Cybersecurity Best Practices for Healthcare
Don't Forget About the Physical Side of
Digital Security
Like many other market sectors, the healthcare world was forced into cybersecurity adjustments and advancements by the COVID-19 pandemic. For example, it was suddenly not a good idea to use touchscreens and keypads to identify users and gain access. At a blinding speed in some cases, IT professionals have worked to deploy new solutions — some of which had been in process already or were being used in other industries and some were completely new.
With these technology advancements, it has become more important than ever to identify physical and digital/logical security weaknesses and be proactive about mitigating them to keep staff, patients and visitors (and their personal data) safe.
Evolving cybersecurity best practices are especially important in healthcare settings, because hospitals and other healthcare venues are technology-heavy, super-sensitive to privacy, and carry unique potential for harm when technology fails.
Jeff Broz, Prime Connected VP of Infrastructure Operations, pointed out that these concerns are particularly important in the growing world of the healthcare Internet of Things (HCIoT). “There is typically a well-established process for adding new devices to an enterprise network. The challenge is that the technology is changing so quickly, that keeping up is a daunting task for the IT security team.”
Healthcare Cybersecurity: What could go wrong?
"When critical systems are compromised, not only is the data within those systems at risk, but the care team is impacted by forcing alternate workflows to ensure the quality of care and patient safety are not impacted."
Some cybersecurity breaches are legendary in the healthcare world. For example, ransomware attacks and hacking through environmental controls. In a worst-case scenario, a nefarious actor can take down an entire network, locking users out or injecting viruses, causing gaps in patient monitoring and care.
Especially with some of the beefed-up collaboration technology being used through the pandemic to electronically replace in-person patient and family touch points, an increased number of potential breaches can deprive caregivers of access to vital information about their patients.
“It is pretty straightforward,” Broz said. “When critical systems are compromised, not only is the data within those systems at risk, but the care team is impacted by forcing alternate workflows to ensure the quality of care and patient safety are not impacted.”
This healthy fear of gaps in care have even led to an unhealthy avoidance of updating systems for some organizations. However, using legacy systems with only-partially-effective updates eventually results in more potential cybersecurity issues and — you guessed it — gaps in a hospital’s control over care. When word gets out about gaps in care, it can affect an institution’s ability to maintain its reputation and compete against institutions that allocate time and money to proper updates and upgrades.
Increased use of smart devices complicates cybersecurity, Broz pointed out, because they often do not include embedded security when they are acquired and implemented. This can lead to human error, from poor configuration to incomplete user protocols. It’s great to have devices such as smart pumps available to monitor distribution of pharmaceuticals, and many healthcare institutions have implemented them. However, do IT teams really understand the vulnerabilities that come along with such devices?
This matters in part because hackers are getting smarter. A number of breaches have occurred in recent years through laptops accessing environmental systems. IT and security staff now have a better understanding of how those breaches happened, but for a variety of reasons they don’t always take comprehensive steps to mitigate such possibilities in their own systems.
According to a Verizon data breach report, 59% of healthcare institution data breaches come from internal actors, whether intentional or unintentional. This often happens due to problems with un-segmented networks or missing security controls. In cases where damage is intentional, it can happen because credentials are too easy to steal, among other things.
Of course, if you oversee security or information technology in a healthcare institution, you have no doubt done your research and know all of this. If you are like many organizations, you have put cybersecurity protections in place and you are ready for the next attack. However, also like most healthcare institutions, you may have forgotten about or too-lightly addressed one particular area of cybersecurity: physical deployment and maintenance.
Broz puts in a nutshell just how critical physical security is to cybersecurity: “All of the sophisticated, deep cybersecurity protocols, software and processes you implement could be taken down in an instant if a bad actor gains access to a server closet through a door left ajar by third-party technician.”
Bones of an effective cybersecurity plan
Any institution’s cybersecurity plan includes a myriad of small security mitigations protecting the many parts of the system. However, without a well-thought-out, comprehensive structure to support full security coverage, all of those small solutions still could leave your organization vulnerable. Just as a building needs a framework to hold up the walls (the bones), a cybersecurity plan is the framework that holds up a system’s components.
