With healthcare systems already facing challenges, security is another vulnerability that is being exploited by cyber criminals. Cyberattacks have occurred frequently over the past few months, taking advantage
Unfortunately, the danger this poses to people is very real: last month a patient died a when a ransomware attack forced them to be diverted from one hospital to another.
However, data shows that healthcare providers don’t have the staff or updated technology to ward off attacks. In fact, cybersecurity healthcare services provider CynergisTek’s latest report found that just 44% of healthcare providers met the criteria details within the National Institute of Standards and Technology’s Cybersecurity Framework (NIST CSF).
Universal Health Services recently experienced its own security breach. Earlier this month, its computers started to fail, leading to a full network shutdown throughout all its U.S. facilities. Nurses reported having difficulties with an online medication system, while a cardiologist at a UHS facility said he'd had to cancel several surgeries.
Luckily, the King of Prussia, Pennsylvania-based company said that major information systems such as the electronic health record were not affected by the attack. But one week later, it was still recovering from the incident. "The recovery process has been completed for all servers at the corporate data center. All U.S. based inpatient facilities have connectivity established back to the corporate data center and are in process of securely connecting to those systems," the company said in a statement. "In the meantime, our facilities are using their established back-up processes including offline documentation methods.”
Experts believe the attack was the result of Ryuk ransomware. Earlier this year, the U.S. Department of Health and Human Services issued a warning about Ryuk, which originated in North Korea. Experts say the malware can be difficult to detect and contain.
So, what should healthcare providers do to protect themselves and their patients? "Modern response efforts should consist of appropriate backup storage procedures, planning for a when, not if, you were to get compromised," said Neal Dennis, threat intelligence specialist at Cyware.
