The ransomware crisis continues to impact hospitals and health systems with little sign of slowing down.
In 2017, IT security in healthcare was in the media spotlight. In May, the WannaCry ransomware hit thousands of information systems. It was followed by NotPetya, which took down Merck and Nuance. In June, the Health Care Industry Cybersecurity Task Force released a number of security frameworks, and the number of cybersecurity training programs increased.
Security frameworks are not the answer to this problem, but they are organizing schema that sometimes help an organization think through its requirements to protect its healthcare data. By August, professionals were worrying about the Internet-of-things (IoT), including malware infection of medical devices – to possibly even include pacemakers active within patients’ bodies.
In Stockholm, at the October ITechLaw conference, practicing attorneys expressed concerns that there was no legal standard that defined the level of due diligence necessary in the management of their information systems. Organizations were being held responsible by government regulators, but with no objective standard of security. CMS delayed requirements for using the 2015 certified electronic health record (EHR) standard. eClinicalWorks’ software company was brought into court because its software could not identify cancer. Medicare continued to deny reimbursement for many telemedicine procedures, thus remaining Luddite in its orientation. Without an accepted standard for reasonable cybersecurity, organizations will remain unable to protect themselves from litigation claiming negligence in their data management.
The end-of-year statistics said it all. Healthcare system security breaches rose 24 percent, but ransomware incidents rose 89 percent.
We can expect that in 2018, IT security in the healthcare sector will continue to be a challenge. Hackers, terrorists, non-state actors, even state actors all continue to be antagonists to the global cyber infrastructure. Information systems can be compromised in a number of ways:
- EHRs can be stolen so that personal information can be used for identity theft;
- Social Security numbers of newly born babies can be hijacked and sold on the dark web;
- Databases can be corrupted or destroyed so that they may not be used; and
- Personal information can be stolen and used for blackmail later on.
The industry already is off to a good start in 2018. Last Thursday, two North Carolina-based data centers of the giant company Allscripts had its cloud platform disabled by a ransomware attack. All patient information became unavailable. The e-prescribing system and EHR platform went offline. The Electronic Prescribing of Controlled Substances (EPCS) functionality went down. Physicians had to go back to paper records.
The previous week, Hancock Health in Greenfield, Ind. was hit by ransomware. All of the patient names in its EHR were changed to “I’m sorry.” They paid out $55,000, which is much less than it would have cost to restore the system had the records remained locked. The “I’m sorry” attack had been visited on Indiana’s Adams Memorial Hospital prior to this. In early January, it was reported that more than one-half of all patient information in Norway had been compromised.
The creativity of criminals is limitless, and law enforcement sometimes is a step behind. Likewise, healthcare security professionals and the security countermeasures they are able to deploy can be insufficient.
And in many cases, they will remain behind, because IT security involves what professionals describe as “asymmetric warfare,” a fancy way of saying that the cost of the attack is many times less than the cost of defense.
In particular, the tsunami of ransomware will continue to do damage to thousands of enterprises, both public and private.
Some have placed blame for ransomware on the outlaw government in North Korea. After all, it is a money-making operation, and the use of crypto-currency makes it easy to get paid. Or it could be Russian organized crime, or other governments, or rogue hackers, or someone else. It really doesn’t matter. What’s important is that ransomware is what the U.S. intelligence community calls an “advanced persistent threat.”
Efforts are being made to set up mechanisms for sharing of cyber threat information between organizations. Theoretically, this should mitigate the damage, but we will have to wait for 2019 to see if it really works as planned – and my guess is that it will not.
