The Role of Leadership in Data Breach Defense

Hospital executives need to be involved in data breach defense. Here’s how they can facilitate active engagement with IT/IS teams.

Nov. 25, 2024 | | Written by Karl Kotalik, Chief Solutions Officer, Celerium

Hospital executives, including CEOs, COOs, CMOs, CNIOs, and others, play a critical role in data breach defense. While they are more familiar with operations than IT staff, they are also responsible for overseeing hospital systems such as EHR/EMR, billing, telemedicine, radiology, and others. These executives are primarily concerned with HIPAA compliance, patient safety, reputational damage, and financial consequences like regulatory fines and lawsuits. That’s why it’s crucial for hospital leadership to be involved in data breach defense. Here are ways that executives can get more involved.

Joint Planning
Hospital executives must work closely with IT/IS teams to develop an incident response plan (IRP) that includes clear policies and procedures for preventing data breaches. Executives need to ensure that IT implements standard security measures, such as multi-factor authentication (MFA), data encryption, patch management, and employee training. However, IT often needs executive support to overcome obstacles like resistance to MFA, securing legacy systems, and ensuring consistent employee training to prevent phishing attacks.

Data Breach Prevention
Effective prevention requires executive oversight. Hospital leaders can help IT/IS by ensuring staff understand the importance of MFA and that legacy systems are properly secured. Executives should also be involved in differentiating between “technical” and “business” data breaches. A technical breach refers to unauthorized access to data, while a business breach involves organizational or human error. Identifying the nature of a breach helps ensure the right response is enacted quickly.

Investigation and Declarations
Once a data breach is detected, executives need to help decide whether to activate the IRP and trigger breach disclosure protocols to the Department of Health and Human Services (HHS) and other regulatory bodies. This process often involves collaboration between IT/IS, legal teams, hospital leadership, and outside experts. Hospital executives are responsible for determining the scope and impact of the breach and making the necessary notifications.

Response and Containment
Containing the breach is crucial to minimizing data loss. This involves stopping the data exfiltration and preventing the breach from spreading to other systems. A key challenge for hospital leadership is deciding which systems should be shut down or isolated during the containment phase. IT’s typical response is to disconnect compromised systems from the network, but decisions must balance security with operational needs. Hospital executives may need to amend the IRP quickly in response to business pressures and legacy system complexities.

Common Understanding of Data Breach Activity
Hospital executives and IT/IS teams should share a common understanding of the breach’s status at the hospital or clinic level. This shared perspective is crucial for avoiding confusion and delays during response. While IT/IS may need time to investigate, executives should be informed early about potential issues to ensure swift decision-making.

Specific Data Breach Exercises
Regular breach exercises, focused on detection, investigation, declarations, and containment, help executives and IT/IS teams work together more effectively during a real incident. These exercises can test the IRP, highlight gaps, and foster a collaborative approach to breach management.

Conclusion
Improving communication and collaboration between hospital executives and IT/IS staff is essential in defending against data breaches. By fostering a common understanding of breach activity and regularly practicing breach detection and response, hospitals can strengthen their defense posture.

Celerium offers solutions to help executives and IT teams collaborate more effectively and manage breaches with greater efficiency. For more information on Celerium’s data breach defense program, visit our website or contact us at [email protected].

About Celerium®
Celerium engineers cyber defense solutions that are easy to implement and manage with minimal IT effort. Hospitals can take advantage of a no-cost subscription to Celerium’s data breach defense program. Learn more at the Celerium website or contact us at [email protected].