In 2019, the healthcare industry suffered losses of more than $4 billion in data breaches.
Cybercriminals target the healthcare sector because of the treasure trove of sensitive data available and the high resale value of that data in the underground black market.
Scarier still: Most organizations' security practices are often less sophisticated than other industries.
Healthcare identity information is at least 10 times more valuable than financial data alone and can be used to set up fraudulent lines of credit, commit medical insurance fraud, or obtain pricey medical care for another person.
Cyberattacks affect all healthcare companies, from local doctor’s offices to major health insurers.
The likelihood of a successful crypto-ransomware attack against the healthcare sector is significantly higher than other sectors, due to the lack of mature information security programing and working security measures.
In fact, 15% of all cyber breaches in 2019 involved healthcare organizations.
The surge of ransomware attacks has prompted the FBI to issue news alerts to the media, hospitals, and healthcare providers.
There are certain measures known to be effective to prevent the introduction of ransomware and to recover from a ransomware attack.
In order to help health care entities better understand and respond to the threat of ransomware, OCR released new HIPAA guidance to prevent, detect, contain and respond to these threats.
Since ransomware can compromise the integrity and availability of electronic protected health information, the guidance makes clear that a ransomware attack usually results in a “breach” of healthcare information under the HIPAA Breach Notification Rule. Under the rule, entities experiencing a breach of unsecure PHI must notify individuals whose information is involved in the breach.
