In October 2024, the healthcare sector just passed an unfortunate milestone. As investigations into the Change Healthcare attack from February continued, the company revealed that sensitive patient information on more than 100 million Americans had been exposed in the attack. This figure makes the incident the largest healthcare breach of all time.

Yet this attack was far from the only one to compromise millions of healthcare records in the past year. Other breaches have exposed sensitive medical images and millions of pieces of personal health data. As cyber threats and breaches like these grow, it is evident that the healthcare sector needs a better approach to cybersecurity.

The problem with cybersecurity

Healthcare faces some specific challenges compared to other industries when it comes to cybersecurity. Lack of adequate resources in staff and funding is one of the main issues. Three in four healthcare IT professionals say understaffing is a significant workforce challenge. Nearly one-half of IT teams said their facilities lack the budget to hire qualified personnel. Without an adequate budget or staff, facilities cannot keep software up to date or adequately monitor unauthorized access to essential systems.

Another top issue is the number of third parties that healthcare organizations must deal with to provide patient services, including medical technology providers, billing software, IT companies and diagnostic testing companies. Every one of these third parties presents another potential way for cybercriminals to access essential systems and data.

Healthcare data and systems are often life-critical functions. In the event of a ransomware attack locking down necessary systems, healthcare companies are more likely to pay the ransom to regain access. This makes the entire industry a more attractive target for cybercriminals looking for big payouts.

Finally, with the rise of telemedicine, connected devices and data-driven healthcare, the volume of data healthcare organizations handle is expanding. Attempts to store and manage this data at scale increase the likelihood of potential data leaks throughout the industry.

Developing an effective response

With such limited resources and so many attack vectors, the healthcare industry has a long road ahead to address the cybersecurity problem. Let’s start with ways healthcare facilities managers can overcome budget constraints.

When healthcare facilities do not have the money or staff to protect all of their systems and data adequately, it is time to prioritize. Managers should conduct regular risk assessments to identify their most vulnerable assets and focus on those areas in cybersecurity planning. Mapping out which assets are life-critical and require immediate attention helps maximize the impact of limited resources.

Additionally, various grants are available for healthcare facilities looking to improve cybersecurity, such as the U.S. Healthcare Connect Fund’s initiatives. These funds can help hospitals – particularly in rural areas – update systems, manage audits, leverage services for virtual chief security officers and even hire new personnel.

There are also ways for organizations to address the risks associated with the high number of third-party vendors. Managers should restrict third-party access to only the data and systems those vendors need to perform their functions. Using data segmentation and enforcing least-privilege access policies can reduce the potential damage if a third-party vendor is compromised.

Contracts with vendors, particularly software providers, also should specify cybersecurity requirements like audits and compliance with relevant regulations, including HIPAA. This ensures vendors take proactive measures to secure data and remain accountable.

Since healthcare data and systems are often life-critical, managers should regularly backup their systems to make sure they can recover data quickly in the event of a ransomware attack. Ideally, users should be able to access essential patient data even if a breach compromises primary systems.

The role of collaboration

The amount of data healthcare facilities collect and manage is only going to increase, which means that solving cybersecurity issues must become an industry-wide endeavor that involves strong collaboration among facilities. Healthcare providers should share information with each other about ransomware attacks and data-protection strategies. This collective approach to cybersecurity helps strengthen defenses against attackers that are becoming increasingly sophisticated and well-resourced.

The concept of information sharing in critical infrastructure sectors has been around for over 25 years. Organizations that coordinate and share cybersecurity intelligence and best practices provide a highly secure and trusted environment to promote collaboration among healthcare organizations.

The challenge of securing healthcare data is complex and evolving, but collaboration across the industry can make a substantial difference. When healthcare facilities and their partners unite to focus on cybersecurity, they create a stronger network that is better equipped to protect the sensitive data patients entrust to them even as threats continue to grow.

Errol Weiss is chief security officer of Health-ISAC.