Consumers were singled out in the early days of ransomware, but now ransomware distributors have no problem directing their malicious efforts toward much larger groups, locking organizations out of key systems and demanding a hefty fee that often doesn’t provide full accessibility once paid. Attacks targeting healthcare providers have become an increasingly regular occurrence over the years, with 2018 experiencing large-scale hospital ransomware attacks that touched thousands of healthcare consumers, disrupted crucial everyday activities, damaged reputations and led to financial loss.

It’s smart to expect this trend to continue to plague the healthcare industry because setting reasonable expectations encourages institutions to better secure their data and prepare for disasters. But will we see a great increase in the frequency and volume of hospital cyberattacks in the year ahead? The adoption of EHRs, mobile devices, medical equipment and BYOD leaves healthcare organizations of all sizes more vulnerable than in years past. Making data security a priority and establishing a clear framework for developing and revisiting protection strategies is a must moving forward.

Assessing the Damage in 2018

In July 2018, Cass Regional Medical Center was forced to take its electronic health records system offline for more than a week. The medical center initiated its prepared incident response just thirty minutes after discovering the attack, demonstrating strong incident response protocols. At that time, no evidence indicated that patient data was breached, but as an extra precaution, the hospital’s EHR vendor Meditech opted to shut down the system until the incident was resolved.

Soon thereafter, Missouri-based Blue Springs Family Practice notified approximately 45,000 patients that a ransomware attack had compromised their personal information. In the notice, they stated this protected health information (PHI) included “full name, home address, date of birth, Social Security number, account number, driver’s license number, medical diagnoses, and disability codes.”

And at the end of the year, the East Ohio Regional Hospital in Harper’s Ferry, Ohio, and the Ohio Valley Medical Center in Wheeling, West Virginia, both fell victim to ransomware. Patient care was disrupted, which meant that patients seeking emergency care were diverted to other hospitals in the region.

The State of Ransomware Today

Cyberattacks often make dangerous waves in the healthcare industry in the form of a series of attacks against similar organizations. In 2018, local governments were hit with a major cyberattack that caused the Matanuska-Susitna Borough to officially declare a disaster, labeling the attack “the worst of its type in the nation.” It was later revealed that a single file left behind on their servers identified the borough as the 210thvictim of the series.

Some in the industry claim that statistics show ransomware is on the decline, but these statistics have the potential to provide a false sense of security to healthcare institutions today where attacks continue to rise.  The need for healthcare institutions to maintain secure access to immediately available data that fuels improved patient care means institutions will continue to be a prime target for ransomware and other cyberattacks.

Getting Prepared for 2019 Attacks

To get prepared for possible ransomware attacks in 2019, today’s healthcare institutions should take several steps to develop a response plan, implement tighter security and backup measures and review practices and systems every quarter.

• Develop and test contingency plans for responding to ransomware and other cyberattacks, reviewing and updating them at least quarterly
• Leverage cyber threat intelligence as part of your overall security management plan
• Implement and frequently test a robust backup plan addresses the effects of cyberattacks (HIPAA security rule requires healthcare providers to implement a backup plan as part of an overall contingency plan in the event of a security breach)
• Institute segmented networks to limit exposure to ransomware attacks and make it more difficult for ransomware to spread from system to system (Zero Trust)
• Stay vigilant by quickly patching known vulnerabilities in applications and operating systems and updating endpoint anti-malware software
• Educate and train your employees to recognize malicious intent and act fast to report suspicious content

Many products and solutions exist to help you tackle this list of preparation tasks. Here are some of the solutions to look out for when seeking professional help in managing risk, security and ransomware prevention at your organization:

If you’re unsure of what services you need to get a handle on your cybersecurity, talk with a HIPAA compliance specialist or an IT security provider that can assess and explain your most pressing areas of risk and lay out all of your options for ransomware prevention. Taking the steps to implement better data security now is better than scrambling to pick up the pieces after experiencing a devastating hospital ransomware attack or other cyberattack. Make 2019 a safe and secure year for your organization and those you serve.

Are you ready to explore your cybersecurity options? Contact Loricca today to get started.