Cyber Pulse: The State of Cybersecurity in Healthcare

### Overview With information-sharing systems proliferating across healthcare environments, safeguarding sensitive patient data has become critical. As of January 2019, over 200 US healthcare organizations suffered IT or hacking-related incidents that affected 500 or more patients. Breached healthcare providers face significant recovery costs, spending an average of $408 per patient to recover healthcare records and up to $1.7 million in advertising to address reputational damage. To explore the factors driving these issues, Kaspersky commissioned a survey of nearly 2,000 healthcare employees across the United States and Canada, evaluating regulatory awareness, security policies, training, and device security protection.

### Key Topics - **Regulatory Awareness:** Longstanding frameworks exist—such as HIPAA instituted in 1996 in the US and PIPEDA/PIPA in 2000 in Canada—yet organizations struggle to make staff aware of compliance mandates. - **Security Policies & Governance:** The necessity of establishing and communicating clear cybersecurity policies so staff understand their role in incident prevention and mitigation. - **Cybersecurity Training:** Developing a culture of vigilance where personnel receive initial and recurrent training on identifying threats and handling security incidents. - **Device Protection & IT Awareness:** Visibility into how IT systems and endpoint devices storing protected health information (PHI) are secured.

### Technical Details - **Regulatory Gaps:** 18% of surveyed US healthcare workers did not know the meaning of the HIPAA Security Rule. In Canada, where British Columbia and Nova Scotia prohibit storing protected health information in the US, 49% of Canadian healthcare respondents did not know where PHI had to reside. - **Policy Deficits:** 21% of respondents were unaware of any cybersecurity policy within their organization while acknowledging one should exist. Among organizations with policies, only 17% of employees in medium and enterprise organizations and 10% in smaller organizations reported reading it more than once. - **Training Shortfalls:** Approximately one-third of US healthcare employees reported never receiving cybersecurity training despite acknowledging they should have, and roughly one-fifth expressed a need for more training. Comparing employee populations, 24% of US respondents and 41% of Canadian respondents had never received cybersecurity training. - **Device Security Visibility:** 40% of surveyed healthcare staff did not know how their IT devices were protected. Unawareness was inversely correlated with organization size: 53% of employees in small organizations were unaware of device protections, compared to 39% in medium organizations and 36% in large enterprise organizations.

### Takeaways Healthcare organizations must improve education regarding regulatory requirements, general security awareness, and incident response protocols so workers know how to respond to suspected issues. Furthermore, healthcare providers must not only implement technical controls on systems storing patient data, but actively communicate these protections to staff to ensure organizational adherence and cultivate employee confidence in data protection practices.