It’s not news that cybercrime remains a serious and pervasive problem for the healthcare industry. But in 2024, healthcare providers face regulatory and post-pandemic shiſts that present new security challenges in addition to the ongoing efforts to protect data and organizations from potential breaches.
The statistics remain disturbing; the number of ransomware incidents in the U.S. rose 18% in 2023, and the healthcare industry topped the list with a total of 249 incidents.1
Cybercriminals use phishing attempts to target healthcare providers of all shapes and sizes, not just large multistate companies or small regional hospitals. The phishing attempts oſten have one thing in common; an estimated 68% of all data breaches involve a human element — someone inadvertently clicking on a link or attachment or responding to a fraudulent email.2
In addition to the email compromise that has long been central to many cybercrimes, new challenges emerged during and aſter the COVID-19 pandemic. Everything shiſted, and it didn’t shiſt because of operations or the changes in the business. Everyone had to adopt digital tools — and fast. Massive digital adoption, while operationally effective, created new risks.
Today, a typical healthcare provider’s facility includes not only a central physical space, but also multiple satellite locations networked together. Each facility is likely to have healthcare instruments and tools individually connected to the internet. The provider has back-office functions that need to be connected to the digital world as well. Lastly, there’s public Wi-Fi. Healthcare, as an industry, moved away from having everything, including data, within four walls. Suddenly, there are a myriad of avenues that cybercriminals can take advantage of. And it only takes one click for ransomware to be installed.
Add to that, the bring-your-own-device trend — with doctors and other medical professionals using personal phones or laptops to download apps they work on — changes the level of cyber hygiene.
Beyond meeting the security demands of an increasingly digital business, healthcare executives are bracing for changes to Health Insurance Portability and Accountability Act (HIPAA) regulations that also could require rethinking and investing more in data protection efforts.
The possible tightening of HIPAA regulations comes as patients are asking for more access to their medical records. Consumers want their medical records opened. They want portability and to have direct access to their information. But the ability for them to be able to control that health data is going to put more of a burden on how we protect that health data.
Today, a healthcare organization’s treasury team is increasingly on the front line. Treasury teams are becoming more and more integrated into the cybersecurity policy framework for their organizations. That’s because they’re the front line; they’re getting the emails from the fake vendors, they’re getting the fake client emails, they’re getting all of these communications coming in. That also can mean they are the first line of defense for their organizations. But ultimately, it’s not just IT or treasury employees who need to be on guard. With the expanded footprint healthcare has, everyone is part of the front line in protecting organizations against cybercrime. Create a culture of security, so that each employee is taking responsibility for the defense of their organization.