Another recent survey noted that nearly one-in-four healthcare providers reported an increase in patient mortality due to ransomware. Case in point—one pending lawsuit alleges that a severe ransomware attack at a hospital in Alabama compromised the quality of care and availability of fetal monitoring equipment—leading to the eventual death of a newborn. The filing is the first credible public claim linking the loss of a human life directly to a cyberattack. Ransomware also contributed to the circumstances surrounding a German woman’s death in September 2020.

Security is stuck in the middle
Despite rapidly escalating risks, many clinicians also continue to resist strict network controls that could inhibit access to information and communications to treat patients and save lives. When I talk with healthcare security leaders, they all feel the pressure that any decision they make right now could be impacting a life in one way or another. A common thing that’s happening is when they go to install a new network or security control to reduce the hospital’s attack surface, doctors respond by saying, “Well, if you do that, you're going to harm my patient.” There aren’t many other industries where security teams have to also worry about directly protecting people’s lives.
Security professionals are really stuck in the middle. You want to be able to do your job to protect the broader network from attack, but you also don't want to implement a control that might impact a patient’s quality of care by blocking a doctor’s access to critical, life-saving resources. It feels like a no-win situation for healthcare security teams.

A broader history of healthcare security stagnation
Statistics show that healthcare has fallen behind other industry sectors in its ability to detect, prevent, and mitigate cyberattacks. The average healthcare organization takes 236 days to detect a data breach and 93 days to mitigate damages—versus an overall industry average of 207 and 73 days, respectively. While the criticality of slow and ineffective healthcare security has clearly escalated during the COVID era, the underlying conditions that have led to this crisis have been allowed to persist for years.

Health IT Homepage