An ounce of prevention: how the healthcare industry can fight cybercrime
The healthcare industry is under siege. Cyber attacks are exposing personal health data, ransomware is disrupting essential health services and shutting down emergency rooms, and fraudulent emails are defrauding partners, patients and staff.
Clinical staff, health consumers and business associates are all increasingly targeted due to the intrinsic value of healthcare records, as well as the susceptibility of the industry to malicious attacks. The industry’s complex, expansive supply chain provides gaping holes for criminals to use phishing emails to cause disruption and steal important data. Add to this the fact that techniques used by perpetrators today are more sophisticated than ever before, exploiting healthcare workers’ natural curiosity, acute time constraints and desire to serve, and you have a recipe for disaster.
Proofpoint’s 2018 Healthcare Threat Report revealed 40mn attacks against hospitals, clinics and health insurers in the third quarter of 2017 alone, illustrating the true extent of the threat facing the industry. Above all, an effective cybersecurity defence starts with a better understanding of the threats in today’s climate, and security teams as well as employees need to be as security savvy as possible. The age-old saying still holds true: an ounce of prevention is worth a pound of cure.
Rise of ransomware
Many healthcare organisations learned about ransomware the hard way during last year’s WannaCry attack, which hit 200,000 victims in over 99 countries. Given the devastation of the attack, it may come as little surprise that ransomware accelerated from 4mn attacks in the second quarter of 2017 to over 17kmn attacks one quarter later. This explosion in activity secured ransomware’s position as the biggest threat facing the industry by far in 2017.
Ransomware can infect entire systems with just one click on a malicious URL or a single download of a seemingly benign attachment, and it only takes one slip for an overstretched employee to turn a normal day into a crippling cybersecurity incident. Ransomware is particularly detrimental for healthcare organisations as it has an instantaneous effect, locking down vital systems required for patient care and operational continuity.
Unfortunately, the need to get back up and running quickly means that these organisations are far more susceptible to caving in to criminals’ demands for ransom, and making these payments can tax already tight budgets. Good preventative measures can help ensure that the situation never reaches this point.
Surge in spoofing
One of the most effective techniques in an attacker’s arsenal is the ability to disguise malicious emails, making them appear to come from a trusted source. Fraudulent emails use social engineering tactics to lure victims into wiring funds, sending sensitive data or divulging system credentials. These attacks are incredibly effective because they prey on people who are time poor and are trying to fulfil requests as quickly and efficiently as possible.
Proofpoint research highlights that a staggering one in five emails purporting to be from a healthcare organisation in 2017 was in fact fraudulent. Furthermore, of three billion emails observed to use the domain of a known healthcare brand, about 8.3% of these were in fact from sources that were either unauthorised or malicious. The ratio might seem small, but it amounts to 262mn malicious emails appearing to come from a trusted domain and requiring other indicators to raise a red flag. With healthcare staff rushed off their feet, their behaviour needs to be conditioned so they can identify phishing emails based on a range of factors (for example, by checking that URLs and attachments are legitimate, in addition to looking at the sender). Proper authentication, threat intelligence, and cybersecurity training tools can help prevent successful phishing attacks.
- Drug screening – improving the testing process
- AI is seen less of a threat and is welcomed by health professionals, research reveals
- Leveraging technology and education in the high-stakes fight against fake medicines
Prevention is better than cure
As we see time and time again, the human factor is the weakest security link within any organisation. Small or large, nearly every cyberattack starts the same way, by targeting a person, via an email. Turns out cybersecurity, like healthcare, is about people.
Healthcare organisations must prioritise improving their defences against modern threats and modifying their security controls to address how people work today. As such, when it comes to bolstering cybersecurity defences, organisations need to look at both technology and people to map out a multi-layer strategy and consider employees to be the last line of defence.
Incidentally, the healthcare industry has been relatively proactive in implementing security awareness training. In a recent survey of healthcare IT providers by HIMSS, 73.5% said they conduct security awareness training for end users. What’s troubling, however, is that half of these organisations rely on once-a-year training.
Considering the speed at which threats evolve, such infrequent training might be just enough to comply with regulatory requirements, but it fails to produce satisfactory knowledge retention. Continuous awareness training aimed at the most targeted people within an organisation needs to be prioritised.
In few other industries can cyber-attacks pose such a direct threat to life. Healthcare organisations have a duty of care, and we are in an age when a successful attack can take essential systems and services offline for hours, if not days or even weeks at a time. Part of the modern commitment to patient care is having a robust cybersecurity strategy in place in order to prevent these disruptions from taking place. Below are some key recommendations to consider:
Train your people to spot attacks that target them. Your security awareness training should include phishing simulations that use real-world tactics and allow you to identify the people and departments that are most at risk. In addition, staff members should be taught to recognise attacks across email, cloud apps, mobile apps and social media.
Get advanced threat analysis that learns and adapts to changing threats. Today’s fast-moving, people-centered attacks are immune to conventional signature- and reputation-based defences. Be sure you can adapt as quickly as attackers do.
Secure your email channel – cybercriminals’ attack vector of choice. Deploy email authentication protocols such as DMARC and lookalike domain defences. These technologies stop many attacks that use your trusted brand to trick employees, partners, vendors and customers.
Get visibility into the cloud apps, services and add-ons your employees use. Deploy tools to detect unsafe files and content, credential theft, data loss, third-party data access and abuse by cloud scripting apps.
