Menu
An Imprivata Company in Health IT Security, Healthcare institutions are under attack, and the third-party vendors they operate with have become a common threat vector. HIPAA-covered entities must glance at identity and access security to navigate risk and avoid potential health data breaches.
A collaborative survey with the Ponemon Institute indicates that 55% of healthcare organizations encountered a cyberattack caused by one of their third-party sellers in the last 12 months. That’s an 11% boost from 2021, which was already a record-breaking year for cyberattacks and ransomware on hospitals.
The healthcare industry has also had the most elevated average data breach cost for twelve years. According to IBM’s Cost of a Data Breach Report, the intermediate cost of a cyberattack moved from $9.23 million to over $10 million in the last year alone.
While these statistics are alarming, healthcare organizations are hit with more than just a financial pressure when they experience a data breach. They also deal with its consequences on patients and their protected health information.
The importance of PHI
Protected health information (PHI) consists of an individual’s confidential and sensitive data—everything a lousy actor needs to commit identity rip-off and everything a hospital is trying to protect. It’s one of the most useful pieces of information a cybercriminal can get their hands on, treasured at up to $250 per record on the black market. Hence, it’s no wonder they go to great heights to compromise healthcare security.
Cybercriminals will employ a seemingly endless list of attack techniques to compromise hospital networks, but credential theft and third-party entrance are two of the most common and effective procedures.
Credential theft is commanding healthcare organizations.
Only 33% of healthcare institutions say they remove a third-party user’s credentials when applicable.
Credentials are the entryway to every door that leads to PHI. They’re the difference between an official and unauthorized digital identity—only verified and authorized digital individuals are awarded privileged credentials to mission-critical systems like EMR databases. So if an authorized user exits an organization and those credentials are left lingering in cyberspace, it’s “fair play” in the eyes of bad actors looking for this un-revoked password.
Once an evil actor gets a leaked, shared, or compromised password, there’s no containing what they could do with the information they access. Numerous hospitals have had to divert ambulances because their systems were down owing to a cyberattack. Mortality rates are rising as a result of hacks on healthcare networks. And patients are experiencing more complications from medical practices — all because of ransomware and cyberattacks. When credentials aren’t protected, alternated, and securely stored, it’s not just impacting digital identities — it’s impacting the identities and lives of patients.
Healthcare organizations aren’t barricading third-party vendor access
Hackers are positively effective at using third-party remote entrances to breach hospital networks. And our work with the Ponemon Institute indicates that healthcare organizations lack confidence in their power to root out these kinds of threats. Around two-thirds of respondents to our second annual survey don’t sense they are highly effective at mitigating them.
Healthcare IT teams aren’t carrying the proper precautions to secure the routes hackers take into their systems. Over half of organizations aren’t able to limit their third party’s access to just what they need to perform a job and frivolity more. Based on the principle of least privilege, this access management stops terrible actors in their paths if they breach a healthcare network.
Forty-nine percent of institutions also aren’t monitoring third-party access. In an assiduousness like healthcare, monitoring access is critical to safeguarding PHI. Patient privacy monitoring is one of the most effective techniques to ensure user access is authorized and appropriate. Access monitoring workflows notice anomalies, notify security and privacy teams of suspicious activity and analyze user behavior to detect and stop similar threats. Without these procedures, meaningful security gaps exist, just enough for hackers to manipulate.
How healthcare institutions can secure identities and third-party access
The problem is obvious: credentials and third-party access are the all-too-common strategies attackers use to attack healthcare facilities. The answer lies in locking down digital identities and consolidating user entrance.
Securing digital uniqueness
Nurses, physicians, and hospital staff are all trusted identities within a healthcare setting. But we are in an evolving digital terrain where no digital identity can be trusted. This introduces conflict within the healthcare IT domain when immediate and urgent access is needed, and there’s no time to establish and verify when a patient’s life could be on the line.
Instead of limiting hospital staff access, healthcare organizations can guarantee digital identities by automating the authentication protocol within healthcare procedures. Automated workflows like SSO, identity administration, and identity governance tools vet a digital identity at the beginning of their user lifecycle and, through authentication, confirm that this identity is the only identity bestowed privileged credentials and accessing PHI.
Securing third-party access
The destiny of access is consolidation, especially regarding managing internal and external user access. Healthcare institutions are often at the whim of granting network access via their vendors’ connectivity procedures.
The most effective way to involve access controls and keep track of your third-party users is by cramming the various connectivity methods by your vendors. Streamlining remote access permits healthcare teams to manage, restrict, and monitor all third-party user access from one complete platform.
