Why Healthcare Organizations Are Targeted by Cyberattacks

Healthcare organizations are frequent targets of cyberattacks. Large hospital incidents make the news, but physician practices, clinics, and the vendors that support them are affected as well. Understanding why helps explain where to focus defenses.

Why attackers target healthcare

The data is valuable. Medical records combine identity details, insurance information, and health history. That information can be used for fraud and is difficult for patients to change after exposure.

Disruption creates pressure. When systems go down, scheduling, documentation, prescribing, and billing are affected. Attackers using ransomware count on that pressure to push organizations toward paying.

Environments are complex. Healthcare organizations run many connected systems: EHRs, imaging, practice management, portals, medical devices, and third-party integrations. Each is a potential entry point.

Many people need access. Clinicians, front-desk staff, billing teams, and vendors all need access to patient information, often from multiple locations and devices.

Resources are limited. Smaller organizations often rely on a single IT provider and have no dedicated security staff. Attackers look for the easiest way in, not the biggest organization.

Common attack paths

• Phishing and social engineering. Emails or calls that trick staff into revealing credentials, opening malicious attachments, or approving payments.
• Stolen or weak credentials. Reused passwords, accounts without multi-factor authentication, and accounts belonging to former staff.
• Remote access weaknesses. Remote desktop and VPN connections that are exposed or poorly protected.
• Unpatched systems. Known vulnerabilities in software and devices that have not been updated.
• Vendor compromise. An attack on a software provider, billing company, or IT vendor that reaches its healthcare clients.
• Insider activity. Usually accidental, such as a misdirected email or a lost device, and sometimes intentional.

Safeguards that address common paths

No set of controls eliminates risk. But a short list of well-implemented safeguards addresses many common attack paths:

• Multi-factor authentication on email, remote access, and administrator accounts
• Prompt removal of access when staff leave, and periodic access reviews
• Regular, tested backups kept separate from the main network
• Timely patching of systems and devices
• Security awareness training that includes realistic phishing examples
• Vendor review and Business Associate Agreements for vendors with PHI access
• A written incident response plan that staff know how to use

HHS's 405(d) program publishes Health Industry Cybersecurity Practices, free guidance written for healthcare organizations of different sizes.

Security and compliance work together

The HIPAA Security Rule requires organizations to assess risks to electronic PHI and implement reasonable and appropriate safeguards. A risk analysis that reflects current threats, and a record of the safeguards implemented in response, serves both purposes: it reduces the chance of a successful attack and documents the organization's diligence if one occurs.

Technical controls are typically implemented by your IT or security provider. A compliance review checks that the right safeguards exist, that they are documented, and that responsibilities are clear between your organization and its vendors.