Healthcare organizations are currently stretched thin as they to work to serve patients’ needs at higher volumes than usual while keeping themselves afloat, business-wise. These concerns alone could leave an organization with limited bandwidth to fend off cyber threats, but some companies must also navigate remote work environments for portions of their teams, as well as the tremendous increase in telehealth sessions. Each of these factors places healthcare organizations at a more elevated risk for cyber threats.

The University of California’s School of Medicine paid out $1.14 million to hackers in order to reclaim their data in a ransomware attack in late June. Back in April, Microsoft found that several dozen hospitals had “vulnerable gateway and VPN appliances in their infrastructure,” according to a warning they released. Threat actors are actively scanning the internet for these types of vulnerabilities. While phishing and other social engineering attacks have increased, Microsoft noted that more complex and dangerous threat activity is emerging.

While the 2020 Egress Insider Breach survey found that phishing posed the largest risk vector, sending information to the wrong person, such as by email, was also a major cause of data breaches. Some of the key factors reported by employees who had been involved in these kinds of data breaches were using a mobile device, rushing, and tiredness – factors which are exacerbated under the heavy demands of the pandemic.

As healthcare fraud causes $300 billion in industry losses annually, it is crucial that organizations take proactive measures to stay ahead of these threats. Josh Gluck, Vice President of Global Healthcare Technology Strategy at Pure Storage, recommends that organizations focus on identity management, multifactor authentication, and data life cycle management. He emphasizes the importance of being able to identify all members of an organization in concert with their roles and data access. In terms of data life cycle management, by knowing where data is stored, he says, an organization can track if that data is being moved or stored in suspicious ways, or ways that make the data more vulnerable to attack.

Though the threats may seem formidable, healthcare organizations do have recourse to protect themselves.