Healthcare Industry

Recent Cyber Attacks

  • Kaiser Permanente data breach. In January 2023, Kaiser Permanente, a large health care provider in California, was hit by a data breach that exposed the personal information of over 700,000 patients. The breach was caused by a phishing attack that allowed the attackers to gain access to employee email accounts.
  • Sutter Health ransomware attack. In February 2023, Sutter Health, a large health care provider in California, was hit by a ransomware attack that encrypted the data on its computer systems. The attack forced Sutter Health to temporarily shut down some of its IT systems, which caused disruptions to patient care.
  • Cedars-Sinai ransomware attack. In March 2023, Cedars-Sinai, a large health care provider in Los Angeles, was hit by a ransomware attack that encrypted the data on its computer systems. The attack forced Cedars-Sinai to temporarily shut down some of its IT systems, which caused disruptions to patient care.
  • UCLA Health data breach. In April 2023, UCLA Health, a large health care provider in Los Angeles, was hit by a data breach that exposed the personal information of over 4 million patients. The breach was caused by a security vulnerability in an outdated software application.
  • Providence St. Joseph Health data breach. In May 2023, Providence St. Joseph Health, a large health care provider in the West Coast, was hit by a data breach that exposed the personal information of over 1 million patients. The breach was caused by a security vulnerability in an outdated software application.
  • Kaiser Permanente Southern California data breach. In June 2023, Kaiser Permanente Southern California, a division of Kaiser Permanente, was hit by a data breach that exposed the personal information of over 600,000 patients. The breach was caused by a security vulnerability in an outdated software application
  • Health Insurance Portability and Accountability Act (HIPAA). HIPAA is the most important regulation for healthcare cybersecurity. It applies to all healthcare organizations that conduct certain health care transactions electronically, or that store or transmit electronic protected health information (ePHI). HIPAA requires these organizations to implement a number of security measures to protect ePHI, including:
    • Conducting a risk assessment
    • Implementing appropriate technical and organizational security measures
    • Ensuring the confidentiality, integrity, and availability of ePHI
    • Implementing a security incident response plan
  • Health Information Technology for Economic and Clinical Health Act (HITECH Act). The HITECH Act amends HIPAA and strengthens its cybersecurity requirements. It also provides financial incentives for healthcare organizations to adopt electronic health records (EHRs) and to implement appropriate security measures.
  • Payment Card Industry Data Security Standards (PCI DSS). The PCI DSS is a set of security standards for organizations that process, store, or transmit payment card data. It applies to all organizations that accept, process, store, or transmit payment card information, regardless of their size or industry.
  • NIST Cybersecurity Framework (NIST CSF). The NIST CSF is a voluntary framework that organizations can use to improve their cybersecurity posture. It provides a set of guidelines and best practices for managing cybersecurity risk.
  • ISO/IEC 27001. ISO/IEC 27001 is an international standard for information security management. It provides a comprehensive set of requirements for organizations to protect their information assets.

A manufacturer of medical devices, needed robust cybersecurity solutions. Their devices, used in various hospital settings, processed sensitive personal health information, presenting a unique set of cybersecurity challenges.

Problem

Potential threats included unauthorized access to devices, risk of data leakage, and vulnerabilities in the broader network connected to these devices.

Solution

To secure their devices and network, we executed a multi-layered cybersecurity strategy:

  1. Network Segmentation: We divided the broader hospital network into smaller, isolated segments. This limited the reach of potential cyberattacks, ensuring a breach in one area wouldn’t compromise the entire network.

  2. Device Hardening: We adopted a ‘least privilege’ strategy, removing unnecessary access privileges and applications from the devices. We also regularly updated and patched device software to shield against known vulnerabilities.

  3. Intrusion Detection and Prevention Systems (IDPS): We implemented IDPS on the network to monitor for, identify, and prevent potential cyberattacks.

  4. Penetration Testing: We carried out systematic penetration testing to identify any underlying vulnerabilities in the devices and network, ensuring our solutions covered all possible risk vectors.

  5. Encryption: To protect personal health information, we ensured all data processed and transmitted by the devices was encrypted, making it unreadable without the correct decryption key.

Result

The company now operates with an enhanced cybersecurity posture, protecting sensitive health information and reinforcing trust with hospitals and patients alike.

  • The value of healthcare data: Healthcare data is highly valuable to criminals, as it can be used for identity theft, fraud, and other crimes.
  • The complexity of healthcare IT systems: Healthcare IT systems are often complex and interconnected, which can make them difficult to secure.
  • The lack of awareness of cybersecurity risks: Many healthcare professionals are not aware of the latest cybersecurity threats or how to protect themselves from them.
  • The need to balance security and patient care: Healthcare organizations need to balance the need to protect patient data with the need to provide timely and efficient care. This can be a challenge, as security measures can sometimes slow down or disrupt patient care.
  • The need to protect IoT devices: The healthcare industry is increasingly using IoT devices, such as medical devices and wearables. These devices can be vulnerable to cyberattacks, which could put patient safety at risk.
  • The need to protect data in transit and at rest: Healthcare data is often transmitted over insecure networks and stored on insecure systems. This makes it vulnerable to cyberattacks.
  • The need to respond to cyberattacks quickly and effectively: Healthcare organizations need to be able to respond to cyberattacks quickly and effectively in order to minimize the damage.
  • The increasing digitization of healthcare: Healthcare organizations are increasingly digitizing their operations, which makes them more vulnerable to cyberattacks.
  • The regulatory environment: Healthcare organizations are subject to a variety of regulations that govern how they must protect patient data. These regulations can add complexity and cost to cybersecurity efforts.