Preparing for cybersecurity threats

Health care entities should not wait for a cyberattack to occur at their organization or for regulatory requirements to further develop before thinking about enhancing their cybersecurity posture. The following practices may help prevent or mitigate cyberattacks and reduce the impact of potential breaches.

Implement high-value security measures: Ideally, companies would be able to fully align their security programs with industry best practices, such as those outlined by NIST or ISO 270001. However, many companies find that their breaches are caused by a lack of cybersecurity basics, such as multifactor authentication (MFA), strong passwords, publicly inaccessible cloud storage systems and regular patching and/or updating of systems.
Conduct security assessments: Regular security assessments help proactively identify gaps and vulnerabilities so that an organization can allocate resources to address such risks. Such assessments may focus on compliance with the HIPAA Security Rule or alignment with the NIST framework, focusing on the organization's needs and obligations. It is prudent to address risk assessment findings without delay, as these are often the first documents scrutinized by regulators and sought by plaintiffs in discovery.
Evaluate stored data: Regular evaluations of patient data can help identify information that requires additional security measures. Data audits can also help organizations spot redundant or nonessential data that may pose cybersecurity risks and provide organizations with an opportunity to delete such unneeded data.
Segregate sensitive data: Storing sensitive data sets, such as patient records, alongside less-sensitive data, like marketing information, can lead to trouble for some organizations. For efficiency, organizations want certain data to be easily accessible to many employees; however, sensitive patient data requires heightened security protocols (e.g.,encryption and strict access controls), which can help mitigate risks arising from security incidents and breaches.
Tabletop exercises:Tabletop exercises can reinforce education materials and policies and procedures, reducing potential error. Effective tabletops usually involve realistic scenarios tailored to a particular organization. Additionally, tabletop exercises tend to be more effective when they include participation by key decisionmakers who would be involved in a live incident.
Implement contingency plans: Contingency plans are key to help ensure continuity, including uninterrupted care delivery and electronic claims submission in the event of a security incident. Such efforts may include plans for maintaining operations when computer systems and networks are down, including establishing manual processes for patient care when certain software and email systems are inaccessible. Contingency planning may also involve the development of alternative communication protocols, such as a text tree or temporary use of non-work email systems (e.g., Gmail, Outlook.com), if a company's email and/or telephone systems are interrupted or offline; however, such alternatives should be secure and compliant with legal requirements (e.g., HIPAA) for dealing with sensitive patient data. Organizations may develop situation-specific response plans that are regularly updated to address the latest threats and regulatory obligations.

Responding to a security incident

Ideally, when a cybersecurity incident occurs, the impacted entity has already established a response plan that it regularly tests, practices and updates. In practice, though, cyberattacks too often affect companies that are unprepared to deal with them. A company that falls victim to a cyberattack should act fast and appropriately to manage the regulatory, legal, reputational and business consequences. Organizations should consider taking proactive measures after a cyberattack, including the following steps to mitigate enforcement and litigation risks.

Involve senior executives: An organization's IT staff cannot solely fix the far-reaching implications of cyber incidents—the involvement of senior executives is crucial to pulling a company through the crisis. Senior executives, including the CEO and those responsible for communications, technology, legal and compliance, should be ready to take the lead on crisis management. With the assistance of external counsel and other professional service providers, they can make effective strategic decisions and coordinate internal and external resources to execute them.
Isolate the system and fix vulnerabilities: After experiencing a cyberattack, an entity should act fast to take the affected system offline to prevent further damage to itself or its customers. As forensic investigators and lawyers examine the cause of the incident, the IT team should focus on identifying and fixing vulnerabilities so that the organization can bring its systems back online as soon as possible.
Engage experienced outside counsel: Outside counsel can offer experience in dealing with breaches, including overseeing a forensic investigation, determining whether notification obligations are triggered and the requisite timing, and litigating such matters when necessary. Effective outside counsel can also explain complex technical and legal concepts to patients, customers, regulators and even Congress. Lawyers also routinely develop and oversee breach-related communications with the public, customers, employees and affected parties. In appropriate circumstances, involving outside counsel may help facilitate more open discussions with employees due to attorney-client privilege.
Communicate promptly and accurately: Customers, regulators and other parties potentially affected by a breach often expect immediate responses to inquiries about a breach. Such communications should be carefully crafted, as such parties have sought to hold organizations liable for inaccuracies in communications related to a breach. Moreover, certain federal and state laws and regulations require breach notifications, but not every incident triggers such obligations. Careful legal analysis, informed by forensic investigation results, can determine when, whom, and how to notify. In some cases, it may even be prudent to initiate a dialogue with regulators before submitting a formal notice.
Coordinate with third parties: Before a breach occurs, a health care organization may consider establishing relationships with third-party cybersecurity experts, outside counsel, law enforcement, and other relevant organizations. Such practices help health care organizations quickly tap into additional expertise and assistance during a cybersecurity event.

Looking ahead

Health care organizations will continue to face sophisticated cyber threats, which necessitates both safeguarding systems and staying up to date with the latest regulations. However, comprehensive risk management is critical and goes beyond implementing technical solutions. It also consists of updating policies, training staff, segregating sensitive data, implementing robust contingency plans and conducting proactive security assessments.

Instant Insights /

Change Healthcare, Kaiser Permanente cyberattacks: A wake-up call for health care

More From HR Executive

Related Stories

Recommended For You