Do Hospitals Have Time for Data Breach Defense?

Hospitals face significant risks from data breaches that are exacerbated by existing financial and operational pressures. Hospital executives must prioritize automated IT security solutions to enhance defense without overwhelming already strained resources.

Sept. 19, 2024 | | Written by Karl Kotalik, chief solutions officer and executive leader of healthcare practice at Celerium

This article is sponsored by Celerium. Celerium Inc. engineers automated data breach detection and containment solutions that are easy to implement and manage with minimal IT effort.

As the health care landscape becomes increasingly challenging, hospital executives face dual pressures of financial instability and the rising threat of data breaches. The potential for data breaches to erode patient trust, disrupt operations, and impose significant financial burdens adds a layer of complexity to hospital management.

The Growth of Threats and Stress

The stress for hospital executives grows each day. There are current estimates of 700 to 800 rural hospitals potentially closing due to financial insolvency over the next few years. The challenges of service delivery, regulatory compliance, and maintaining patient trust and brand reputation are all-consuming.

Data breaches can be debilitating to hospital leadership, management, and IT. Of course, the potential erosion of patient trust and brand reputation when a criminal threat actor steals millions of patient HIPAA PHI records is very painful. Worse is the potential to impact hospital systems, causing diversion and other patient safety issues. Layered on top of these issues are the extra financial burdens, including the cost of recovery and potential HHS/OCR Regulatory fines and/or class action lawsuit settlements, not to mention the possibility of increased cyber insurance premiums in future years.

The Challenges of Time and Resources

Dealing with data breaches may require costly investments in technology and staff. But even if funds are available, there are additional issues. Hiring IT staff is a problem; finding IT security hires with knowledge of HIPAA and other issues is an even bigger challenge. With over 3 million open jobs for IT security staff, how can hospitals attract and retain essential employees?

In addition, the complexity of IT solutions, from payment systems and electronic records to medical devices, requires more investment in IT staffing. Unfortunately, many of these systems require unexpected budget allocation to maintain, constantly integrate, and operate!

Cyber Threats Will Get Worse

The criminal threat actors know about the turmoil that hospitals face, and they know they can often sell ePHI patient records for up to $1,000 each. In the past, threat actors had to be very experienced. However, a few years ago, dark web marketplaces started selling inexpensive toolkits for phishing and hacking, enabling less experienced hackers. Then, a new underground industry called “Ransomware as a Service” (RaaS enabled wholesale/ retail partnerships, empowering novice hackers to leverage these partners in crime and their advanced hacking tools. Now, we are entering the next generation of empowering novice threat actors with AI and Generative AI. These new tools will help novice hackers create advanced phishing email campaigns that will be increasingly difficult for hospital workers to detect, even with employee awareness training programs. AI will also help hackers create malware, even next-generation polymorphic malware, which mutate to avoid detection.

The Way Forward – Automated Defense

Given a future with motivated and creative threat actors, now armed by AI and other advanced technology tools, it’s easy to understand how hospitals could easily experience more and more data breach attacks. Given the current state of overloaded and overwhelmed IT organizations and the difficulty in hiring and retaining staff, the future is clear. Hospital executives need to examine automated IT security solutions as additional ways to improve security. However, a note of caution: if automated tools require a great deal of IT human resources to implement, maintain, and integrate, then the benefit of these tools can be eroded. So, finding automated tools with easy implementation, low maintenance, and low integration costs is key to driving future efficiency and effectiveness in cyber and data breach defense measures.

To learn more about data breach defense for hospitals, visit Celerium’s website.