An effective cybersecurity plan begins with assessment of every component in your system and every potential security breach scenario. Your assessment should include determination of physical ways bad actors could access systems (e.g., through unlocked doors), or where inadvertent actions could compromise the system (e.g., accidentally activating on/off switches). A comprehensive risk assessment should be created before any new components are purchased or programs are put in place.
The bones of your cybersecurity plan should follow emerging standards, including ever-changing best practices for encryption, data tracking, human error mitigation, awareness programs, and incentives for reporting phishing, for example. “Part of establishing digital security in a healthcare institution is knowing what the most current standards are and understanding how to follow them,” Broz advised. He said many institutions lean on third-party experts. However, if your team members are not already, they should get on the mailing lists of cybersecurity industry organizations, such as the Healthcare Information and Management Systems Society, Inc. (HIMSS), so they can receive timely updates and tips. Even with reminders from experts, Broz suggested many companies are forgetting about the physical side of digital security.
We’ve included a checklist of some of the most easily forgotten physical aspects of cybersecurity at the end of this article to help flesh out your cybersecurity plan.
Overall, an effective cybersecurity plan must:
- Include integrated digital and physical cybersecurity solutions pathways (“You can’t have one without the other,” Broz said.)
- Take into account how your healthcare cybersecurity initiatives will affect profitability and other aspects of your institution, including efficiency, staffing and budgets
- Identify unsupported legacy systems and realistically determine when the potential for ongoing vulnerabilities outweighs the costs of upgrading
- Account for third-party devices that will be connected to your network by patients, families, employees and contractors — some exposure through third-party devices is intentional and some may be unintentional
- Incorporate partnerships with trusted third-party service and equipment providers who know the specific business of healthcare cybersecurity
- Prioritize to ensure that the most important, or most foundational, aspects of cybersecurity are managed first
- Include an incident response plan, so your team knows exactly what to do when a breach happens
- Outline built-in protocols for continual testing and updating your healthcare cybersecurity systems without any gaps in care
- Integrate input, needs and concerns from other teams in the organization and align with high-level organizational goals and processes
- Include detailed steps for continual training, information sharing across departments, and plan updating
Healthcare venues present unique, and oftentimes critical, potential cybersecurity issues. Most hospitals and other healthcare institutions hire experienced, educated inhouse information technology and security professionals who know how to create and carry out a plan. The key is to make sure your professional staff is given the time and resources for proper planning, implementation and management of cybersecurity — including ensuring comprehensive coverage, with no gaps, by addressing the physical side of digital security.
Physical cybersecurity plan checklist
1.
Experienced, trustworthy deployment team. Ensure you are working with a deployment team you trust. Choose a company with a proven track record for exceptional deployment specifically in healthcare institutions. This aspect of your organization is too important to rely on general or inexperienced technicians to provide the services and technology you need.
2.
Control access during deployment. Installation involves running cable throughout the building, so you will have to provide the deployment team with keys and badges to access many areas. Consider using dual factor authentication biometric cards that require the card owner’s thumbprint in combination with the card before they will work. Broz said, “These cards are the same size and shape of traditional access cards, and they are pretty bulletproof.” Biometric cards also can be used with GPS for disaster tracking and contact tracing.
3.
Physical equipment security. Ask your deployment team to provide written plans for physical security during the installation period. Technicians are notorious for propping open doors to network closets, for example. Your deployment and maintenance teams must ensure at all times that no one can get into these areas and compromise equipment.
4.
Properly secured staging areas. Broz explained that staging areas must be plugged into the network for official checkouts during implementation. “Set up the system in a mock environment in a secured room out of the way,” Broz said. “Don’t just do it in some easily accessed classroom, where a disgruntled employee could take down the network and make it look like someone else did it.”
5.
Interim and ongoing equipment security. Both during deployment and after equipment is in place, ensure that your team is preventing unauthorized access and potential damage by securing open ports, switches and cables. Take time to do this between deployment steps until you can make the equipment permanently secure
6.
Intruder notifications. Use intruder alert systems in strategic areas to detect potential bad actors who might compromise your systems in person.
For more information about or assistance with both the digital and physical sides of your cybersecurity plan, contact Prime Secured at 402-289-4126 or primesecured.com
