As a health system, we must have adequate levels of protection for the sensitive data we manage to protect both ourselves and the patients we care for.
Cyberattacks not only disrupt healthcare providers, they also disrupt patient care. Hypothetically, if a Ballad Health provider was phished and had their credentials stolen, a hacker could potentially use that information to log into Epic and access patient information to sell on the black market. Even more dangerous, a hacker using those credentials could potentially change a patient’s medication or procedure or discharge the patient prematurely.
According to a research study published in September 2021 by the Ponemon Institute, approximately 43% of the 600 healthcare IT professionals surveyed said they had experienced a ransomware attack within the last two years that disrupted the ability to care for patients. Of those who experienced a ransomware attack:
- 70% said the attack led to delays in procedures and tests, resulting in poor outcomes.
- 36% said the attack led to an increase in complications from medical procedures.
- 22% said the ransomware attack led directly to an increase in mortality rate.
A ransomware attack impacts patient care as well as an organization’s ability to operate.
Recent, devastating data breaches in healthcare
In 2020, Michigan-based Trinity Health experienced a ransomware attack on one of its customer-relations vendors. This attack compromised more than 10 million records, including protected health information, social security numbers and financial payment data.
Usually, hackers who steal patient information will sell it on the dark web. For example, in 2018, hackers breached the American Medical Collection Agency (also known as AMCA) and stole patient data that was later listed for sale on dark web forums. When AMCA’s four largest clients terminated their agreements, they were forced to file for bankruptcy.
In 2015, the largest healthcare industry cyberattack in history occurred when hackers used a phishing email to gain access to insurance provider Anthem’s corporate databases, which contained sensitive patient health information. The hackers stole nearly 79 million records, including employee data, insurance numbers, medical IDs, income data and more. Anthem agreed to pay $115 million to resolve litigation resulting from the attack and were ordered to triple their cybersecurity budget.
Knowledge is key: ‘Don’t Take the Bait’
We must stay alert if we are going to protect our organization, our data, our patients and each other, and one of the best ways to stay prepared is through education.
Last week, Ballad Health launched “Don’t Take the Bait,” a coordinated cybersecurity campaign. In the coming weeks and months, this cybersecurity campaign will consist of Ballad Health News and Ballad Teams articles, videos, tips and quizzes. Be on the lookout for how you can learn more about cybersecurity risks and what you can do to support our efforts in data protection.
