As forecasted over the past several years, the number of cybersecurity attacks in healthcare continues to increase at a faster pace than other industries. In fact, since the outbreak of COVID-19 earlier this year, criminal hackers have been more aggressive. In the first three months of 2020, many health systems have seen a 273% increase¹ in attempts compared to the same period in 2019. At TRIMEDX specifically, we have seen an average increase from 19 to 80 threats per month.
These recent events highlight the impact of what can happen when an attack occurs. According to well-publicized reports, the IT infrastructure of a major U.S. healthcare system was taken offline requiring manual filing of patient information, surgery cancellations and re-routing of ambulances to other facilities. In another recent occurrence, a ransomware attack at a hospital in Germany was attributed to a patient’s death.
Yes. The potential of financial loss and brand erosion are serious concerns but understanding the impact medical device cybersecurity can have on patient safety is paramount for healthcare organizations.
As we consider this, here are three questions worth asking as we observe National Cybersecurity Awareness Month in October:
- Do you know what your medical device cybersecurity exposure looks like?
- Do you have the expertise to know what can be done to improve it?
- Can you prove, through objective measurement that your medical device cybersecurity program is effective?
To address these questions, here are some tangible steps to consider:
- Collect an accurate, real-time inventory of all connected medical devices as well as non-medical devices providing medical care. Obtain a complete device record that provides a comprehensive security score for every device incorporating such things as: patient safety, vulnerabilities, alerts & recalls and suspicious behavior.
- Leverage expertise to ensure the correct remediation actions are taken to reduce the risk exposure on every device.
- Perform the necessary remediation work based on risk prioritization, ensuring the devices at greatest risk are addressed first.
- Demonstrate, in quantifiable terms, that the remediation work being performed is yielding the desired results.
Of course, an effective medical device cybersecurity solution requires more than the ability to gather raw data. For example, having effective automated tools to detect vulnerabilities that may be exploited by threats in a timely manner is critical. In addition, qualified specialists must be available to proactively review the findings and remediate vulnerabilities to improve overall risk posture.
When key data elements are available and linked together in intuitive workflows and informational dashboards, the evidence of actual progress―an improved security posture―can be measured. When this happens, confidence that the right things are happening at the right time increases dramatically.
By combining deep medical device and cybersecurity expertise, TRIMEDX bridges the gap between medical device regulatory compliance as well as critical cybersecurity elements for a truly comprehensive management strategy.
To learn more about how we can help you better secure your medical devices, please contact us.
¹“UHS hospital chain hit with apparent ransomware attack.” Healthcare IT News. 29 Sept. 2020, https://www.healthcareitnews.com/news/uhs-hospital-chain-hit-massive-ransomware-attack