Just like the rest of us, hospitals are becoming more connected. Everything from MRI machines to heart rate monitors are linked to the internet. The latest equipment improves patient care, but connection comes with risk.
Beau Woods is a cybersecurity expert and founder of Stratigos Security.
“If you can’t afford to protect it, you can’t afford to connect it,” Woods said.
Woods says investing in the latest cybersecurity tools is more important than ever for hospitals big and small. They’ve become prime targets because of valuable patient data that can be sold or held for ransom.
Federal reports and studies show cyberattacks slow doctors’ ability to treat patients and can even force hospitals to send patients elsewhere for treatment, delaying care and putting patients’ lives at risk.
Federal officials say cyberattacks against healthcare facilities doubled between 2022 and 2023.
But properly protecting against a cyberattack can be especially hard for smaller hospitals, says CEO of the Montana Hospital Association Bob Olson.
“For a couple of reasons: It is expensive and to find the IT professionals, they have the same kinds of problems with recruiting people to be in the more rural communities,” said Olson
Experts say many high-end cybersecurity tools are mostly marketed to larger hospital systems, and cost at least six figures.
That’s why the White House’s announcement earlier this month is a big deal. Google and Microsoft will offer one year of free security assessments and heavy discounts on their cybersecurity tools for small hospitals.
CEO of the National Rural Health Association Alan Morgan helped broker the deal. While these services are temporary, he thinks they will help.
“You’re never going to get a level playing field here, but we got to be able to do at least a bottom tier level tier of protection to try to keep our communities safe,” Morgan said.
Cybersecurity experts agree that this offer is a step in the right direction but without support in the future, small hospitals could again struggle to pay for adequate cyber defenses.
Experts like Amie Stepanovich with the Future Privacy Forum would also like to see federal money help hospitals respond to attacks and recover.
“Folks who are in the cybersecurity industry say they have to be perfect all the time, defense has to be complete. All the attacker needs is to find the one hole,” Stepanovich said.
Small hospitals have increasingly become targets. Logan Health In Kalispell experienced multiple data breaches, with one leading to a legal settlement. St. Vincent in Billings and St. Patrick in Missoula have also experienced data breaches. A hospital in Gillette, Wyoming diverted patients in 2019 during a cyberattack because it couldn’t properly treat them.
“And if you’re going to a hospital that’s been hit by ransomware and you get diverted to another one that’s an hour away, then you lose all the advantages that you have of the modern health care system,” Woods said.
Woods says doctors need to be prepared for cyberattacks. He runs simulations for providers through CyberMed Summit, a nonprofit focused on cybersecurity in the healthcare industry.
George Washington University medical resident Arman Hussain went through a recent simulation. He treated patients having a stroke and heart attack.
“In both of those scenarios, our ability to use the computer and some of our ability to use vital monitoring software went away in the middle of the simulation,” Hussein said.
He says there are many workarounds for those problems, like manually getting vitals. But other things can slow to a crawl. Getting crucial medications or lab results can be hard if that’s all done through a computer system that’s shut down. Not knowing a patient’s allergies, or seeing their digital medical files can also be a problem.
“I don’t know how I’m going to get my medication because of this or I can’t look up my patient’s old record because of this. Putting yourself in that scenario is going to bring forth all these different logistical questions you would have never thought of if were you not in that situation itself,” Hussein said.
He says every hospital should provide this training and create plans for when an attack happens so patients can get the lifesaving care they need.
