Healthcare data breaches hit an all-time high in 2024, until June 400 breach incidents have been reported involving millions of records.
In April alone, the protected health information (PHI) of 15 million individuals was exposed due to unauthorized access/disclosure incidents, the largest of which involved Kaiser Permanente affecting 13.4 million individuals.
This only means that the recent healthcare data breaches have increased in severity. Such breaches also attract massive fines, non-compliance penalties, and loss of reputation.
How should healthcare organizations manage the data breaches, and how should they prevent future attacks? Keep reading to find out.
Ways to Manage Healthcare Data Breaches
1. Identify the Threat
You need to identify the source of the threat, vulnerabilities exploited, attack vectors used, the extent of affected systems and infrastructure, etc, with vulnerability scanners. This will help you choose containment and remediation methods and tools.
2. Set Your Incident Response and Disaster Recovery Plan in Motion
If you suspect you are under attack, it is critical that you stop data from being stolen, clean up and repair systems quickly and make sure that the attack doesn’t recur.
To this end, you need to implement your incident response and disaster recovery plan. This will typically begin with informing key internal stakeholders, including the cross-functional response team, IT teams, top management, legal teams, etc.
3. Communicate
Data breaches in the healthcare industry (like most others) require organizations to disclose breaches to the public and external stakeholders legally.
Do not disclose publicly breached information to patients, as it causes a significant loss of trust and reputation. It is critical that you disclose it to those affected and the public before the media or your employees do.
4. Preserve Evidence
While the need to fix breaches instantly is understandable, do not take hasty decisions such as shutting down or altering devices/ networks, reinstalling or wiping systems, etc., without the right people and strategies.
This way, you may unknowingly delete valuable forensic data that enables you to understand gaps and be better prepared to prevent future data security breaches in your healthcare organization. Make sure to preserve all forensic evidence from data breaches.
5. Contain the Breach
Upon identifying the threats and all other relevant information about the healthcare data breach underway in your organization, you need to contain it and prevent further damage. To this end, you should
- Isolate and freeze affected systems, networks, devices, etc. and stop communications with them quarantine identified malware
- Temporarily delay or disable services
- Disable (don’t delete) remote access capabilities and wireless access points
- Segregate hardware devices in the EMR from other critical devices while relocating them to separate sub-networks
- Restrict access to EMR; regular traffic should only have access to critical ports and servers outside the EMR
- Change passwords and disable non-critical accounts but don’t delete anything
- Document all the changes (including disabling and freezing) you are making during this phase
It is best to develop a containment strategy well in advance based on scenario planning and with the help of trusted security experts instead of scrambling for help after the attack.
6. Eradicate and Recover
The previous two steps must be done systematically and properly before threat eradication since improper threat identification and containment leaves damaging gaps in security that make the affected systems exploitable in the future.
To eradicate the threat, you must
- Close vectors of reinfection and vectors of exfiltration
- Remove backdoors, malware, compromised credentials, affected accounts, etc.
- Perform thorough pen-testing to identify unknown threat vectors and remove them
Some steps in recovery include:
- Apply patches/ fixes/ virtual patches for all unsecured vulnerabilities
- Switch on auditing and logging systems immediately as attackers tend to switch them off to cover their tracks
- Update all software
- Run malware tests
- Wipe or replace affected/infected hardware
- Refresh all images with up-to-date master images
- Restore data and systems using good backups stored in secure locations
7. Investigate and Analyze Forensically
This is a critical step to protect your organization after a healthcare data breach. If you don’t have in-house experts, enlist the services of certified security experts to conduct thorough forensic analysis and root cause analysis.
This will help you go to the root causes and understand the critical weaknesses in security instead of stopping with the fixing of symptoms through containment. These insights can strengthen your security posture and prevent future data breaches.
8. Re-evaluate and Strengthen Security to Prevent Future Healthcare Data Breaches
It is best to test the strength of your newly deployed security defenses to ensure they are effective. But don’t stop there; keep testing and evaluating security measures’ effectiveness and tuning them in line with the changing threat landscape.
Conclusion
Given the alarming healthcare data breach statistics, healthcare organizations must shore up their security and plan for cybersecurity contingencies.
That’s the only way they can effectively prevent data breaches or minimize the impact.
