Jill is the administrator for a 25-bed rural hospital in a remote part of Texas that receives patients from almost an hour away in every direction and serves as the counties only hospital. A discussion with Jill around cybersecurity practices provides insight into the various reasons why administrators may not be aware of the danger that lies just beyond their firewall. Surprised by the implications of her internal network password policies not meeting standards, Jill states “Our hospital is one of the most remote in the state, how and why would we be targeted by hackers?” She is not alone in thinking that her geographical location will diminish the odds that their facility will be vulnerable to a cyber-attack.
Cyber attacks may be the last thing on the mind of a hospital administrator, especially if they operate in such a remote environment but when an attack happens it can unleash a nightmare scenario with devastating consequences. Take for example earlier this year when a small Michigan practice found it too costly to restore their data after an attack, they simply locked their doors and retired early. Many hospital leaders may not see cyber threat’s until it’s too late, as they can potentially put patient lives at risk while hospital services are on hold. In fact cyber exploits to rural hospitals in many cases make it a financial impossibility to survive.
Randy Myers a former rural hospital CIO and certified cyber security expert at Mandry share’s his insight into how healthcare cyber-attacks go from random to targeted.
“One of biggest misconceptions regarding cyber-attacks on healthcare facilities is that attacks are carried out by an individual at a single point in time. Take for an example a hospital’s whose network transmits PACS data through an unsecured remote desktop session. Their IP addresses are most likely flagged by hackers because PACS data can easily be identified and almost all healthcare facilities transmit PACS data. Once the flagged IP addresses are placed on the dark web, they are then purchased by another hacker who then makes a more targeted exploit. Hackers will not only use e-mails to distribute ransomware or nefarious links but also look for improper firewall configurations and old software code that has not been updated to current patch levels to further place nefarious files on the network. Many hospital IP addresses are already bought and sold on the dark web, it’s just a matter of who wants to use those IP’s to carry out a coordinated attack.”
The most difficult aspect of this relatively new threat landscape is that for many decades, healthcare data security and IT management has suffered from both a lack of dedicated funds and resources necessary to protect ePHI data. Expanding budgets in areas that do not generate revenue can be a tough pill to swallow for many but is now crucial to long term survival.
For residences of small communities, rural hospitals and healthcare clinics remain the last available resource for their families to receive medical care without having to travel longer distances. In remote regions of New Mexico and Texas a few less miles of travel can be the difference between life and death in some emergency situations. It is likely that in many cases a cyber-attack can result in a rural hospital closing its doors. Mandry technology’s data compliance and security program significantly reduces both the likelihood and impact cyber security attacks by identifying, prioritizing, and remediating vulnerabilities and gaps within the healthcare IT environment. This unique program aligns with a cost structure that allows hospitals to predict compliance costs and meet reporting deadlines for incentive programs.