Healthcare cyber
security can help
combat worsening
security breaches

The IoMT and its connected network of medical devices have been a revolutionary force in healthcare since well before the pandemic. The IoMT has enabled an array of remote medical possibilities while redefining the concept of "point of care." But it's also made healthcare cyber security exponentially more complex.

Hospitals are more vulnerable to malicious actors looking for unguarded endpoints. Many home medical devices and wearables become a potential entry point to a sensitive network and a wealth of valuable personal health information. Also on the line is patient safety, an issue that previously only intersected with healthcare cyber security at the most peripheral level. Take St. Jude, for example, and their researchers who discovered that implantable cardiac devices could be accessed remotely by hackers.

These issues might not be as serious a concern if device security were to keep up with the current threat landscape; but research on 5 million unmanaged Internet of Things (IoT) and IoMT devices found that 15 to 19% of the devices were running on Windows 7 or older, leaving them a decade or more behind today's security standards.

And use is only increasing. From social distancing to consumerization trends in healthcare, IoMT devices are only set to become more common over time.

COVID-19 has disrupted nearly every aspect of society and industry, and healthcare has not been immune.  Because of COVID-19, the future of healthcare and the technology it relies on are undergoing profound change.  This includes telemedicine and telehealth, artificial intelligence (AI) for faster diagnostics, advances in population health and even 3D printing.

But what has all that meant for cyber security?

The social separation that is supporting public health has, in some cases, made it harder for security teams to collaborate and quickly detect emerging threats.  Further, new challenges to physical security (work-from-home practices put devices and sensitive data in uncontrolled environments), and a confirmed increase in the number of cybercriminals trying to exploit fear about the pandemic -- further imperil the security of healthcare organizations.

Deloitte, for example, has observed an increase in phishing attacks, malspams and ransomware attacks by attackers using the pandemic to bait customers and employees. Cyber security in healthcare will be permanently reshaped by these trends, pushing security leaders to refresh their perspectives.

Achieving the secure interoperability of complex healthcare IT systems -- from medical records to billing systems to telehealth applications -- is a strategy that many healthcare organizations are pursuing. As organizations become increasingly connected, they face new challenges, driving the need for additional security standards that fit those needs.

Increased interoperability means rising threats to data integrity and pressure to ensure secure transmission of sensitive data—and providers are on the hook for making this happen. As recently as 2019, the College of Healthcare Information Management Executives (CHIME) has pushed for regulatory changes and cyber security measures to support providers as they work to enhance care quality and efficiency.

This has included improved guidance for analyzing and assessing the threats that are within their control—a fast-expanding category in the modern healthcare cyber security landscape.

What's potentially most frustrating about security breaches in healthcare is that, while much is changing, too much is staying the same.

Against the rise of Pony/Fareit malware as a threat, phishing still dominates healthcare cyber security news, even as COVID-19 presents new avenues for bad actors to exploit. The same goes for ransomware, an ongoing favorite of cyber criminals targeting the industry.

Healthcare continues to top breach vulnerability lists, struggling to keep up with the demands of the threats to the industry. According to the most recent Department of Health and Human Services audit report, the majority of providers are not performing the risk assessments required by the Health Insurance Portability and Accountability Act (HIPAA), and the same goes for risk management processes.

Still, a lot comes down to internal controls. Insider threats are still a major problem (healthcare ranks as the worst industry at stopping insider data breaches), and transparency is still a dire need as the response to COVID-19 (especially around remote work and telemedicine) and other technology trends continue to evolve.