Cybersecurity in Healthcare | Institute for Health Policy Leadership

By IHPL - October 1, 2024

In the modern digital landscape, cybersecurity is crucial for the daily operations of many organizations. Most healthcare facilities rely on specialized hospital information systems, including electronic health records (EHR), e-prescribing systems, practice management tools, radiology information systems, and computerized physician order entry systems.¹ The healthcare sector has long been a major focus for cyberattacks because it holds a wealth of valuable information, including patients’ protected health information; financial information, such as credit card and bank account numbers; personally identifying information, such as Social Security numbers; and intellectual property related to medical research.^2,3,4 Cyber incidents in hospitals and health systems can cause prolonged care disruptions, patient diversions, and acute care strain, leading to canceled appointments and delayed procedures. Moreover, they can jeopardize patient safety and impact communities that rely on local emergency and specialty care for life-saving treatments.³

In 2023, a new record was set with 725 major healthcare cybersecurity breaches reported to the Department of Health and Human Services Office for Civil Rights, surpassing the previous year’s record of 720 breaches.⁵ Healthcare facilities are struggling to deal with increasingly advanced cyberattacks due to facilities falling short on basic security measures, budget constraints, and challenges in hiring and retaining skilled information technology security professionals.^5,6

Therefore, in December 2023, the Department of Health and Human Services (HHS) published the Healthcare Sector Cybersecurity Strategy, which builds on the Biden Administration’s National Cybersecurity Strategy published in March 2023 and focuses on enhancing resilience for hospitals, patients, and communities facing cyberattack threats.^3,7 Specifically, the HHS aims to work with Congress to obtain funding to administer financial support for hospitals to implement high impact cybersecurity practices and propose new cybersecurity standards that will be incorporated into existing programs, including the Health Insurance Portability and Accountability Act (HIPAA) Security Rule.⁸ The HIPAA Security Rule sets national standards to safeguard individuals’ electronic personal health information handled by covered entities. It mandates the implementation of administrative, physical, and technical measures to ensure the confidentiality, integrity, and security of electronic protected health information.⁹

On March 22, 2024, the Health Care Cybersecurity Improvement Act of 2024 (S. 4054) was introduced, which would allow healthcare providers to receive advanced payments in the event of a cyber incident if they are adhering to minimum cybersecurity standards.^10,11 This legislation comes in response to a cyberattack on Change Healthcare, which had paused billing services for many healthcare providers, putting them at risk of going bankrupt.¹⁰ The Health Care Cybersecurity Improvement Act aims to amend the current Medicare Hospital Accelerated Payment Program and the Medicare Part B Advance Payment Program by introducing several key changes. It also requires the HHS Secretary to determine if the need for payments is due to a cyber incident.^10,11

Healthcare cybersecurity threats come in many forms and target a variety of systems, making it a key focus for medical information threat. However, the healthcare industry lags behind other major sectors in securing critical data, making it particularly vulnerable.¹² Therefore, healthcare organizations should implement a comprehensive hospital cybersecurity strategy to guarantee patient safety and protect all devices from misuse and attacks. This approach can ensure that every connected medical device, as well as any device containing data classified as patients’ protected health information or personally identifiable information, is fully secured.¹³ Investing time and resources in safeguarding healthcare technology and ensuring the confidentiality of patient information against unauthorized access are essential.

Author Bio:

Renée Chuang, M.S.

Renée completed her undergraduate education in Biochemistry and Sociology at the University of Oregon. She then received her Master of Science in Global Health at National Taiwan University. Currently, she is pursuing her DrPH in Health Policy and Leadership at Loma Linda University School of Public Health. Her research interests include patient-provider relationships and quality of care. When she is not studying, she can be found exploring local coffee shops in LA or training for a marathon.

Author Bio:

References