How UiPath robots are helping with the NHS backlog
The COVID-19 pandemic has caused many hospitals to have logistical nightmares, as backlogs of surgeries built up as a result of cancellations. The BMJ has estimated it will take the UK's National Health Service (NHS) a year and a half to recover.
However software robots can help, by automating computer-based processes such as replenishing inventory, managing patient bookings, and digitising patient files. Mark O’Connor, Public Sector Director for Ireland at UiPath, tells us how they deployed robots at Mater Hospital in Dublin, saving clinicians valuable time.
When Did Mater Hospital implement the software robots - was it specifically to address the challenges of the pandemic?
The need for automation at Mater Hospital pre-existed the pandemic but it was the onset of COVID-19 that got the team to turn to the technology and start introducing software robots into the workflow of doctors and nurses.
The pandemic placed an increased administrative strain on the Infection Prevention and Control (IPC) department at Mater Hospital in Dublin. To combat the problem and ensure that nurses could spend more time with their patients and less time on admin, the IPC deployed its first software robots in March 2020.
The IPC at Mater plans to continue using robots to manage data around drug resistant microbes such as MRSA once the COVID-19 crisis subsides.
What tasks do they perform?
In the IPC at Mater Hospital, software robots have taken the task of reporting COVID-19 test results. Pre-automation, the process created during the 2003 SARS outbreak required a clinician to log into the laboratory system, extract a disease code and then manually enter the results into a data platform. This was hugely time consuming, taking up to three hours of a nurse’s day.
UiPath software robots are now responsible for this task. They process the data in a fraction of the time, distributing patient results in minutes and consequently freeing up to 18 hours of each IPC nurse’s time each week, and up to 936 hours over the course of a year. As a result, the healthcare professionals can spend more time caring for their patients and less time on repetitive tasks and admin work.
Is there any possibility of error with software robots, compared to humans?
By nature, humans are prone to make mistakes, especially when working under pressure, under strict deadlines and while handling a large volume of data while performing repetitive tasks.
Once taught the process, software robots, on the other hand, will follow the same steps every time without the risk of the inevitable human error. Simply speaking, robots can perform data-intensive tasks more quickly and accurately than humans can.
Which members of staff benefit the most, and what can they do with the time saved?
In the case of Mater Hospital, the IPC unit has adopted a robot for every nurse approach. This means that every nurse in the department has access to a robot to help reduce the burden of their admin work. Rather than spending time entering test results, they can focus on the work that requires their human ingenuity, empathy and skill – taking care of their patients.
In other sectors, the story is no different. Every job will have some repetitive nature to it. Whether that be a finance department processing thousands of invoices a day or simply having to send one daily email. If a task is repetitive and data-intensive, the chances are that a software robot can help. Just like with the nurses in the IPC, these employees can then focus on handling exceptions and on work that requires decision making or creativity - the work that people enjoy doing.
How can software robots most benefit healthcare providers both during a pandemic and beyond?
When the COVID-19 outbreak hit, software robots were deployed to lessen the administrative strain healthcare professionals were facing and give them more time to care for an increased number of patients. With hospitals around the world at capacity, every moment with a patient counted.
Now, the NHS and other healthcare providers face a huge backlog of routine surgeries and procedures following cancellations during the pandemic. In the UK alone, 5 million people are waiting for treatment and it’s estimated that this could cause 6,400 excess deaths by the end of next year if the problem isn’t rectified.
Many healthcare organisations have now acquired the skills needed to deploy automation, therefore it will be easier for them to build more robots to respond to the backlog going forwards. Software robots that had been processing registrations at COVID test sites, for example, could now be taught how to schedule procedures, process patient details or even manage procurement and recruitment to help streamline the processes associated with the backlog. The possibilities are vast.
The technology, however, should not be considered a short-term, tactical and reactive solution that can be deployed in times of crisis. Automation has the power to solve systematic problems that healthcare providers face year-round. Hospital managers should consider the wider challenge of dealing with endless repetitive work that saps the energy of professionals and turns attention away from patient care and discuss how investing in a long-term automation project could help alleviate these issues.
How widely adopted is this technology in healthcare at the moment?
Automation was being used in healthcare around the world before the pandemic, but the COVID-19 outbreak has certainly accelerated the trend.
Automation’s reach is wide. From the NHS Shared Business Service in the UK to the Cleveland Clinic in the US and healthcare organisations in the likes of Norway, India and Canada, we see a huge range of healthcare providers deploying automation technology.
Many healthcare providers, however, are still in the early stages of their journeys or are just discovering automation’s potential because of the pandemic. I expect to see the deployment of software robots in healthcare grow over the coming years as its benefits continue to be realised globally.
How do you see this technology evolving in the future?
If one thing is certain, it’s that the technology will continue to evolve and grow over time – and I believe there will come a point in time when all processes that can be automated, will be automated. This is known as the fully automated enterprise.
By joining all automation projects into one enterprise-wide effort, the healthcare industry can tap into the full benefits of the technology. This will involve software robots becoming increasingly intelligent in order to reach and improve more processes. Integrating the capabilities of Artificial Intelligence and Machine Learning into automation, for example, will allow providers to reach non-rule-based processes too.
We are already seeing steps towards this being taken by NHS Shared Business Service, for example. The organisation, which provides non-clinical services to around two-thirds of all NHS provider trusts and every clinical commissioning organisation in the UK, is working to create an entire eco-system of robots. It believes that no automation should be looked at in isolation, but rather the technology should stretch across departments and functions. As such, inefficiencies in the care pathway can be significantly reduced, saving healthcare providers a substantial amount of time and money.