The importance of cybersecurity in protecting patient safety
A high-level guide for hospital and health system senior leaders
By John Riggi, Senior Advisor for Cybersecurity and Risk, American Hospital Association
Health care organizations continually face evolving cyberthreats that can put patient safety at risk. That’s why I advise hospital C-suite and other senior leaders not to view cybersecurity as a purely technical issue falling solely under the domain of their IT departments. Rather, it’s critical to view cybersecurity as a patient safety, enterprise risk and strategic priority and instill it into the hospital’s existing enterprise, risk-management, governance and business-continuity framework.
Aligning cybersecurity and patient safety initiatives not only will help your organization protect patient safety and privacy, but will also ensure continuity of effective delivery of high-quality care by mitigating disruptions that can have a negative impact on clinical outcomes.
Why health care gets hit more
Health care organizations are particularly vulnerable and targeted by cyberattacks because they possess so much information of high monetary and intelligence value to cyber thieves and nation-state actors. The targeted data includes patients’ protected health information (PHI), financial information like credit card and bank account numbers, personally identifying information (PII) such as Social Security numbers, and intellectual property related to medical research and innovation.
In fact, stolen health records may sell up to 10 times or more than stolen credit card numbers on the dark web. Unfortunately, the bad news does not stop there for health care organizations — the cost to remediate a breach in health care is almost three times that of other industries — averaging $408 per stolen health care record versus $148 per stolen non-health record.1
How cyberattacks threaten patient privacy, clinical outcomes and your hospital’s financial resources
Cyberattacks on electronic health record and other systems also pose a risk to patient privacy because hackers access PHI and other sensitive information. By failing to keep patient records private, your organization could face substantial penalties under HIPAA’s Privacy and Security Rules, as well as potential harm to its reputation within your community.
Most importantly, patient safety and care delivery may also be jeopardized. Losing access to medical records and lifesaving medical devices, such as when a ransomware virus holds them hostage, will deter your ability to effectively care for your patients. Hackers’ access to private patient data not only opens the door for them to steal the information, but also to either intentionally or unintentionally alter the data, which could lead to serious effects on patient health and outcomes.
Another example: Patient outcomes were threatened when Britain’s National Health Service was hit as part of the May 2017 “WannaCry” ransomware attack on computer systems in 150 countries, resulting in ambulances being diverted and surgeries being canceled. Since that time there have been other instances of ambulance diversion orders issued due to ransomware, including here in the U.S. With proper planning and investment, however, it’s possible to mitigate this risk. As I told Congress last July, “The impact of Wannacry on American hospitals and health systems was far less serious, which speaks to the tremendous efforts the field has made to improve cybersecurity and build incident-response capabilities.”
Take steps to protect your organization
The cyber bad guys spend every waking moment thinking about how to compromise your cybersecurity procedures and controls. The best defense begins with elevating the issue of cyber risk as an enterprise and strategic risk-management issue. If possible, you should also dedicate at least one person full time to lead the information security program, and prioritize that role so that he or she has sufficient authority, status and independence to be effective. Furthermore, you and your team should receive regular updates on your organization’s strategic cyber risk profile and whether adequate measures are dynamically being taken to mitigate the constantly evolving cyber risk.
Finally, the most important defense is to instill a patient safety-focused culture of cybersecurity. This enables health care organizations to leverage their existing culture of patient care to impart a complementary culture of cybersecurity. A culture of cybersecurity, where the staff members view themselves as proactive defenders of patients and their data, will have a tremendous impact in mitigating cyber risk to the organization and to patients.
As senior advisor for cybersecurity and risk for the American Hospital Association, I am available to assist your organization in uncovering strategic cyber risk and vulnerabilities by conducting an in-depth cyber-risk profile, and by providing other cybersecurity advisory services such as risk mitigation strategies; incident response planning; vendor risk management review; and customized education, training and cyber incident exercises for executives and boards. Please contact me for more information at 202-626-2272 or jriggi@aha.org.
John Riggi, having spent nearly 30 years as a highly decorated veteran of the FBI, serves as senior advisor for cybersecurity and risk for the American Hospital Association (AHA) and its 5,000-plus member hospitals. In this role, Riggi leverages his distinctive experience at the FBI and CIA in the investigation and disruption of cyberthreats, international organized crime and terrorist organizations to provide trusted advisory services for the leadership of hospital and health systems across the nation. His trusted access to hospital leadership enhances his perspective and ability to provide uniquely informed risk-advisory services.
While at the FBI, Riggi also served as a representative to the White House National Security Council, Cyber Response Group. He also led the FBI Cyber Division national program to develop mission-critical partnerships with the health care and other critical infrastructure sectors for the exchange of information related to national security and criminal cyberthreats. Riggi held a national strategic role in the investigation of the largest cyberattacks targeting health care and the critical infrastructure of the nation. He is the recipient of the FBI Director’s Award for Special Achievement in counterterrorism and the CIA George H.W. Bush Award for Excellence in Counterterrorism, the agency’s highest award in this category.