The inability to adequately assess and understand the risks that vendors pose is becoming incredibly costly to healthcare providers, according to a  report released today by Censinet and the Ponemon Institute. According to the research, the yearly hidden costs of managing vendor risk is $3.8 million per healthcare provider, far surpassing the $2.9 million that each data breach costs providers. The cost across the healthcare industry is $23.7 billion per year. The research also indicates that 56 percent of healthcare organizations have experienced a data breach introduced by one or more third-party vendors in the last two years.

The report, “The Economic Impact of Third-Party Risk Management in Healthcare,” found that 72 percent of respondents believe the increasing reliance upon third-party medical devices connected to the internet is risky, and 68 percent say moving to the cloud while connecting medical devices to the internet creates significant cyber risk exposure. Two out of three respondents believe that current manual risk management processes cannot keep pace with cyber threats and vulnerabilities, while 63 percent believe they cannot keep pace with the proliferation of digital applications and devices. Reliance on inefficient third-party vendor risk management processes and the inability to automate risk assessments and remediation has created an environment where third-party breaches are commonplace and expensive.

These inefficiencies and escalating breaches exist despite the number of resources – both known and hidden – that are involved in the vendor risk management process. The report states that the average healthcare provider has 3.21 dedicated full-time employees spending more than 500 hours per month completing vendor risk assessments. However, the research uncovered that there are significant, additional hidden costs – including the involvement of information security and risk staff, supply chain managers, clinicians, and line of business managers – which increase that number by 10x to 5,040 hours per month that healthcare providers spend managing third-party vendor risk. Even with this time and resource commitment, 60 percent of respondents still believe that time spent on vendor risk assessments takes resources away from other important tasks.

Additional findings of the report include:

• Healthcare providers have an average of 1,320 vendors under contract, but just 27 percent said that they assess all vendors annually;
• Fifty-nine percent of respondents said that they believe senior executives in their organization can bypass the third-party assessment process in order to secure a lucrative business relationship, creating an enormous loophole for even the most effective vendor risk management programs;
• Eighty percent of healthcare providers believe that prioritization of vendor risks is very important – but only 36 percent believe their ability to do so is very effective; 
• Only 40 percent of respondents say that they believe vendor assessments as they exist today are very valuable for the actionable insights they provide to the C-suite and board of directors; 
• Only 21 percent of all vendor risk assessments result in a requirement to remediate prior to doing business with the healthcare provider while only 11 percent result in disqualification.

“It’s clear that healthcare providers are in a tough spot. The number of vendors they rely on is increasing at the same time the threats those vendors pose are escalating in frequency and severity, so it’s easy to see how managing these risks has become an overwhelming problem,” said Dr. Ponemon, chairman and founder of the Ponemon Institute. “But it’s not all bad news – we can very clearly see an opportunity with automation for healthcare providers to monitor, measure, and mitigate the scourge of third-party breaches that continues to plague their industry.”

The vast majority of respondents recognize the importance of automation, such as continuously updating changes to third-party risk (78 percent) and standardizing vendor assessment questionnaires (74 percent) – but only 38 percent are able to achieve automation of each capability. In fact, only one-third of respondents said that they are automating most of their vendor assessment programs, which means that the vast majority of healthcare providers continue to rely on manual, inefficient processes to mitigate third-party risk.