Knowledge Center

Cybersecurity white paper examines health IT vulnerabilities and how stakeholders can mitigate risk in the wake of record data breaches striking the healthcare industry

RESTON, Va. — March 20, 2017 — The Workgroup for Electronic Data Interchange (WEDI), the nation’s leading nonprofit authority on the use of health IT to create efficiencies in healthcare information exchange and a trusted advisor to the U.S. Department of Health and Human Services (HHS), announced the development of an industry white paper, entitled “The Rampant Growth of Cybercrime in Healthcare.” The paper explores some common vulnerabilities that are typically exploited by cybercriminals in today’s healthcare environment, as well as best practices organizations can implement to mitigate these vulnerabilities.

According to the paper: “As the use of health IT becomes more widespread, cybersecurity must be more directly integrated into the fabric of healthcare and ultimately become an organizational asset that is perceived as commonplace and mission-critical as hygiene and patient safety procedures have become to quality care. No matter how high the walls that any one organization is able to erect against cybercriminals, the healthcare industry at large must coalesce as a united front to more collectively address how to implement a universal culture of cyberdefense and train a more resilient workforce to mitigate threats.”

Stemming from topics discussed at multi-stakeholder cybersecurity roundtables convened in November 2015 and April 2016 by WEDI and sponsored by Fortinet, the 15-page document outlines how cybercrimes are more commonplace in the healthcare landscape given the high value of digital health records which have “attracted organized crime and government-sponsored entities that in turn are capable of launching sophisticated attacks to disrupt, disable, destroy or maliciously control digital technology and data of organizations. As cybercrimes have become more prevalent and complex in healthcare, they are also causing greater damage.”

In light of the cybersecurity challenges identifies, roundtable participants identified the following best practices for mitigation to the industry, as explored in the white paper:

1. Drive a cultural change in how cybersecurity is approached in healthcare, beginning with raising awareness to educate stakeholders around the risk and cost of cyberattacks;
2. Build the business case for cybersecurity and move it into the executive suite;
3. Develop cybersecurity frameworks that provide a robust, forward-facing roadmap to protect organizations in a changing environment; and
4. Apply lessons learned from other industries.

“Fortinet detected more than 700,000 hacking attempts per minute against healthcare organizations in the fourth quarter of 2016. It’s clear that the attack surface is growing at exponential speeds as the industry faces a technological transformation with IoT devices and cloud applications providing new patient care delivery models,” said Susan Biddle, senior director of healthcare at Fortinet. “To mitigate these threats and gain greater control and visibility, healthcare providers should focus on people, processes and technology. By focusing on building a culture of cyber-awareness, conducting ongoing cyberthreat assessments, and deploying a security fabric architecture for centralized, end-to-end security, healthcare providers can better ensure that all devices and applications on their networks are protected with real-time threat intelligence.”

Some additional key highlights from the white paper include:

• It is critical for organizations to assess their current approach to cybersecurity, understand potential adversaries that they may encounter and identify the vulnerabilities that may be targeted before developing a comprehensive and robust strategy to effectively detect, mitigate and prevent cyberthreats across multiple fronts;
• In 2016, the leading causes of reported data breaches in healthcare were unauthorized access (40 percent) and hacking (33 percent), while theft and loss of data actually saw a decrease in the number of incidents; and
• Of the current cyber threats that compromise data today, healthcare organizations are most concerned by ransomware (69 percent), phishing attacks (61 percent) and negligent insiders (55 percent) which can often be the most difficult to prevent and protect, given the human elements involved.

“The Rampant Growth of Cybercrime in Healthcare” white paper was made possible through the support of Fortinet, and is available on the WEDI website.

About WEDI

The Workgroup for Electronic Data Interchange (WEDI) is the leading authority on the use of health IT to improve healthcare information exchange in order to enhance the quality of care, improve efficiency, and reduce costs of our nation’s healthcare system. WEDI was formed in 1991 by the Secretary of Health and Human Services (HHS) and was designated in the 1996 HIPAA legislation as an advisor to HHS. WEDI’s membership includes a broad coalition of organizations, including: hospitals, providers, health plans, vendors, government agencies, consumers, not-for-profit organizations, and standards development organizations. To learn more, visit www.wedi.org and connect with us on Twitter, Facebook and LinkedIn.