Clinical Scorecard: Understanding Today’s Cybercrime

At a Glance

Key Highlights

• Ransomware and hacking are the primary cyberthreats in health care today with a 278% increase in ransomware-related breaches from 2018 to 2022.
• Phishing emails account for over 90% of malware and ransomware attacks, exploiting human factors rather than technology.
• AI is expected to increase the sophistication and success rate of cyberattacks, making detection more difficult.

Guideline-Based Recommendations

Diagnosis

• Recognize phishing attempts by suspicious email characteristics such as unexpected links, attachments, and official-looking but fraudulent graphics or logos.
• Verify web addresses by manually entering URLs into browsers rather than clicking links.

Management

• Implement reasonable and appropriate administrative, technical, and physical safeguards for e-PHI as required by HIPAA Security Rule.
• Conduct in-house training or collaborate with consultants to educate all employees on cybersecurity awareness and phishing detection.
• Maintain a culture of suspicion and verification to prevent engagement with malicious communications.

Monitoring & Follow-up

• Regularly monitor for large data breaches and ransomware incidents as tracked by authorities such as HHS OCR.
• Stay updated on emerging cyber threats including AI-enhanced attacks and geopolitical factors influencing cybercrime.

Risks

• High risk of cyberattacks due to sensitivity of health data and necessity of electronic data sharing.
• Increasing threat complexity due to AI and cybercrime as a service models.
• Potential impact on timely and safe patient care delivery.

Patient & Prescribing Data

Patients whose electronic protected health information is managed by health-care entities

Cybersecurity measures directly affect the safety and timeliness of patient care by protecting sensitive health data from breaches.

Clinical Best Practices

• Promote cybersecurity awareness among all health-care staff including frontline clinicians.
• Ensure compliance with HIPAA Security Rule safeguards for e-PHI.
• Verify suspicious emails and avoid clicking on unknown links or downloading attachments without confirmation.
• Use manual URL verification to confirm legitimacy of web addresses.
• Stay informed about evolving cyber threats and incorporate new protective strategies accordingly.

References

• U.S. Department of Health and Human Services (HHS) on ransomware and hacking threats
• HHS Office for Civil Rights (OCR) report on health-care data breaches 2018-2022
• Health Insurance Portability and Accountability Act (HIPAA) Security Rule
• 2024 Data Breach Investigations Report by Verizon Business