Federal Authorities May Impose Civil Penalties against Hospitals Paying Ransomware Demands

Hospitals could be charged $250,000 or twice the demand amount, whichever is greater.

In October 2020, the United States Department of the Treasury’s Office of Foreign Assets Control (OFAC) issued an advisory on potential sanction risks for facilitating ransomware payments. It warned that entities, including hospitals, paying off ransomware extortion demands might be subject to civil monetary penalties under the International Emergency Economic Powers Act (IEEPA).

Under Title 50, Chapter 35, § 1705(b) (Penalties) of that Act, “A civil penalty may be imposed . . . in an amount not to exceed the greater of — (1) $250,000; or (2) an amount that is twice the amount of the transaction.”

This places hospitals in danger of violation of the IEEPA, even when they are the victim of a ransomware attack.

RACmonitor first reported on the danger of ransomware attacks in January 2017 (“Cyberattacks on Hospitals: How Ransomware and Bitcoin Threaten America’s Health Providers). Since that time, ransomware attacks have continued to increase. According to the Federal Bureau of Investigation, from 2018 to 2019, there was a 37 percent increase in ransomware cases in the United States. However, the associated losses from these attacks increased by 147 percent. So there are more ransomware attacks, and the financial damages they are causing is increasing even more rapidly.

Extrapolating from data collected regarding hospitals during the first half of 2020, approximately 120 will have their information systems disabled from various types of hacking, usually associated with faulty email behavior. We also can expect that by the end of the year, at least 20 major hospitals will suffer debilitating ransomware attacks.

Because of a desire to maintain confidentiality, data is not always available on the amount paid out by hospitals to unlock their information after it is frozen by such attacks. Nevertheless, it has been reported that the University of California-San Francisco School of Medicine paid out $1.14 million to hackers.

How Hospitals are Damaged by Hacking

Any time a hospital is hacked, it suffers extensive damage, both short-term and long-term. In the short term, it must cope with potential loss of revenue that takes place when it is unable to provide services. There may also be significant harm to patients. On the information technology side, the hospital will need to immediately call in expensive consultants who can provide emergency services and assistance in getting their system back up and running. From a technical point of view, it requires highly skilled (and costly) expert services to diagnose the problem.

Even if the ransomware demand is paid and the decryption key is delivered, a hospital still will face a formidable hurdle in restoring its data, rebuilding its databases, and re-verifying its security and applications as it gets back on its feet. These expenses have an average cost of more than $1 million, according to Proven Data, a service that helps organizations recover from ransomware attacks. For some services, hourly rates for emergency consultants run around $1,950.

In the longer term, apart from all of the cost and difficulty associated with restoring the information system and getting it back into operational order, the hospital must engage in notification of the breach to persons whose data may have been exposed. There usually is a public relations disaster to handle as well.

There also is the cost of paying the extortionist in order to get the key to decrypt the hospital data. In addition, a ransomware incident can cause an explosion in liability to third parties that may be working with the hospital.

Even if the hospital has paid for ransomware cyber insurance, it still will face a long road in getting the system back into order so it can continue functioning. It is not as simple of getting the recovery key and pushing a button – far from it.

Paying Up

Whether to pay may euphemistically be called a “business decision.” At the core is a simple estimation – is the cost of paying less than the cost to rebuild the system from scratch?

But even if there is a decision to pay, still the hospital will face problems. It is rarely the case that a hospital will have a crypto-currency account already set up in order to make payments to international scammers. As a consequence, it is common to use consultants or “enablers” who are familiar with how to make such payments. They can set up the cryptocurrency accounts and make sure that the payment goes through. In the past few years, a number of services have emerged to facilitate these payments – for a handling fee, of course.

If the hospital has cyber-insurance, then it may foot the bill, but it will do this only after the hospital makes the payment. The payment must be made, then the receipts are given to the insurance company for reimbursement.

In practical terms, what this means is that the insurance company is not going to get involved directly in making the payoffs. Consequently, it should easily escape from any potential liability from violating the International Emergency Economic Powers Act. 

One would think that part of the advantage of using a third-party expert in making the payments would be a lessening of potential liability for the hospital, provided that it can plausibly deny any knowledge of the transaction. That is not so. The problem with civil monetary penalties in this case is that it is considered to be a matter of strict liability. This means that the entity making the payments is liable under the Act, even if they have no knowledge of the identity of the foreign actor and have no intent to violate U.S. law.

Developing an Industry-Wide Solution

Groups such as the American Hospital Association (AHA) may provide an important avenue for pursuing a lessening-of-liability in case of ransomware. For example, one of AHA’s important legislative initiatives is promotion of regulatory relief. This area of activity focuses on reducing the costs of regulatory compliance and medical liability reform. This cluster of activities might be a promising place to start in getting an exemption from the danger of OFAC civil monetary penalties that otherwise might be forced on victim hospitals compelled to pay due to a ransomware attack.

The bottom line: purchase cyber liability insurance, and lobby for reform of the IEEPA to exempt hospitals from civil monetary penalties.