A look inside the fraught world of hospital cybersecurity
Rick Bowmer/AP Images
- Hospitals are appealing targets for hackers because they are data-rich and typically have less cybersecurity prevention technology in place, compared to other industries.
- A hospital breach in May shut down 16 hospitals in the UK , and security information specialists are saying that it's time to improve hospital cybersecurity.
What happens when hackers target hospitals for money and patient information?
It happened in May this year, when the notorious software exploit WannaCry wiggled its way into the United Kingdom’s National Health Service computer network. The breach ultimately saw 16 hospitals shut down throughout the UK until things could be normalized. Hospital employees trying to use their computers during this time were unable to do anything useful. Instead, they were prompted to liberate their systems by sending $300 worth of Bitcoin to the anonymous attackers.
The medical world took notice. Speaking at HubWeek, Boston’s weeklong festival on art, science, and innovation, Senior Vice President and Chief Medical Officer of Massachusetts General Hospital Briton O’Neill gave attendees the broad strokes on the dicey topic of hospital cybersecurity.
“We have 72,000 employees with credentials to log into our computer system,” says O’Neill. “Our network has many components, including a financial clearance system and an electronic health records database. Not all 72,000 employees can get into each component, but having this number of people can make it easier for criminals to access our network with a phishing attack, for example.” (He emphasized that his organization has implemented some robust anti-phishing training for employees.)
Despite enabling great convenience, technology can also increase the potential for harm. “You can do a lot with the information contained in a health record: get a mortgage, file insurance claims, open a credit card, get a mortgage,” says Jagar Kadakia, Chief Information Security and Privacy Officer of Boston-based Partners HealthCare. “It’s way more valuable than a credit card number.” To steal a few thousand paper records would require a truck. To steal the social security numbers, addresses, and driver’s license data for 136 million Americans would only require a USB drive. It’s why every medical organization of consequence has a highly technical, no-nonsense cybersecurity team in the trenches daily, supporting the staff providing medical care and making sure patient data stays where it belongs.
“The healthcare industry has traditionally had weaker control sets in place versus, let's say, the financial industry,” says Kadakia. Hospitals are appealing targets for hackers because they are not only data-rich, but generally more susceptible. “Our aim is to have security on par with large financial institutions.”
There are a variety of government committees that address the topic of hospital cybersecurity, but they have yet to make meaningful progress on how to legislate. This means hospitals still have no formal guidelines that say they need to do “X, Y, and Z” in order to be secure. Despite this uncertainty, however, Kadakia is optimistic about the future.
“This will improve over time just like anything else improves over time.”
NOW WATCH: A Navy SEAL explains why you should end a shower with cold water