hospital officials about receiving automated calls offering help paying their hospital bills. To date, no one is believed to have fallen for the scam although it is possible that other patients could similarly be targeted.

The calls appear to be coming from a local telephone number owned by the hospital, although that number is not an active extension. A statement from the hospital confirmed that the number has not been configured on the hospital’s communication system. The number appears to have been spoofed.

It is unclear how the scammers obtained patients’ telephone numbers and spoofed a hospital telephone number, although the hospital does not believe this is an inside job. The hospital has confirmed there has not been a security breach and that its telephone system has not been compromised. Calls to the number – 07-858-2308 – are directed to the hospitals answering service.

The criminals behind the scam are believed to have spoofed the number to make it appear that the calls are coming from the hospital. The hospital does not believe the scammers have access to any personal information of patients and that the aim of the calls is solely to gain access to credit card numbers and/or other financial data.

The matter has been reported to the Skowhegan Police Department and an investigation into the incident has been launched. Patients have been advised that the hospital does not use automated calls and if any calls are received from that number they should hang up and not disclose any information.

The post Redington-Fairview General Hospital Targeted with New Telephone Phishing Scam appeared first on HIPAA Journal.

Security Analytics Solutions Can Improve Security Posture, but there are Challenges

Posted by HIPAA Journal

A recent Ponemon Institute study has delved into the use and effectiveness of security analytics solutions. The study shows that while security analytics solutions can help organizations improve their security posture, there are many challenges with both deployment and day to day use.

The purpose of the study was to find out how – and how much – these solutions are helping organizations and where they are failing.

The study, which was sponsored by analytics firm SAS, was conducted on 621 IT and IT security professionals in the United States that are involved with security analytics in their respective organizations. 87% of respondents said they personally used security analytics solutions in their organization, while 80% of respondents said those solutions were fully deployed.

Most commonly, security analytics solutions are deployed after a cyberattack has been suffered. 68% of organizations said an attack was the main driver for implementing an analytics solution. 53% said it was fear of a cyberattack or a successful intrusion that spurred them to start using an analytics solution, while 44% said they deployed an analytics solution to meet compliance requirements.

The most common analytics solutions are tools that have been developed in house, which are used by half of organizations, while a Security Information and Event Management (SIEM) solution was used by 47% of respondents. Those solutions were deployed on premise and in the cloud by 40% of respondents. 33% said they only used the solution on premise, while 23% only used the solution in the cloud.

There are clear benefits to using a security analytics solution, although deployment is challenging. The solutions require extensive configuration and tuning before they are effective. 56% of respondents said they found deployment difficult or very difficult.

Other major problems were the sheer volume of data that needs to be analyzed – a problem for 51% of respondents – and getting access to the necessary data – rated as a problem by 45% of respondents.

Once access to the required data has been achieved, the challenges do not stop. 66% of respondents said they experienced problems with data quality, while integrating data was an issue for 65% of respondents.

The main purpose of security analytics solutions is to gain insight into security events as they happen. 72% of respondents wanted to see what was happening now, while 69% said they used the solutions to find out about past security events. 65% of respondents used the solutions to provide advance warnings about potential internal and external threats.

That said, many respondents were failing to detect the threats they most wanted to find. Half of respondents wanted their analytics solutions to detect data exfiltration, yet only 33% of respondents said their solution had that capability. 40% said they wanted to use their solution for adversary reconnaissance, but only 35% said their solution was capable of providing that information. 36% wanted their solution to detect lateral network movement, yet only 31% of respondents said their solution provided that information. Detecting malicious insiders and internal threats was important for 36% of respondents, yet only 23% said their solution had the necessary capability.

Information is needed quickly for it to be most beneficial, yet only 28% said their solution could provide information in real time or every few minutes. 40% of respondents said their solution only provided data hourly or daily.

The overwhelming feeling was the use of security analytics solutions had helped to improve security posture. One of the most important benefits was the reduction in false positives when analyzing anomalous traffic. Before the solutions were deployed, 80% of respondents said it was difficult to reduce false positives, although that figure fell to one third after a security analytics solution had been deployed.

There may be many challenges with deploying and using security analytics solutions, but 61% of organizations said their solution was critical to their cyber defenses. 71% of respondents said their organization is planning on increasing the use of security analytics in the next 12 months.

“Security analytics clearly isn’t as effective as security practitioners need it to be,” said Stu Bradley, Vice President of Cybersecurity Solutions at SAS. That said, “building analytic sophistication ultimately pays off in improving organizations’ ability to discover, detect, investigate and respond to security events in a reliable, repeatable way.”

As for the challenges in deploying security analytics solutions, Bradley offered some helpful advice

“Nearly all solutions require initial configuration and tuning for optimal performance,” however, “organizations can avoid many pitfalls by clearly defining workflows and project goals before starting an implementation.”

The post Security Analytics Solutions Can Improve Security Posture, but there are Challenges appeared first on HIPAA Journal.

OCR Urges Covered Entities to Monitor and Report Cyber Threats

Posted by HIPAA Journal

The healthcare system in the United States has suffered a barrage of cyberattacks in recent years and there is no sign that those attacks will ease. In all likelihood, attacks will increase in both number and severity.

To counter the increased threat, healthcare organizations, government agencies, the private sector, and international network defense communities must collaborate, says the Department of Health and Human Services’ Office for Civil Rights in its February newsletter.

It is the responsibility of healthcare organizations to keep abreast of the latest cyber threats to enable them to take timely action to mitigate risk. Threat intelligence is available from many organizations, although as a minimum, healthcare organizations should be regularly checking the cyber threats published by the United States Computer Emergency Readiness Team (US-CERT).

