It doesn’t matter if you run a small business or lead a multi-national corporation. It doesn’t matter if you’re in the retail space or big tech. Cyber security has to be a focal point. But if there’s one industry that’s especially vulnerable today, it’s healthcare.
How Healthcare Companies Can Prioritize Cybersecurity
COVID-19 has taken everyone by surprise. And while the chief focus will always be the health and well-being of patients, there’s another grave concern in the healthcare industry: cybersecurity.
Over the next few weeks and months, hospitals, clinics, and other healthcare companies will need to be more diligent than ever to avoid being compromised. Cybersecurity must be a priority – and here are some recommended action steps:
1. Be Strict With Software Updates
Software updates are annoying, but they exist for a reason. Generally speaking, these updates are designed to improve functionality and close up security loopholes. If you continue to use an outdated version of your software, you risk being exposed. At the very least, you’re missing out on certain protective elements and safeguards that the vendor deems to be important.
2. Practice Over-the-Top Password Integrity
Passwords can be annoying – we hear you loud and clear. But strong passwords are one of the best and last lines of defense in a cyber attack or data theft situation.
Be over-the-top with your password integrity. Require complex passcodes – and make them expire every few weeks so that employees are forced to change them. In cases where there’s sensitive data inside, require two-factor authentication.
If employees give you pushback for adding friction to the login process, help them understand why you’re doing it. They may not be aware of the risks that exist. Educating your team on the need for greater cybersecurity is always a smart idea.
3. Train Staff to Spot Attacks
Research shows that four out of five physicians have been a victim of some sort of cyber attack in recent years. More than half of these were phishing-related attacks.
Phishing attacks are typically carried out via email and are designed to entice recipients to reveal private and sensitive information – like patient information, passwords, etc. They can also be used to trigger ransomware and viruses that infect computers and/or networks.
One in three physicians say their practice has suffered a shutdown related to a cyber attack. For 36 percent of these physicians, the shutdown lasted for five hours or longer.
These attacks are becoming more and more commonplace. Make sure you’re training every employee and staff member to identify these attempts and respond in an appropriate manner.
4. Have a Device Management Strategy
Mobile devices are great for speed, flexibility, and efficiency, but they also represent serious points of vulnerability to your system. It’s okay to allow patients to use mobile devices, but there has to be a device management strategy in place.
Your strategy should be one that’s documented, carefully implemented, and followed with precision. Be clear on things like which devices are allowed; restrictions on mobile device usage; security configuration; etc.
5. Secure Patient Data
Nothing is treated more seriously than patient data. With all of the HIPAA laws and requirements for data integrity, a failure to protect sensitive information can result in lawsuits, fines, penalties, and other stiff repercussions. If you’re going to get serious about something, make it patient data protection.
The number one way to secure patient data is to control access to the data. Access should only be granted on an as-needed basis. And if a staff member is given access, it should be on a temporary basis. As soon as the access is no longer needed, it must be revoked.
Looking Toward the Future
The future is always ripe with uncertainty – but especially today. We’re in the middle of a major crisis that’s impacted the healthcare world in a variety of ways. On the front lines, it’s revealed major cracks and fault lines in disaster preparedness and availability of resources. On the back end, it’s shown just how important it is to have a strong cybersecurity infrastructure in place to support proactive responses.
It’s impossible to predict what will happen next, but hospitals and healthcare organizations that prepare for the worst will be set up best over the next decade.
