You only have to read the latest news to feel a little nervous about your facility's security.
Recently, UnitedHealth Group confirmed a massive theft of healthcare data in a ransomware attack. Criminals took files containing personal data and protected health information from a substantial portion of the American population.
We’re only just beginning to know the extent of this theft. The hackers were inside the network for more than a week before deploying ransomware, which means they were able to steal significant amounts of data undetected before releasing their demands. It started with widespread outages at pharmacies and hospitals. This resulted in physicians, pharmacies, and hospitals being unable to do basic tasks such as dispensing medications, organizing inpatient care, or processing authorizations necessary for surgeries. How far it will go, and for how long is anybody’s guess.
This should be a wake-up call for anyone in healthcare. Are you doing all you can to protect your data?
While cybercriminals are working diligently to get what they want, you can actively do your part by ensuring you have robust security measures in place. Start with vulnerability assessments - they can showcase your weak points and help you make better decisions as you move forward. We suggest these:
Network Security Assessment
How secure is your network? Begin by evaluating your firewall configurations. Conduct penetration testing to discover open ports and weak points throughout the system. Ensure you’re using secure VPNs for remote access.
Data Security Assessment
Is your data secure? Review all procedures and encryption methods for stored and transmitted data. Check your data backup and recovery processes. Assess the security of your Electronic Health Records (EHR) systems.
Access Control Assessment
Who is accessing your data? Verify all users in your systems; what access and permission levels are they using? Implement multi-factor authentication for sensitive systems. Review and update access logs regularly.
Endpoint Security Assessment
How secure are your systems and devices? Ensure all devices have updated antivirus and anti-malware software. Implement a system that checks for unauthorized devices connected to the network. Regularly update and patch all software and operating systems.
Physical Security Assessment
How secure is your workplace? Assess the security of physical access to IT infrastructure, such as servers or networking equipment. Implement biometric or card access controls for any and all sensitive areas. Surveillance systems can also provide another level of safety; ensure they are operational and well monitored.
Application Security Assessment
How vulnerable are your applications? Conduct code reviews and vulnerability scanning of all internal applications. Ensure third-party applications are regularly updated and patched. Never assume something is secure just because you purchase it from a vendor; have your own assessments to ensure safety.
Incident Response Plan Assessment
How well would you handle emergencies? You don’t know unless you have a plan and test it regularly. Review and update your incident response plan. Conduct regular drills and training for staff on incident response procedures. Ensure you log and monitor all security events.
Staff Training and Awareness Assessment
Are your staff well prepared for security threats? Conduct regular cybersecurity training sessions for all staff. We also suggest you implement phishing simulations to test staff awareness. Ensure staff are aware of policies for handling sensitive information. Have a plan for reporting procedures in the event a staff member has questions or notices unusual behavior.
Compliance and Regulatory Assessment
Are you in full compliance with all healthcare regulations? This includes HIPAA and other local and federal regulations. Regularly review and update policies to meet regulatory requirements. Conduct audits to verify compliance with industry standards.
Third-party Risk Assessment
How safe are all third-party vendors? While you might be unable to control their security features, you should evaluate how well they protect your data. Ensure agreements include security and privacy clauses. Conduct regular reviews and audits of third-party access and activities. It is up to you to remain aware of how your data is being handled.
Security will always remain a problem. The news will continue to remind us daily how cybercriminals are walking away with what we value most. Privacy matters, and keeping your data as safe as possible is up to you.
Can we help you with your next vulnerability assessment?
For IT Strategy, Cloud Conversion, or Help Desk Services reach out to us at Silver Linings Technology 360-450-4759.
