The Executive Suite: 4 Ways to protect your medical practice from cybersecurity threats

It’s been more than two years since the healthcare industry was forced to rapidly adopt virtual care services at the beginning of the pandemic, and all signs point to digital technology remaining a key part of the healthcare experience long into the future. While this has greatly improved our ability to deliver care, there’s been one unintended consequence that’s remained too often overlooked: an explosion in cyber attacks that have become more frequent and sophisticated across provider networks.

In fact, cybersecurity breaches hit an all-time high in 2021 and exposed the protected health information of nearly 45 million individuals – a record amount that has tripled in just three years. That threat has only grown with the Biden Administration warning about the potential for Russia to conduct malicious cyber activity against the United States and urging the private sector to ‘immediately’ harden cyber defenses. Lawmakers have signaled that they are working to shore up funding for cyber defense among critical infrastructure entities, including healthcare. In the meantime however, there’s four specific steps that providers of all types and sizes can implement today to better protect themselves against bad actors.

1. Combine defense tools with security awareness trainings

There are a plethora of cyber tools available to protect organizations. But many of these protections focus on preventing external threats, not internal weaknesses. A provider’s first line of defense is its employees. Many workers lack a sound understanding of actions that may leave companies vulnerable to cyberattacks – whether it is granting access to unknown personnel or using unsecured networks.

In fact, recent data indicates basic human error is the leading cause of medical breaches. The best way for organizations to combat this is to bolster employees’ knowledge of cybersecurity through training programs and incident response plans.Security awareness training should cover, but not be limited to: how to spot phishing and scams, tips for password management, and device security. By educating employees on the consequences of a security breach and best practices to mitigate risk, security and IT leaders can reduce, or possibly even eliminate, cyberattacks.

2. Boost password management tactics

In today's cloud-based world, good password hygiene is key to protecting against cyberattacks. Despite constant warnings from security experts, many users use the same simple passwords across their applications – often using their birthdays, addresses, or names of pets – making them low-hanging fruit for hackers. The recycling of passwords is convenient, but it allows hackers to gain access into several accounts through a single successful attack. To ensure password safety, users should make sure they’re staying up to date with evolving password standards. These days, many platforms enforce the use of short, complex passwords that require special characters, a mix of upper and lowercase letters and numbers. Recently, however, the emphasis has shifted from complexity to length, as they are harder to crack and easier to remember than a string of random characters.

Creating a secure password isn't a fail-safe though, especially if it's not stored properly. Often, passwords are stowed in documents or spreadsheets, or auto-logins through web browsers for faster entry. As a result, hackers no longer waste brainpower cracking codes. All that’s needed is physical or remote access to the computer. To prevent this from happening, provide employees with a secure password manager application, that itself is guarded by a lengthy password, to ensure complex account credentials are safely stored. This way, employees can rely on the tool to create unique passwords for each application.

Lastly, the success of organizations’ password security policy depends on whether users share passwords. By taking steps to establish and communicate a policy prohibiting the action and closely monitoring access controls, organizations can minimize the risk of both internal and external threats, and create a more safe environment overall.

3. Implement stricter access management

In today's distributed workforce, understanding who has access to what information is just as essential to security as strong password management. By restricting access rights to a subset of users with role-based management, businesses can minimize security risk, as employees are unable to expose information they don't have access to.

To follow the lifecycle of access removal, employers should:

Assess and analyze the current data, users, process flows, and procedures
Assign users to appropriate roles and privileges
Monitor access privileges regularly. Employee onboarding, off-boarding and organization restructures can put businesses at risk if not handled properly
Regularly audit privileges to keep tight control over access

Insufficient access management can cause irreversible damage to healthcare organizations and their patients. By implementing more stringent access rights and standardized steps for verification, providers can ensure data security is not jeopardized during day-to-day operations, while also reducing the administrative burden placed on healthcare personnel.

4.Secure sensitive data with encryption

As providers become increasingly challenged by evolving threats, encryption software has become more important than ever, as it enables businesses to shield sensitive data from the clutches of cyberattackers. Data encryption is a security method where information is encoded into an unreadable form, rendering it useless to anyone without the virtual key. In any context, data should be encrypted at all times – both at rest and in transit – on computer systems and the cloud.

Through robust encryption, businesses can enhance their online security, support data integrity against hackers and data corruption, protect intellectual property, while also ensuring they remain compliant with industry-wide regulatory standards like the Health Insurance Portability and Accountability Act (HIPAA).

Protecting against cyber attacks today could save you tomorrow

If these past few years have taught us anything, it’s that we should anticipate a growing number and variety of cyber threats – both in the year ahead and long into the future. While there’s little that we can do to stop attacks from occurring, the greatest measure of protection is preparing our defenses before bad actors strike rather than waiting until it’s too late.

Doing so will both help give peace of mind during these troubling times and ensure providers can focus on what matters most: delivering the best quality patient care.