LUGPA Policy Update: Cybersecurity in Healthcare – A Call to Action

Oct. 2024

Cybercriminals are increasingly attacking healthcare providers, and data breaches are rising sharply in frequency and scale. In 2023 alone, more than 133 million individuals were impacted by healthcare data breaches—over double the previous year’s total—demonstrating the urgent need for more robust cybersecurity measures. On average, each breach affected over 200,000 individuals, underscoring the magnitude of these incidents.

One of the most significant recent breaches in 2023 involved Medicare beneficiaries. More than 900,000 individuals were notified that their personal data—including Medicare claims information, Social Security numbers, and personally identifiable information (PII)—may have been compromised due to a vulnerability in the MOVEit file transfer service.

The breach occurred between May 27 and May 31, 2023, when unauthorized third parties accessed sensitive data from the Wisconsin Physicians Service Insurance Corporation (WPS), a Centers for Medicare & Medicaid Services (CMS) contractor. This incident highlights healthcare’s digital infrastructure vulnerabilities and the need for enhanced cybersecurity to prevent future breaches.

The financial toll of these breaches is staggering. Cybersecurity firm Emsisoft estimated the cost of the MOVEit breach to exceed $15 billion, factoring in the economic risks, potential identity theft, and fraud exposure. CMS and WPS took immediate steps to mitigate the damage, offering credit monitoring and advising affected individuals on protective measures. However, this breach serves as a stark reminder of the increasingly sophisticated nature of cyberattacks in healthcare.

Ransomware is another major concern, with 46 healthcare systems targeted in 2023, compared to 25 in 2022. These attacks disrupt patient care and lead to long-term financial and reputational harm. The healthcare sector has been particularly vulnerable, with breaches costing an average of $10.93 million per incident—far exceeding the financial damage seen in other industries.

Given these rising threats, healthcare providers must prioritize cybersecurity. Key steps include:

1. Access Controls: Implement multi-factor authentication and restrict access to sensitive data.
2. Encryption: Ensure data is encrypted in transit and at rest.
3. Firewalls: Use firewalls to filter and monitor network traffic.
4. Data Backups: Regularly back up critical data to secure locations.
5. Device Management: Safely dispose of outdated devices to prevent data leaks.
6. Staff Training: Educate staff on cybersecurity policies and the latest threats.
7. Telehealth Security: Ensure secure environments for telehealth sessions.

The Department of Health and Human Services (HHS) reports a 256% rise in large healthcare data breaches over the past five years, with a 264% increase in ransomware attacks. To safeguard patient data, healthcare organizations must proactively strengthen their cybersecurity defenses, invest in advanced technologies, and foster a culture of cybersecurity awareness.

On September 26, Senators Ron Wyden (D-OR) and Mark Warner (D-VA) introduced the Health Infrastructure Security and Accountability Act to strengthen cybersecurity across the U.S. healthcare system. The bill mandates that the Department of Health and Human Services (HHS) enforce stricter cybersecurity standards for healthcare providers and related entities, with stronger rules for critical organizations. It removes the cap on HIPAA fines to deter large corporations from neglecting cybersecurity and allocates $800 million for safety-net hospitals and $500 million to help other hospitals improve their defenses.

In response to recent cyberattacks like the one on Change Healthcare, which compromised patient data and disrupted care, the bill requires mandatory annual cybersecurity audits and stress tests for healthcare entities. It also authorizes HHS to audit 20 companies annually and imposes fines for non-compliance. The act establishes user fees to support oversight and allows HHS to provide advanced Medicare payments during cyber disruptions. Critics warn that these measures could disproportionately impact small and underfunded healthcare facilities.

A one-page summary of the bill can be found here. The legislative text can be found here.

For additional resources on enhancing cybersecurity in healthcare, visit LUGPA’s dedicated page: Improving Cybersecurity for Healthcare Providers.