As physicians focus on patient health and executives work to keep the doors open, data breaches can have serious consequences for everyone.
Cyber criminals around the world know that sensitive patient information held by America’s hospitals is ripe for the picking. Health care remains the top target for hackers, with 210 of the 870 ransomware attacks last year on critical infrastructure organizations directed at health provider organizations.
While any hospital can be a target, cyber criminals began attacking small and rural hospitals more specifically in 2022. Smaller hospitals often don’t have the information technology (IT) resources necessary to thwart increasingly sophisticated cyber threats, much less continue to care for patients when an inevitable attack occurs.
By their very nature, hospitals are chaotic places where anything can happen at any time. A 2021 study by a federal cybersecurity agency found that hospitals hit by ransomware often experience additional stressors that can correlate with higher patient mortality rates. While ransomware is particularly troubling, any data breach or intrusion can cause serious issues not only for hospitals, but also for patients.
Health care data is particularly prized not only for direct fraud of Medicare or Medicaid, but also for medical, personal, and financial information that can be used to create new identities and open lines of credit. Medical records are worth 50 times more than credit card numbers on the dark web. Hackers also know that the 24/7 nature of hospitals means they are likely to pay a ransom, which 61% did in 2022.
The following suggestions can benefit every hospital, but small and rural hospitals, in particular, need advice, expertise, and funding to meet the cybersecurity challenges of today and prepare for the challenges of tomorrow.
More than 40% of rural hospitals currently operate in the red, and one in five is at risk for closure, according to the Chartis Center for Rural Health. When a hospital’s mission is to provide the best patient care possible while trying to keep the doors open, cybersecurity will not be top of mind for hospital executives.
But the federal government is stepping up efforts to make patient data more readily available through interoperability of technology systems, which underscores the importance of hardening IT infrastructure across health care to keep patient data out of the hands of bad actors.
When it comes to protecting technology networks and assets, small and rural hospitals have fallen well behind their larger and more urban counterparts. An immediate, bipartisan plan is needed to give small and rural hospitals the resources and support they need to put the focus back where it truly belongs — on the patient.
Kate Pierce is Fortified Health Security’s senior virtual information security officer and executive director of subsidy. She recently testified before the U.S. Senate’s Homeland Security & Governmental Affairs Committee on the challenges small and rural hospitals face in managing an effective cybersecurity program as well as barriers to adequate funding and human capital constraints.