Healthcare is one of the most targeted industries for cyber attacks due to the vast amount of sensitive data stored: especially personally identifiable information (PII) kept in patient records.
Telehealth and online providers who deliver their services by leveraging technology and data are especially targeted by cyber criminals because they offer broad attack surfaces where vulnerabilities may be exploited.
While there are a number of protections that healthcare organisations can employ to safeguard their systems and private information, cyber criminals are constantly devising new ways to infiltrate systems or trick people into disclosing information that enables access.
The costs involved range from business interruption to legal actions and can take multiple forms — amounting to huge losses for the organisations involved.
Smaller businesses in the healthcare sector may not have the resources to deal with attacks and may struggle to recover financially, reputationally and in retrieving lost data.
Technology-related cyber security threats to healthcare providers: key areas
Sensitive personal data
If your organisation collects, stores, processes or has access to personally identifiable information (PII) or personal health information (PHI), both types of data are subject to regulations.
Local authorities govern how this sort of information is collected, used and stored, and failure to observe these requirements can result in regulatory fines and penalties.
If sensitive information is compromised through unauthorised access or disclosure, the affected individuals may need to be told about the breach and may need to be provided with credit monitoring services, involving legal and forensic costs.
Case study: privacy liability
Operational downtime
Can your business operate without access to computer systems and the data they hold for hours, or even minutes? Many healthcare providers rely on technology for multiple functions, from record keeping to dispensing prescriptions via SMS.
This provides multiple potential access points for cyber criminals and makes healthcare practices more susceptible to ransomware and extortion risks. They also often target and disable backups, leaving businesses with limited options for data restoration.
Technology providers servicing healthcare businesses
Healthcare adjacent technology service providers may be subject to liability for errors that cause injury or financial loss to patients of their client practices.
The outsourcing business may also be held liable for technology services provided on the practice's behalf and responsible for notifying affected individuals and the expenses of regulatory actions.
Providing patient services across multiple jurisdictions
As the relevant regulations governing personal data are updated across Australia's different states and territories healthcare businesses are subject to evolving responsibilities — and risks.
It's important to stay current with regulatory requirements in all regions where the business practises.
Accepting and using electronic payment systems
An increasing number of electronic fund transfers are being targeted, often by hacking into email accounts, assuming a false identity and sending fraudulent instructions. With evolving technologies they're also becoming more sophisticated and convincing.
AI-driven attacks, such as deepfakes and AI-based exploitation may not be adequately covered under traditional cyber insurance policies, necessitating policy reviews.
Case study: extortion through remote access vulnerability
How cyber insurance offers essential protections for healthcare providers
Cyber insurance not only gives healthcare providers access to a range of technical experts to help get back online fast, it can cover the financial losses incurred as a result of business interruption and the costs of re-creating any corrupted data. It can also cover the reputational impact of cancelled contracts and customers choosing to go elsewhere.
How Gallagher can help
Brokers remain a critical source of guidance on cyber coverage, combined with expertise in healthcare sector risks and insurance solutions. In addition to cyber insurance protection, Gallagher offers expertise, advice and resources for building business resilience to withstand cyber security incidents.
