It’s difficult to stay ahead of data breaches, and healthcare leaders seem to largely agree that it’s only getting more challenging — and that’s bad news for the financial health of the industry, as data breaches are projected to cost healthcare $ 4 billion by the end of the year. 2020 could be even more costly.
NInety-six percent of IT professionals in a new Black Book Market Research survey agreed with the sentiments that data attackers are outpacing their medical enterprises, holding providers at a disadvantage in responding to vulnerabilities.
Thus far in 2019, healthcare providers continued to be the most targeted organizations for industry cybersecurity breaches with nearly 4 out of 5 breaches, whereas successful attacks on health insurers and plans maintained with more sophisticated information security solutions had little change year to year. More than half of all provider breaches were caused by external hacking according to respondents.
WHAT’S THE IMPACT
More than 93% of healthcare organizations have experienced a data breach since Q3 2016, and 57% have had more than five data breaches during the same timeframe. Not only has the number of attacks increased, but more than 300 million records have been stolen since 2015, affecting about one in every 10 healthcare consumers.
The dramatic rise in successful attacks by both criminal and nation-state-backed hackers illustrates how attractive and vulnerable healthcare enterprises are to exploitation. Despite this, the provider sector remains exceedingly susceptible to ongoing breaches.
Exacerbating the issue is that budget constraints have encumbered the practice of replacing legacy software and devices, leaving enterprises more susceptible to attacks. It’s becoming more challenging for hospitals and health systems to invest in areas that don’t actively produce revenue, the survey found.
According to 90% of hospital representatives, IT security budgets have remained level since 2016. As a percentage of IT health systems and hospital organizational budgets, cybersecurity has increased to about 6% of the total annual IT spend for calendar year 2020. But physician organizations and groups report a decrease in actual cybersecurity expense allocated, with less than 1% of their IT budgets earmarked for cybersecurity in 2020.
WHAT ELSE YOU SHOULD KNOW
In all, 84% of hospitals were operating without a dedicated security executive. As a solution to unsuccessfully recruiting a qualified healthcare chief information security officer, 21% of organizations opted for security outsourcing to partners and consultants, or selected security-as-a-service options as a stop-gap measure.
Twenty-one percent of hospitals reported having a dedicated security executive, although only 6% identified that person as a CISO. Only 1.5% of physician groups with more than 10 clinicians in the practice reported having a dedicated CISO.
The estimated cost of a data breach by the respondent hospital organizations with actual breaches in 2019 averaged $ 423 per record.
Meanwhile, 58 health system marketing leaders with organizational breaches in the past 18 months reported expending between 51,000 and 100,000 dollars of unbudgeted marketing expense to fight any negative impressions on the hospital brand due to data breaches and theft. Still, no marketing executive reported allocating 2020 budget funds to combat the consequences of patient privacy or record breaches.
THE LARGER TREND
In 2017, Craig Musgrave, CIO of The Doctors Company, said even a small attack can cost health IT departments about $ 5,000. A larger attack, requiring the expertise of 20 or more people to clean it up, can cost upwards of $ 100,000.
The key is having an instance response process in place. Controls to keep hackers from executing a breach are of huge benefit, but breaches will happen regardless, so a means of monitoring assets and stopping the bleeding when necessary are key to avoiding catastrophic financial loss in the face of such attacks.
Twitter: @JELagasse
Email the writer: jeff.lagasse@himssmedia.com