Top Six Actions to Manage Hospital Cybersecurity Risks

1. Establish procedures and a core cybersecurity team to identify and mitigate risks, including board involvement as appropriate.

2. Develop a cybersecurity investigation and incident response plan that is mindful of the Cybersecurity Framework being drafted by the National Institute of Standards and Technology.

3. Investigate the medical devices used by the hospital in accordance with the June 2013 Food and Drug Administration guidance to ensure that the devices include intrusion detection and prevention assistance and are not currently infected with malware.

4. Review, test, evaluate and modify, as appropriate, the hospital’s incident response plans and data breach plans to ensure that the plans remain as current as possible in the changing cyber threat environment.

5. Consider engaging in regional or national information-sharing organizations to learn more about the cybersecurity risks faced by hospitals.

6. Review the hospital’s insurance coverage to determine whether the current coverage is adequate and appropriate given cybersecurity risks.

Related Resources

Member
Letter
Public
AHA letter to Senator Mark Warner regarding reducing cybersecurity vulnerabilities in the health care sector.
Member
Between at least June 2018 and January 2019, Nigerian cyber criminals have targeted and accessed healthcare claims payment processors throughout th
This two-part special report explores what hospital and health-system boards can do to reduce cyber risks and vulnerabilities.
Member
This PIN has been released TLP: GREEN: The information in this product is useful for the awareness of all participating organizations within their
Public
This section contains publicly available Cyber Threat Intelligence reports including FBI and TLP-White reports. For access to restricted distribution reports…