In a recent HITRUST virtual panel co-sponsored by eFax Corporate\u00ae, \u201cEffectively Managing Cybersecurity Vulnerabilities in a Turbulent Healthcare Ecosystem,\u201d HITRUST\u2019s Michael Parisi shared an insightful anecdote.<\/p>\n\n\n\n
A friend of Michael\u2019s, working from home during the lockdown, had a phone call with a customer to discuss highly sensitive information\u2014while his patio door was wide open. Afterward, the man\u2019s wife came in from outside and told him she heard everything he\u2019d said to the customer. Oh, and so did the couple\u2019s next-door neighbor.<\/p>\n\n\n\n
What makes Michael\u2019s point relevant to this conversation about healthcare cybersecurity during COVID is that we\u2019re all running our businesses and performing our jobs under new circumstances, which means we\u2019re all facing new risks and threats.<\/p>\n\n\n\n
Now, imagine that call was between a physician and a patient\u2014and think of the neighbor as an Alexa or Siri in the doctor\u2019s home, with a cybercriminal hacking the device to listen in for sensitive data. As Michael pointed out, \u201cThe devices are always listening.\u201d<\/p>\n\n\n\n
That was just one of many lockdown-era cybersecurity threats discussed by the expert panel, which included:<\/p>\n\n\n\n
Among the other quarantine-era risks the panel discussed included:<\/p>\n\n\n\n
Healthcare organizations have had to adjust so much of their operations to address work-from-home arrangements\u2014policies, controls, assessments, tools, technologies\u2014that many IT teams have had to shift their focus away from security, privacy, and regulatory compliance.<\/p>\n\n\n\n
With the medical industry working to develop both a COVID vaccine and new treatments, hackers see increased value in going after these companies\u2019 networks and systems to steal this intellectual property. This is why cyberattacks against biopharma companies have skyrocketed since the early days of the pandemic.<\/p>\n\n\n\n
Many healthcare-industry professionals are working from home, often for the first time, while also dealing with the stress of the pandemic. These disruptions in our professional and personal lives can leave us more distracted and vulnerable to poor decisions\u2014such as falling for phishing attacks.<\/p>\n\n\n\n
EHNAC\u2019s Lee Barrett cited one incredible example. The HHS issued a warning that hospitals\u2019 security and privacy officers were receiving postcards, supposedly from the \u201cSecretary of HIPAA Compliance,\u201d asking them to visit a URL for a risk assessment. The problem: There is so such position as Secretary of HIPAA Compliance. This is a new phishing attack, designed to take advantage of everyone\u2019s confusion during COVID. And many of these healthcare security professionals are falling for it.<\/p>\n\n\n\n
Another challenge the panel discussed was that the healthcare industry has only finite resources and budget\u2014and right now, the priority for these organizations is protecting people\u2019s health during COVID. In other words, many organizations are having to weigh competing objectives and de-emphasize everything other than the challenges of treating COVID patients and saving lives. Unfortunately, \u201ceverything\u201d can also include cybersecurity and data-privacy initiatives.<\/p>\n\n\n\n
The panelists offered a number of suggestions for health organizations to better protect their sensitive data. j2\u2019s Jeffrey Sullivan, for example, suggested a couple of best practices for healthcare IT teams during what he described as our current \u201conce-in-a-lifetime level of distraction.\u201d<\/p>\n\n\n\n
First, Jeffrey suggested, review your cybersecurity infrastructure across your newly distributed organization. Make sure all of the automated tools and processes are doing their jobs, meaning:<\/p>\n\n\n\n
Jeffrey also recommended contacting the third parties whose apps, platforms, and other cloud tools your employees use. Ask them what specific steps they\u2019ve taken to protect their systems\u2014and your company\u2019s sensitive data\u2014during this period of heightened risk from cybercriminals.<\/p>\n\n\n\n
Lee Barrett of EHNAC\u2014who called j2\u2019s level of cybersecurity preparedness \u201ca model for the industry\u201d\u2014offered another valuable recommendation:<\/p>\n\n\n\n
Lee noted that the best way to make sure your organization is meeting all of its cybersecurity and regulatory standards is to have your infrastructure and processes audited and tested by a third-party expert.<\/p>\n\n\n\n
Now more than ever, your internal IT security teams have too much on their plate to make sure you\u2019re addressing\u2014or even seeing\u2014all of the new potential threats to your organization\u2019s data security.<\/p>\n\n\n\n
For HIPAA-compliant, HITRUST-certified, and COVID-secure cloud faxing, learn what eFax Corporate can do for your organization.<\/p>\n\n\n\n