The impact of ransomware attacks on healthcare is as alarming as it is under-addressed. The United States healthcare system alone faces an annual burden of nearly $21 billion due to these attacks. It pays well over $100 million in ransoms, and is beginning to acknowledge the tragic realities of impacted patient care, including higher patient mortality rates. For every headline related to cyberattacks, there are likely hundreds more that go unreported.
The Health Insurance Portability and Accountability Act (HIPAA) was enacted in 1996 and sets forth a comprehensive set of standards for protecting sensitive patient health information. The Privacy Rule applies to all entities that fall within the definition of a “covered entity“, which generally includes healthcare providers, health plans, and clearinghouses.
For biotech organizations, collaboration is the lifeblood of clinical research. A typical clinical trial depends upon constant communication, data sharing, and myriad other interactions among sponsors, sites, CROs, and participants. A breakdown in collaboration can cause delays that threaten the entire operation.
In April 2022, a medical billing company based in New York became the victim of a serious ransomware attack. Bad actors stole personal and financial data of patients from 26 healthcare institutions who were the company’s clients. The billing company had to notify almost 1 million individuals that their data had been stolen. Over the last few years, organizations and fintechs that process payments for healthcare providers have become a hot target for cyber attacks.
On September 12, the FBI released a private industry notification entitled “Unpatched and Outdated Medical Devices Provide Cyber Attack Opportunities.” The notification underscores how a growing number of vulnerabilities in medical devices and Internet of Medical Things (IoMT) assets can be exploited by threat actors to “impact healthcare facilities’ operational functions, patient safety, data confidentiality and data integrity.”
