COVID-19 catalyzed greater connectivity in the healthcare space. Take telehealth, for example. Stay-at-home orders quickly escalated telehealth from a promising innovation to an essential priority. In a matter of months, organizations had to quickly shift their IT budgets, scopes, and schedules to leverage their existing technologies and get providers and patients on board.
We’ve seen impressive statistics in increased adoption in this short timeframe. The Centers for Medicare and Medicaid Services estimated approximately 13,000 telehealth appointments per week before the pandemic and at least 10 million total, breaking down to roughly 625,000 per week from early March through mid-August.
A changing—and challenging—healthcare ecosystem
Yet healthcare organizations face numerous complex challenges in the long-term implementation, adoption and protection of connected devices, services and solutions.
Telehealth, for example, shifts the point of care by allowing electronic interactions and telemetry between providers and patients — through video, audio, patient portals, and beyond. Telehealth also changes elements within the healthcare ecosystem, such as diagnostic devices, electronic health records and devices for services like connected robotic surgery. This forces the integration of systems and devices across the continuum of care.
An intensifying threat landscape
For healthcare organizations, cyber-attacks can cause all types of devastation. Threat actors can use malware or exploit hardware vulnerabilities to take systems offline—impeding essential exchanges of information and delaying vital care. Health devices can be hacked, leading to patient harm, even death. And loss of patient data can lead to serious legal problems, damaged reputations and fines.
The response to COVID-19 heightens these vulnerabilities. For example, a recent article in Wired explains that “skeleton crews at the office and general distraction can create windows of vulnerability. And in times of stress or distraction, people are more likely to fall for malicious scams and tricks.”
We’re already seeing the repercussions. When a healthcare network with over 400 facilities fell victim to ransomware, the organization was forced to delay appointments and test results and reroute emergency room patients. Another ransomware attack in Germany forced a patient with a life-threatening condition to be moved to another facility, with tragic results. In other incidents, cybercriminals have been taking advantage of pandemic vulnerabilities to steal patient data, sell hospital network administrator credentials on the dark web and more.
More connections increase the risk
The interconnected, multi-component nature of much health IT infrastructure today adds to the cybersecurity challenge. In telehealth, for example, many applications involve a user logging in through a simple app via their tablet, phone, or computer. Behind this log-in may be several vendors and a complex underlying infrastructure, all open to risk.
To free up their resources to focus on their core competency of patient care, many organizations have their back-end and cloud infrastructure hosted and managed by third parties. Yet cybercriminals often target managed service and cloud providers, attracted by the allure of taking down several organizations at once.
As organizations integrate with external providers, they must be cognizant of the risk as well as the opportunity. Any component that’s compromised in one area of such a connected solution could potentially compromise information or operations in another area. Threat actors recognize this vulnerability as well, expanding their tactics from just one application to anything that happens to be on a device or in a network.
In short, connected solutions like those increasingly present in the medical field are rapidly expanding the attack surface for cyberattacks, and the increase of intersection points that come with the cloud, virtual private networks, and collaborative spaces are putting data at risk.
Security by design—and at every step
When designing new solutions, organizations need to simultaneously consider both user experience and cybersecurity. We’ve seen medical devices recalled for lacking proper encryption for data in transit, potentially exposing patient information. Both manufacturers and providers need to mitigate such vulnerabilities moving forward. For example, a home health monitor should have security controls that are easy to understand and operate, even by a patient who’s not feeling well.
Moreover, cyber protection should be “baked in” to new product and solution design, especially for new technologies that are being releasing quickly. As the healthcare sector continues to adopt connected health systems and realize its promise, security cannot be an afterthought.
