Hacking the Hippocratic Oath: Four Ways to Shield Patients from Ransomware Attacks

Imagine a hospital plunged into darkness: no internet, no access to medical systems, and a $22 million price tag to find the light. This is not fiction – it’s the harsh reality of ransomware in healthcare. From Vermont’s largest hospital to Chicago’s leading pediatric facility, healthcare institutions have been paralyzed by these attacks, facing millions in damages and severe disruptions in patient care. 

These incidents highlight a chilling reality: the healthcare sector is a prime target for cyberattacks in our global, digitally interconnected era. The threat isn’t just financial assets or data privacy; it’s an immediate danger to patient safety and the continuity of care. The urgency for fortified cybersecurity measures has never been more apparent, emphasizing the need to protect information and lives. 

The FBI revealed healthcare as the most targeted infrastructure sector by cybercriminals at 249 breaches in 2023. This shows that hackers view hospitals, clinics, and other healthcare organizations as key targets because operators tend to pay a ransom to keep critical services running. The stark reality makes cybersecurity a moral imperative, consistent with the Hippocratic Oath’s commitment to prioritizing patient well-being. 

In this century, the “doing right by our patients” creed has evolved into the critical need to care for cybersecurity in healthcare services. Healthcare and security leaders must integrate strong cybersecurity protocols as an essential element of providing quality patient care. 

As we delve into crucial strategies to consider, we’ll see how a proactive cybersecurity stance can maintain the integrity of healthcare, ensuring that care remains both continuous and secure. 

Here are four recommendations for healthcare leaders:

Mapping the minefield: Enhancing risk analysis

Adopting connected medical devices, patient records, and building management systems has significantly broadened hospitals’ internal and external digital attack surfaces. This complexity is compounded by the fact that 12% of the healthcare industry still uses end-of-life (EoL) or end-of-support (EoS) operating systems, exposing critical vulnerabilities. Accurately evaluating the security risks posed by this diverse array of connected assets, from outdated systems to cutting-edge technologies, presents a formidable challenge, yet is essential for safeguarding patient data and healthcare services.

In response, healthcare organizations must adopt a more nuanced approach to cybersecurity, focusing on devices and services’ operational behavior and adherence to established security baselines. Questions should shift toward understanding the specific security measures in place and the potential impacts of cyberattacks, aiming to devise effective mitigation strategies (e.g., comparing against “known good” behavior baselines). This highlights the importance of utilizing comprehensive risk analysis tools and methodologies to navigate the complex cybersecurity landscape efficiently, ensuring a proactive stance against potential threats.

Vigilance as a virtue: Cultivating cybersecurity awareness

It can’t be said enough: cybersecurity is the responsibility of every individual within an organization. 

Phishing is an extremely cheap and easy way for hackers to compromise an organization, whether by deploying ransomware or harvesting credentials to gain access to the network. All it takes is one employee clicking on the wrong email attachment or giving sensitive information to an unauthorized party to cause potential disruptions.

Regular educational sessions about cybersecurity hygiene, including phishing simulations, must be a core aspect of every hospital’s cybersecurity awareness effort. Reliable and robust systems for employees to report cybersecurity incidents are also needed.

Divide to conquer: The strategy of network segmentation

Technologically speaking, hospital networks are traditionally flat, consisting of network segments with little to no access controls, greatly amplifying security risks. For example, if a staff computer used to browse the web during a lunch break gets infected and has access to medical devices, servers, and so on, a breach can cause catastrophic amounts of damage in short order. 

That’s why effective segmentation policies – along with a Zero Trust architecture approach, a security model that seeks to prevent malicious actors from breaching networks and moving laterally across them – are crucial for limiting the blast radius of cyberattacks. 

Making that happen demands a coordinated effort with IT, networking, information security, lines of business, and device owners in hospitals. Echoing point #1, this is why it is so essential for hospitals to invest time in inventorying all physical and virtual assets, mapping communications, building out system-level views, and using automated technologies to monitor everything going on 24/7. Additionally, multi-factor authentication should be enabled across the entire environment.

Beyond the walls: Securing the external attack surface

The external attack surface of hospitals encompasses all points of potential vulnerability accessible from outside their internal networks, especially third-party vendors and Internet of Things (IoT) devices. While designed to enhance operational efficiency and patient care, these elements often introduce risks due to security oversights or misconfigurations. For instance, IoT devices that monitor patient health remotely can be crucial for medical care but may lack robust security measures, making them prime targets for exploitation.

Hospitals must adopt a comprehensive strategy for defending and managing their external attack surfaces to mitigate these risks. This includes conducting regular security assessments on all third-party vendors to ensure they meet stringent security standards and promptly applying security patches for IoT devices and other vulnerable systems. Therefore, hospitals can address potential external attacks that may cripple them and endanger patients’ lives by having a secure and resilient healthcare environment.

In the spirit of the Hippocratic Oath, healthcare leaders are called to heal and protect. As we navigate the digital age, let this ancient vow inspire a modern mandate: to arm our healthcare systems against ransomware. By championing risk analysis, fostering cybersecurity awareness, segmenting our networks, and securing our connected assets, we can honor our most profound commitment to do no harm. This is our call to action, a pledge to safeguard the sanctity of healthcare in every byte and every interaction. 

Incorporating advanced technologies is pivotal in this endeavor, providing healthcare delivery organizations (HDOs) with valuable tools to mitigate risks and secure digital environments. This approach aligns with our professional duty and empowers us to stay ahead of evolving cyber threats. Let’s transform this oath into our cybersecurity creed, ensuring our patients’ safety and trust in technology remain intact.

Photo: turk_stock_photograph, Getty Images

This post appears through the MedCity Influencers program. Anyone can publish their perspective on business and innovation in healthcare on MedCity News through MedCity Influencers. Click here to find out how.