Patient Safety and Cyber Risk

Healthcare CEOs know all about patient safety – at least that’s what they’ll tell you. Joint Commission and others have been all over the subject for years. Ask them what patient safety really means and most will probably start talking about how healthcare organizations protect their patients from errors, injuries, accidents, and infections. It’s a big issue. As many as 440,000 people die every year from preventable errors in hospitals alone. However, only a few healthcare CEOs will include cybersecurity in their list of top risks, but that is slowly beginning to change.

Today’s US healthcare payers, providers and pharmaceuticals are under attack – from state sponsored theft of healthcare IP, clinical formulations, procedures and treatment regimens, to the PII of patients including 78.8 million customers of Anthem Health, to the commercial theft and sale of PHI and PII by cyber-criminal gangs intent on the monetization of stolen data.

What many don’t realize is that cyber risk in a healthcare setting is not just about attacks against the confidentiality of information but also the availability and integrity of health IT systems and data. Healthcare is a prime target for extortion and has been disproportionately impacted by bouts of ransomware impacting the availability of health IT systems to render care to patients.

Just look at the UK NHS when it succumbed to the global WannaCry ransomware attack last year. Nearly two thirds of NHS Hospital Trusts were impacted and had to cancel appointments and divert all but the most critical of emergency patients elsewhere. Had the NHS understood the true magnitude of its cybersecurity risks and acted accordingly to patch and replace out of date systems, then the negative impact to the lives of many of its patients could have been avoided.

I’m sorry, the Doctor can’t see you at the moment – our IT systems are down!

So what happens to patient care when critical Health IT systems aren’t available to diagnose or treat patients? Their surgeries get cancelled, or they get put in an ambulance to an unaffected hospital 40 or 50 miles away. That’s where the patient safety question comes into play.

  • What is the impact to a sick patient when he or she has to be transported an hour or so to a functional hospital?
  • What if that patient happens to be many hours’ drive or flight away from the nearest un-impacted and available facility and expires en-route?
  • What is the level of culpability for healthcare providers when they fail to properly evaluate and protect against availability risks to their IT systems?
  • There is a fairly obvious duty of care for patient safety so shouldn’t that extend to the availability of health IT systems needed to treat patients?
  • Should hospitals be held accountable in the same way that we hold retailers accountable when they fail to protect their credit card payment systems?

Modern healthcare is highly dependent upon the clinical IT systems we use to diagnose and treat patients. What happens when a medication cabinet won’t open to dispense critical medications? What happens when a pharmaceutical robot dispenses the wrong medications for a patient and the mistake is not noticed by overworked staff? Our reliance today upon IT and IoT systems is perhaps more than most physicians would willingly admit.

Primum non nocere. (First do no harm)

Making cyber-risk a critical part of enterprise risk across the healthcare industry should be a must, given the potential risks to patient safety, just as evaluating and assessing all assets on the clinical-business should be too. The rising number of non-IT devices plugged in, or connected wirelessly, to hospital networks far overshadows the number of PCs, laptops and workstations in most facilities. What is more, most of these IoT devices have no security protections and cannot easily be patched. Medical devices are growing at 20% per annum and are often owned and managed outside of hospital IT and Security teams. No wonder then, that hospital CEOs are becoming concerned at the patient safety ramifications of one of these devices being compromised by a malicious hacker.

Widespread automation and cost cutting across hospitals is leading to a rising trend of the outsourcing of hospital building management systems (BMS). This includes everything from electrical and water distribution to elevators and HVAC. Most of these outsource agreements are with companies from many miles away – often out of State, or out of Country, who manage systems remotely via a virtual private network (VPN). Usually governed by weak or incomplete third-party contracts which are rarely audited, these agreements extend the hospital attack surface into the outsource company complete with all of their security vulnerabilities. Scholars of prior cybersecurity attacks will be quick to point out the parallels here between Target Stores and its HVAC services provider Fazio Mechanical, which resulted in one of the largest cyber-thefts of credit card numbers as well as most of Target’s customer information. The breach cost Target millions in compensation, restitution and credit monitoring, as well as the jobs of everyone in leadership.

The repercussions of third-party vendor breach in healthcare could however, be far more nefarious and impactful given what is connected to the typical hospital network. That is, unless networks are properly and securely segmented to isolate BMS, medical devices and business IT systems. However very few hospitals have so far even started to securely segment their large flat networks.

The need therefore to evaluate third party risk is critical, yet most hospitals currently don’t do this well if at all. With thousands of suppliers, vendors, contractors and consultants in each hospital, manual assessment is simply too much to handle with the current number of security and compliance staff.

As healthcare leaders continue to monitor and evaluate what is meant by patient safety in their operations, it’s clear that today, patient safety means so much more than just avoiding medical errors or someone slipping on a freshly mopped hospital floor.

The author addresses these and other subjects at the South Dakota HIMSS annual Conference today 
in Sioux Falls, SD.

Subscribe to our periodic posts via email to new posts so I don't miss them.

Original stories and articles may be republished without charge provided that attribution is provided to the source and author. Articles written for, and published first elsewhere, are subject to the republishing terms and conditions of the host site.