OCR explains that US-CERT – one of the four branches of the Department of Homeland Security’s National Cybersecurity and Communications Integration Center (NCCIC) – provides actionable threat intelligence to the public and private sector, government agencies and critical infrastructure owners. US-CERT collects and analyses its own data, but also intelligence submitted by its partners.

Information on the latest threats is published on its website, along with recently discovered vulnerabilities, mitigations for known vulnerabilities, and details of the latest patches. Organizations can also sign up for e-mail alerts from US-CERT via its website.

The value of the information provided by US-CERT was highlighted by a report on Grizzly Steppe activity, published on February 10, 2017. Grizzly Steppe is the name given to a campaign run by Russian civilian and military intelligence services targeting the U.S government and private sector organizations, including healthcare organizations. The activity report details the methods used by the threat actors to gain access to systems along with techniques that can be adopted to mitigate the threat and defend against spear phishing and webshell attacks.

Armed with this information and intelligence on other network and data security threats, healthcare organizations can ensure action is taken to counter threats to the confidentiality, integrity, and availability of ePHI. OCR recommends US-CERT reports and alerts should be obtained by all covered entities and their business associates as part of the HIPAA Security Management Process.

Healthcare organizations should also play a part in improving awareness of the latest cybersecurity threats by sharing reports of suspicious activity with US-CERT. OCR suggests “Covered entities should report to US-CERT any suspicious activity, including cybersecurity incidents, cyber threat indicators and defensive measures, phishing incidents, malware, and software vulnerabilities.”

While threat intelligence and details of security incidents should be submitted, covered entities are not permitted to share any ePHI with US-CERT unless the disclosure is otherwise permitted under HIPAA Rules (Details of allowable disclosures of ePHI are available on this link).

The post OCR Urges Covered Entities to Monitor and Report Cyber Threats appeared first on HIPAA Journal.

81% of U.S. Healthcare Organizations Have Increased Security Spending in 2017

Posted by HIPAA Journal

The 2017 Thales data threat report published earlier this week shows the healthcare industry is responding to the increased threat of data breaches and cyberattacks by committing more funds to improving cybersecurity defenses.

After two record breaking years of healthcare data breaches – 2015 in terms of the number of records exposed or stolen, and 2016 in terms of the number of breaches reported – it is clear that the healthcare industry is under attack.

2016 also saw a record number of settlements reached with the Department of Health and Human Services’ Office for Civil Rights. Last year there were 12 HIPAA settlements and one Civil Monetary Penalty issued to resolve HIPAA violations discovered during healthcare data breach investigations.

Healthcare organizations are certainly feeling the heat. In the US, 90% of healthcare organizations feel vulnerable to data threats. There was also a 2% increase in the number of healthcare organizations that experienced a data breach in the past 12 months. 20% said they had a data breach in the past 12 months and 55% of healthcare organizations say they have had a historic data breach.

In the past, the healthcare industry has lagged behind other industry sectors when it comes to cybersecurity. That is now starting to change. Healthcare organizations have responded to the increased threat level by committing more funds to their cybersecurity programs; considerably more this year than other industry sectors.

Last year, only 60% of healthcare organizations increased cybersecurity spending. According to the Thales threat report, 81% of healthcare organizations will be increasing their cybersecurity budgets this year, compared to the overall industry average of 73% and the global healthcare industry average of 76%.

94% of healthcare organizations are now using advanced technologies to protect sensitive data. 61% use SAAS, 50% IAAS, 39% PAAS, 59% use Big Data, 19% use containers, and 5% are now using blockchain.

The biggest spending priorities for healthcare organizations is to comply with industry regulations. 57% of healthcare organizations say their main spending priority is compliance, 40% say it is to prevent data breaches, 34% say it is to adopt best practices, and 27% say spending has increased in response to increased cloud use.

How is the money going to be spent? 69% of healthcare organizations are increasing spending on network security, 61% are investing in endpoint and mobile protection measures, 62% are increasing spending on analysis and corrections, 51% on technologies to protect data in motion, and 47% on technologies to protect data at rest.

92% of healthcare organizations believe network security is very or extremely effective at preventing data breaches – and increase of 14% year on year – while 67% believe endpoint protection is very or extremely effective – an increase of 3% year on year.

Garrett Bekker, Senior analyst at 451 Research points out that healthcare organizations need to think carefully about the technologies they use to keep data secure, “Oorganizations keep spending on the same solutions that worked for them in the past but aren’t necessarily the most effective at stopping modern breaches.” Bekker also said “Spending on securing internal networks from external threats is less and less effective – and relevant – as both the data and the people accessing it are increasingly external.”

When it comes to barriers preventing the adoption of better cybersecurity defenses, 53% said complexity is a major issue. 39% said they lack the staff to manage those defenses, 36% said performance concerns, 33% lack the budget, while 26% said they lacked organizational buy in.

48% of healthcare organizations believe cybercriminals are the main external threats, but internal threats are also a major concern. Privileged users are rated as the biggest internal threat according to 61% of organizations, followed by executive management (46%), contractors (33%) and service providers (26%).

Peter Galvin, VP of strategy, Thales e-Security says “For healthcare data to remain safe from cyber exploitation, security strategies need to move beyond laptops and desktops to encompass an ‘encrypt everything’ approach that best suits a world of internet-connected heart-rate monitors, implantable defibrillators and insulin pumps. Adhering to the security status quo will create vulnerabilities that lead to breaches, and further erode customer trust.”

The post 81% of U.S. Healthcare Organizations Have Increased Security Spending in 2017 appeared first on HIPAA Journal.