Cyberattacks plague the healthcare industry

Author: Darius Tahir, KFF Health News

Central Oregon Pathology Consultants has been in business for almost 60 years, offering molecular testing and other diagnostic services east of the Cascade Range.

Starting last winter, he worked for many months without pay, surviving on cash, pra

said ticce manager Julie Tracewell. The practice comes on the heels of one of the most significant digital attacks in American history: the February hack of payment manager Change Healthcare.

COPC recently learned that Change has begun processing some outstanding claims, which numbered approximately 20,000 as of July, but Tracewell does not know which ones, she added. The patient payment portal remains disabled, meaning customers cannot pay their bills.

“It will take months to calculate the total losses from the outage,” she said.

Healthcare is the most common target of ransomware attacks: according to the FBI, 249 of them targeted healthcare institutions in 2023 – the most of any sector.

Health executives, lawmakers and those in the halls of Congress fear the federal government’s response is inadequate, underfunded and overly focused on protecting hospitals — even though Change has proven that vulnerabilities are widespread.

“The Department of Health and Human Services’ current approach to health care cybersecurity – self-regulation and voluntary best practices – is woefully inadequate and has left the health care system vulnerable to attacks by criminals and foreign government hackers,” Sen. Ron Wyden (D-Ore.), chairman of the Senate Committee Finance, he wrote in a recent letter to the agency.

The money isn’t there, said Mark Montgomery, senior director at the Foundation for Defense of Democracies’ Center for Cyber and Technology Innovation. “We have seen extremely gradual or almost no efforts to increase investment in security,” he said.

The task is urgent – 2024 was the year of healthcare hacks. Hundreds of hospitals across the Southeast faced disruptions in obtaining blood for transfusions after the nonprofit donation service OneBlood fell victim to a ransomware attack.

Cyberattacks complicate both mundane and complex tasks, said Nate Couture, chief information security officer at the University of Vermont Health Network, which was hit by a ransomware attack in 2020. “We can’t mix a chemical cocktail by eye,” he said, referring to cancer treatment at a June event in Washington, DC

In December, HHS unveiled a cybersecurity strategy to support the sector. Several proposals focused on hospitals, including a carrot-and-stick program designed to reward providers who adopted certain “basic” safety practices and penalize those who didn’t.

Even this narrow scope of action could take years to come to fruition: under the department’s budget proposal, money will start flowing to “high-need” hospitals in fiscal year 2027.

Focusing on hospitals is “inappropriate,” Iliana Peters, a former enforcement attorney at HHS’s Office for Civil Rights, said in an interview. “The federal government needs to go further” by also investing in organizations that provide services and contract with vendors, she said.

The department’s interest in protecting patient health and safety “really puts hospitals at the top of our list of priority partners,” Brian Mazanec, deputy director of the Strategic Preparedness and Response Administration at HHS, said in an interview.

Three offices within two different agencies are responsible for the nation’s health cybersecurity. The health department’s Office of Civil Rights is a sort of cop that monitors whether hospitals and other health care organizations have adequate measures to protect patient privacy, and threatens them with financial penalties if they don’t.

The health department’s Office of Preparedness and the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency are helping build defenses — for example, requiring medical software developers to use auditing technology to check their security.

Both of the latter are obliged to create a list of “systemically important entities” whose activities are of key importance for the efficient functioning of the health care system. These entities could get special attention, such as being included in government threat briefings, Josh Corman, co-founder of the cyber advocacy group I Am The Cavalry, said in an interview.

Federal officials were working on the list when news of the Change hack broke, but Change Healthcare was not on it, Jen Easterly, leader of the cybersecurity agency Homeland Security, said at a March event.

Nitin Natarajan, the agency’s deputy director for cybersecurity, told KFF Health News that the list is only a draft. The agency previously estimated that it would complete the list of entities – by sector – in September last year.

The health department’s preparedness office is supposed to work with the cybersecurity agency Homeland Security and the entire health department, but congressional staffers say the office’s efforts fall short. There are “silos of excellence” at HHS, “where teams weren’t talking to each other (where) it wasn’t clear who people should go to,” said Matt McMurray, chief of staff to Rep. Robin Kelly (D-Ill.), at the June conference.

Is the health department’s office of preparedness the “right home for cybersecurity”? “I’m not sure,” he said.

Historically, the office has focused on disasters in the physical world – earthquakes, hurricanes, anthrax attacks and pandemics. She inherited cybersecurity as Trump-era department leadership grabbed more money and power, said Chris Meekins, who worked in the Trump-era readiness office and is now an analyst at investment bank Raymond James.

However, since then, Meekins said, the agency has shown it is “not qualified to do this.” There is no funding, no commitment, no expertise.

The preparedness office has only a “small handful” of cybersecurity staff, said Annie Fixler, director of FDD’s Center for Cyber and Technology Innovation. Mazanec admits that the number is not high, but hopes that the additional funds will allow it to hire more employees.

The office responds to external opinions with a delay. When the industry cyberthreat clearinghouse tried to coordinate with it to create an incident response process, “it took probably three years to find someone willing to support” the effort, said Jim Routh, then chairman of the board of the Health Information Sharing and Analysis Center group.

Routh said that during the 2017 NotPetya attack — a hack that caused major damage to hospitals and drugmaker Merck — Health-ISAC ultimately distributed information to its members, including the best method to stop the attack.

Advocates are looking at the Change hack – allegedly caused by a lack of multi-factor authentication – a technology very familiar in American workplaces – and say HHS must use mandates and incentives to get the health care sector to implement better safeguards. The department’s strategy, published in December, proposed a relatively limited list of goals for the health care sector, which for now are mostly voluntary. The agency is “exploring” the possibility of creating “new, enforceable” standards, Mazanec said.

Most of the HHS strategy is expected to be implemented in the coming months. The ministry has already asked for additional funds. For example, the preparedness office wants an additional $12 million for cybersecurity. The Office of Civil Rights, with a flat budget and a shrinking law enforcement workforce, is set to release an update to its privacy and security policies.

“There are still significant challenges facing the entire industry,” Routh said. “I don’t see anything on the horizon that will necessarily change that.”

KFF Health News is a national newsroom dedicated to broadly understood journalism about health issues and is one of the main operational programs of KFF – an independent source of health policy research, polls and journalism.