Large Teaching or University Associated Hospitals Face Higher Likelihood of Data Breach

Between late October of 2009 and late December 2016, there were 1,798 data breaches recorded by the U.S. Department of Health and Human Services (HHS), according to a report from JAMA Internal Medicine. And of those, 257 were hospitals. Several, 33 in fact, were breached two times or more. Many of them were teaching hospitals or those related to universities. The trend is showing that these types of medical facilities are increasingly the victims of data breaches.

Larger facilities were more likely than smaller or non-teaching ones to be compromised. According to the lead author of the study, Ge Bai, Ph.D., that could be because they simply have a higher quantity of the valuable data the cyberthieves are after. This includes social security numbers, which are issued with the intent of staying with the owner forever. Unlike payment card numbers, they are not easily changed or unlinked to fraudulent activity.

What is likely contributing to this uptick is the lack of budget funds to update the aging infrastructures of these hospitals. There are a lot of systems running on outdated and unsupported equipment and on those systems a vast amount of sensitive data is stored.

Those in charge of these systems should be aware of this and ensure they are doing whatever possible to not only secure the data, but also keep the systems updated and upgraded. As operating systems and other software becomes no longer supported, it’s more critical to move the data that is to be protected off of them.

In addition, as ransomware phishing increases in popularity as a tool for the hackers, ensuring staff is educated on the risks of phishing and how to identify these attacks is critical. Phishing remains the number one way ransomware makes it onto systems.

This is also why having current backups on hand should be at the top of the to-do list. Not having these could result in a situation such as Hollywood Presbyterian Medical Center, which had to pay the cybercriminals to get its data unencrypted. Not having backups could lead to life or death situations, as the keys to get the information released are not always provided in ransomware situations.

Not patching and update software and systems also poses significant risk. Recently, the FBI warned the healthcare industry of a threat to open FTP servers. According to the warning, cybercriminals are specifically targeting the servers in or related to healthcare organizations to “access protected health information and personally identifiable information in order to intimidate, harass and blackmail business owners.”

In addition, behavioral analytics tools can help track user trends and will identify and flag abnormalities for further review.

According to a Forbes report, healthcare related breaches have cost $6.2 billion within the last two years. Hospitals are becoming the biggest targeted sector. In addition, per Michael Lipinski at Securonix, healthcare data breaches cost 80% more than the U.S. average for similar incidents.