In some ways, the combination of managed service providers and healthcare clients is the perfect storm of targets for hackers. Attacks on managed service providers are on the rise, as are attacks on healthcare records. In fact, there were a total of 41.4 million patient records breached in 2020 alone. That’s why HIPAA compliance is so important for managed service providers.
Your organization’s people are your first line of defense against cyber criminals. Unfortunately, they’re also your weakest link. Insiders pose the biggest threat to cyber security in the healthcare industry, and only 13% of public sector employees “take personal responsibility for cyber security.” Here are 10 proactive ways to improve employee cyber security compliance.
The cyber threat environment is constantly changing, so employee cyber security training is not “one and done.” It is a continuous process that should begin during the onboarding process and continue throughout the employee’s tenure.
Many healthcare organizations make the mistake of focusing employee cyber security training exclusively on HIPAA compliance, and organizations in other industries can fall into similar traps. While compliance is important, it does not automatically equate to cyber security.
Often, employee cyber security manuals are written by the IT department or security personnel, who may fill them with so much “tech-speak” that they require a degree in computer science to decipher. Make sure that your rules and procedures are written in plain language that non-IT employees can easily understand.
Cyber security is everyone’s responsibility. This includes all levels of employees, from the C-suite down to the receptionist. Don’t forget about part-time employees, seasonal workers and other temps, even interns. Everyone in your organization who has access to a computer must be trained on cyber security best practices.
If one of your employees receives a suspicious email or finds a flash drive on the floor, who should they report the incident to, and how? Make sure your employees know exactly what to do next.
Illustrating why cyber security hygiene is important both in and outside the office is a great way to reinforce training lessons and bolster employee buy-in. Use real-world examples that employees can relate to, such as phishing scams that seek to steal personal account credentials.
User behavior analytics, paired with continuous monitoring of network activity, protect your organization on two fronts. First, they allow you to identify employees who are snooping around in areas of your system they don’t need to access to do their jobs. Second, they allow you to identify stolen credentials by flagging logins at odd hours and/or from unusual locations. In either case, you can set up the system to temporarily suspend access until you determine what’s going on.
The best way to ensure that employees don’t misuse their credentials is to prevent them from doing so in the first place. Employees should be given the minimum amount of system access to perform their jobs, and no more. Access levels should be regularly reviewed for appropriateness.
Even the most diligent employee can make a mistake. If employees fear being fired for inadvertently clicking on a phishing link, not only will they not report the incident; they may try to cover it up, which could make things even worse. Encourage employees to report missteps as soon as possible, and ensure them that they won’t be disciplined for doing so.
In addition to not beating your employees with sticks, offer some carrots. Recognize employees who flag phishing schemes and other attempted cyber attacks.
The cyber security experts at Lazarus Alliance have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting organizations of all sizes from security breaches. Our full-service risk assessment services and Continuum GRC RegTech software will help protect your organization from data breaches, ransomware attacks, and other cyber threats.
Lazarus Alliance is proactive cyber security®. Call 1-888-896-7580 to discuss your organization’s cyber security needs and find out how we can help your organization adhere to cyber security regulations, maintain compliance, and secure your systems.
Healthcare organizations tend to focus their cyber security efforts on HIPAA compliance, protecting patient data, and defending against ransomware attacks like WannaCry, with scant, if any, attention paid to medical device security. A Ponemon Institute study released last week by Synopsys, Medical Device Security: An Industry Under Attack and Unprepared to Defend, paints an ominous picture regarding the cyber security of IoT devices such as smart insulin pumps, diagnostic and monitoring equipment, and even the mobile apps used to control connected devices:
One would think that, given the fact that a faulty connected medical device could result in a dead or maimed patient, these devices would be subject to strict regulations and exacting security standards.
This is not the case at all. Medical device security is no more robust than general IoT security. The respondents to the Synopsys/Ponemon study cited a complete lack of security standards, testing, and accountability for medical device security, along with intense pressure to push products to the market as soon as possible. These are the same problems that plague the overall connected devices industry. Smart watches, smart doorbells, smart toys, and even smart cars are designed for ease of use and cutting-edge features, not cyber security.
Smart medical devices are no different. The FDA does have a set of voluntary guidelines addressing medical device security, but according to the study, only 51% of manufacturers and 44% of HDOs followed them.
Perhaps the most horrifying finding from this already frightening report is that most device manufacturers and HDOs stated that only a “serious hacking incident” would prompt their organizations to increase their medical device security budgets. Yes, you read that correctly: The majority of players in the medical device industry are relying on reactive cyber security, waiting until a breach has actually happened – which, in this case, could mean that someone dies or is maimed – to address device vulnerabilities.
Last fall, medical device maker St. Jude Inc. announced that it was forming a medical advisory board focused specifically on medical device security. This is a positive step, but it happened only after allegations that its smart cardiac implants were vulnerable to hacking, which prompted an investigation by the FDA.
The current reactive approach to medical device security is completely unacceptable. Knowing this, the FDA has cited the cyber security of medical devices as one of its top regulatory science priorities in 2017. However, the wheels of government turn very slowly; manufacturers, HDOs, and patients cannot afford to wait for the government to step in and save the day. The healthcare industry needs to start taking the same proactive approach to cyber security that it does to disease prevention. This isn’t just about money or reputation; human lives depend on it.
The cyber security experts at Lazarus Alliance have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting organizations of all sizes from security breaches. Our full-service risk assessment services and Continuum GRC RegTech software will help protect your organization from data breaches, ransomware attacks, and other cyber threats.
Lazarus Alliance is proactive cyber security®. Call 1-888-896-7580 to discuss your organization’s cyber security needs and find out how we can help your organization adhere to cyber security regulations, maintain compliance, and secure your systems.