Healthcare's cybersecurity status quo has been destroyed by a confluence of factors. We are now 17 years into the 21st century and the healthcare industry writ large has somehow managed to hold on to a minimalist cybersecurity posture that is two decades old. In Internet time this is equivalent to about 100 years. Despite a slew of continuous breaches and civil monetary penalties imposed by HHS, not much seemed to move the needle. However, the days where healthcare can continue to stick its collective head in the sand are quickly fading.
The real dangers posed by WannaCry and Petya, and the tsunami of similar ransomware attacks that are sure to follow, has awoken the healthcare masses to the fact that maybe this "cybersecurity thing" is not just Big Brother looking over their shoulder, but rather simply the cost of doing business in the 21st century. David Harlow's recent article nails it. The $$ quote follows:
Ransomware poses an existential threat to data security and operations in an era of electronic health records, integrated health data management systems and connected medical devices. As a result, it puts every person’s health and safety at risk.
That is not hyperbole. Cyberextortionists in May unleashed WannaCry ransomware on the general public, affecting hundreds of thousands of computers in 150 countries, including those at many National Health Service hospitals and clinics in the United Kingdom. The healthcare industry likely was not deliberately attacked, but instead was a target of opportunity, reached through links to malware distributed by email.
Going forward it is likely that the healthcare industry will be deliberately attacked because, as Willie Sutton infamously said: "That's where the $$ is." PHI is an obvious target of opportunity, not only for the purposes of extortion, but because allegedly the data itself is worth a significant amount of money on the black market (e.g. for identity fraud and other nefarious reasons).
The existential threat that David refers to above has the power to destroy reputations and result in millions (if not tens of millions) of dollars in costs and penalties, including class action litigation that is likely to, sooner rather than later, overcome the "what's the harm" threshold that has stymied prior suits from moving forward on a negligence theory (HIPAA having no private right of action; only HHS and State AGs can bring actions).
Finally, the generational gap where the "old grumpy docs" refused to comply as a matter of principle is also fading. None of us escapes the ravages of time, and the younger generation of healthcare executives, having grown up "digital," have a more holistic understanding of the risks, and therefore are better positioned to mitigate, including expanding compliance and information technology budgets commensurate with the existential threat.
This is not hyperbole and this is NOT Your Daddy's HIPAA anymore!
This
FREE HIPAA Cybersecurity Seminar/Webinar for healthcare compliance professionals, and other healthcare stakeholders, will be presented by Carlos Leyva, Esq., CEO of 3Lions Publishing, Inc. (the publisher of the
HIPAA Survival Guide) and Managing Shareholder of the
Digital Business Law Group.
We will summarize the lessons learned by the healthcare industry from WannaCry/Petya and perform a postmortem on their respective impact. WannaCry was a game changer and therefore requires immediate industry attention, especially because it foreshadowed the subsequent threats such as Petya...threats that are now the rule and not the exception.
This seminar/webinar also covers the threat to the healthcare industry posed by the
Internet of Things ("IoT"), which provide both huge opportunities BUT also exponentially more vectors to be exploited.
Healthcare professionals are among the busiest in the world and often lack the bandwidth to self-educate. This live (and "live streaming") Seminar provides stakeholders an opportunity to get caught up quickly.
There are two options for this Seminar - one is for you to attend in person or you can watch the Webcast of the Live Seminar. Registration is required for both options. Space is limited so be sure to RSVP right away!
Where: Hampton Inn, 100 East Bay Dr. Largo, FL.
When: July 14, 2017 2:30pm EST
If you have any questions, call us at 800-516-7903
