An Evolving Healthcare Cybersecurity Landscape

Cloud computing is still in its infancy in the healthcare industry, an industry that started experimenting with technology in the 1950s. But the pace of adoption is projected to continue to increase. With clinicians using mobility tools and the Internet of Things, the healthcare industry is collecting more patient data than ever before in history. Without the right security strategy and infrastructure, healthcare organizations are leaving patient data vulnerable and themselves open to potential lawsuits, not to mention the cost of the data breach itself.

Further, the increased use of virtual healthcare coupled with wearable personal health monitoring devices has dramatically increased the attack surface. Add to the mix the facts that commercial nonmedical companies are now involved with Amazon’s expansion into nationally available telehealth and Google has purchased Fitbit, we can see that we now have an even larger attack surface. The question is, with this increase, how do we make good on the promise of access to quality, cost-efficient, and secure healthcare?

As a result, there may be a cascade of negative impacts to successfully attacked organizations, such as significant fines/legal actions extracted by regulatory agencies like HHS, FDA,and GDPR; and the loss of patient and community confidence as well as reputational damage to all organizations involved.

It has been our observation that organizations adopting cloud services come to realize that with the adoption of every new CSP, they have essentially extended their enterprise into another entity “somewhere in a cloud” - one that they have limited control over and provides even less visibility into their operations. Yet, they remain fully accountable for continuous operation, effective performance, appropriate security, privacy, and all relevant regulatory compliance requirements. While not impossible, success is not a given without insightful planning, continuous vigilance, and mastery of the technology services being delivered throughout the supply chain. These new challenges may pose considerable budgetary and training burdens on organizations trying to balance patient care and the economic stress of operating in a global pandemic.

The challenge: How do healthcare organizations stay off of the “Wall of Shame”?

Well, there is no one-size-fits-all solution, but we know healthcare facilities have access to a tremendous amount of data that can benefit both the patient and the facility if used properly. With the innovations of IoT and MedIoT the promise has always been improved patient care. But with this comes responsibility to protect that data and the patients it belongs to.

At CSA we gathered some of our experts in the field to author and contribute to a Healthcare Playbook called Healthcare Cybersecurity Playbook- An Evolving Landscape. The playbook is intended to help healthcare organizations (CSC) and healthcare cloud service providers (CSP) [1] develop a preparedness framework to ensure they have the proper governance and controls in place, understand shared responsibility, prepare for security incidents, detect and analyze security breaches quickly, contain incidents, and recover from attacks and mitigate risks using CSA best practices and controls.

For cloud service providers, security controls, compliance, and the transparency thereof are rapidly becoming baseline expectations of users – especially enterprise customers in the healthcare industry. Increasing reliability of results, transparency, and ease of use of the CSP’s assurance reports are competitive advantages in today’s environment. However, in the near future this will be a barrier to entry for those who have not made the investment.

For cloud users, demanding transparency of evidence of the level of security and effectiveness of your cloud provider is an essential step in mitigating risk as well as understanding your organization's role and responsibility. Transparency goes a long way in proving due diligence and “standard of care”. CSA’s Consensus Assessment Initiative Questionnaire (CAIQ) and Cloud Controls Matrix (CCM) are excellent tools to start with for very good documented reasons.

If you’re interested in learning more about our healthcare guidance, you can download the full Healthcare Cybersecurity Playbook.

---

[1] CSC - Cloud Service Customer, CSP - Cloud Service Provider