How to Keep Your Practice Safe from Ransomware Attacks

Ransomware is no foreign topic in the healthcare industry. It shouldn’t be.

According to a report by Tenable, the rise in ransomware attacks led to the overall spike in healthcare data breaches. In the year 2020, a whopping 55 percent of healthcare data breaches were caused by ransomware attacks. 

Things are even more alarming in 2021. Hacking and IT incidents—which include ransomware attacks—accounted for 68 percent of all reported healthcare data breaches. 

In September 2021 alone, the Department of Health and Human Services (HHS) received reports of data breaches that compromised the protected health information of 1,206,799 people in the United States.

| Read more: The Biggest HIPAA Breaches of 2021 So Far

The pervasiveness of ransomware in the healthcare industry puts lives at risk, and not having ransomware protection can be disastrous for your patients and practice.

Every healthcare practice needs to properly equip itself with the tools and training to stop a ransomware attack in its tracks.

Keep Ransomware Attacks Out

A ransomware attack’s success (or failure) depends on two factors: human and technological.

A study published by the Association for Computing Machinery states, “The most security-conscious users are susceptible to unknown vulnerabilities, and even the best security mechanisms can be circumvented as a result of user actions.”

Here are a few tips from cybersecurity experts that you and your clinic staff can implement to reduce the risk of ransomware attacks in both the human and the technological aspects.

How Your Practice Can Address the Human Factor

In a mini-symposium organized by the Cybersecurity and Infrastructure Agency (CISA) last month, one of the speakers, Certified Chief Information Security Officer Perry Carpenter, pointed out that there is a constant meteoric rise in spending on IT and cybersecurity, but data breaches still seem to be outpacing them.

“So clearly we are missing something,” commented Carpenter. “I would say that the thing that we’re missing is the human layer.”

The human factor in a cybersecurity risk is often referred to as an insider threat—a deliberate or accidental security risk that originates from within an organization. According to an IBM study, human error accounts for 95% of data breaches.

To form an effective line of defense on the human side of the issue, Carpenter offers the following advice:

1. Build an effective cybersecurity awareness program.

Focus on shaping behaviors to foster a culture that values security. In time, you should be able to achieve a company culture that has cybersecurity woven through it. Invest in regular cybersecurity awareness training for your organization.

2. Build a robust vulnerability management process.

You should have a clear process in place that your IT team can refer to when identifying, evaluating, treating, and reporting security vulnerabilities in your systems. If you don’t have a dedicated IT team for your practice, you can partner with a managed IT service provider.

3. Predetermine your guidelines for negotiation.

This is especially relevant in ransomware cases involving healthcare facilities where lives could be at stake. It’s easy to say you’ll never pay ransom, but it’s a different story when your clinic has been down for a week or when a hospital is unable to treat patients. 

Think through what your position and policy are ahead of time so you won’t have to deal with them as you go through the urgency and emotions of a ransomware attack.

4. Ensure the integrity of your backup and recovery processes.

There have been countless times when an organization was hit by a ransomware attack and they tried to restore their backup data but later found it to be corrupted—they ended up with lost time, lost data, and crippled operations. So test and verify your backup and disaster recovery plan, and be extremely intentional about ensuring that it works.