The report from the 10th annual Black Book Research State of the Healthcare Cybersecurity Industry goes on to reveal insights that have been received from 2,797 CISOs, CIOs, data security professionals, and patient data privacy professionals assessing user satisfaction with more than 400 software, service, and consulting firms. Apart from this, 1,959 healthcare consumers happened to be polled to supplement external perceptions as well as confidence in their providers’ and also payers’ efforts in order to protect consumer as well as organizational data.

Another Q3 2023 survey pertaining to hospitals and physician practices conducted by Black Book went on to caution that many cybersecurity solutions that were acquired before 2023 may now as well be outdated and hence would be ineffective when it comes to hacks and breaches that one may come across in 2024.

This indeed poses quite a threat to marginally performing providers, who may as well close down because of the financial strain as well as reputational damage caused by these incidents involving cybersecurity. Apart from this, the widespread use of remote access systems, dependence when it comes to third-party IT solution providers, and the growth in virtual patient consultations go on to create more susceptibilities, enabling cyberattacks to make inroads in healthcare technology platforms.

It is worth noting that in 2022, the average ransom payment happened to be under $6,000. But by 2023, there happened to be a whopping 25,000% surge, with average payments skyrocketing to almost $1.5 million. This astounding rise in profits enabled the ransomware groups to broaden their operations, pay the initial access brokers, and at the same time acquire zero-day vulnerabilities, hence enabling more attacks.

Consequently, healthcare cybersecurity vendors as well as the advisory market are all set to experience substantial growth, with providers as well as payer IT professionals planning strategic funding exceeding $140 billion by 2025. This growth happens to be driven by the rising cyberattacks that target health systems and payers throughout the first two quarters of 2024.

Notably, the ransomware attacks on U.S. healthcare providers went on to hit a staggering $28.2 billion in terms of costs in 2022, whereas the security breaches alone went ahead and incurred a massive $7.3 trillion for healthcare companies by the end of Q3 2023.

2023 saw a prominent surge in ransomware attacks that targeted the healthcare sector. 46 hospital systems went on to be victims of such attacks, which was a prominent increase from 25 in 2022 and 27 a year before that.

These attacks directly went on to affect a minimum of 141 hospitals, thereby leading to disruptions because of patient unavailability as well as IT systems.

Apparently, the average cost of healthcare data breaches went on to touch an all-time high in 2023; the average expenditure came to $11 million, which marked a rise of 53% ever since 2020. Notably, 33 out of 46 attacks on the health system resulted in sensitive data theft, which included health information.

Apparently, the documented data breaches within medical practices as well as physician groups grew 72% from 2019 to 2022, with hospitals as well as health systems experiencing a 59% surge over the same period. Apart from this, 82% of IT managers went on to report numerous ransomware hits on their organizations, and that too in 2023 alone.

There has been a loss of $872 million due to the 2024 ransomware attack on Change Healthcare, which happens to be owned by UnitedHealth Group. Change Healthcare, along with UHG subsidiary Optum, went ahead and took hundreds of providers offline because of the incident. They even went on to face criticism from the White House as well as Congress when it came to handling the ransomware attack.

The Black Book study states that healthcare breaches go on to cost an average of $697 per record, thereby cutting the highest ever figure across the sectors for a decade. This amount happens to be over four times the cross-sector average, hence highlighting the significance of cyber data security when it comes to providers as well as payer sectors.

As per the President of Black Book Research, Doug Brown, the consequences of the recent ransom attack on the nation’s largest clearinghouse vendor happen to go beyond just disrupting the part of claims processing; it disrupts the important processes that are essential for maintaining patient care. Such kinds of tangible effects on human health highlight the urgent need when it comes to complete cybersecurity steps throughout the entire gamut of healthcare.

In another survey pertaining to healthcare consumers, 91% went on to express a feeling of heightened anxiety with regards to external entities’ probable misuse of health information.

Current security risks have also led to 79% of consumers feeling a bit of reluctance to share health data electronically because of privacy concerns. The fact is that the confidence of consumers in medical organizations’ compliance with HIPAA guidelines as well as data privacy happens to be very low, with just 8% having a high level of confidence.

Moreover, 97% of healthcare consumers go on to harbor certain levels of skepticism about the efficacy of current government regulations when it comes to safeguarding health data. 22% of consumers would look into switching to a provider for data privacy protection if in case they were able to compare or verify their respective data protection technologies.

It is estimated that 90% of the chief information security officers- CISOs go on to believe that software and service vendors happen to fail to adequately address cybersecurity processes, hence hindering user improvement for healthcare sector clients.

There happen to be 86% of IT professionals within health plans who agree with the sentiment that data attackers happen to be outpacing organizations, hence holding payers to a continued disadvantage when it comes to responding to vulnerabilities all across 2024.

As per the president of Black Book™, Doug Brown, most of the health systems CISOs and CIOs happen to be compelled to embrace the next-gen cybersecurity tools as well as solutions so as to safeguard the data of the organizations and also maintain their financial viability.

The sector faces a rising threat spectrum, such as ransomware, malware, breached records, concerns over patient privacy, phishing attacks, and cyber threats, specifically due to the rising adoption when it comes to telehealth, remote patient monitoring, etc.

Sensitive data gets compromised quite significantly when there happens to be a ransomware attack on healthcare organizations as compared to other sectors, as per an April 30 report released by Rubrik Zero Labs, one of the research arms of a cybersecurity firm.

Additionally, email archiving is crucial for safeguarding sensitive information and ensuring compliance with data protection regulations. To keep emails safe, it is essential to implement strong encryption protocols, regularly update security measures, use multi-factor authentication, and conduct regular security training for staff to recognize phishing attempts and other cyber threats.

20% of a typical healthcare firm’s sensitive data holdings get impacted, which means that the files are encrypted, deleted, or even taken away in the event that a ransomware encryption event is successful. An average company’s sensitive data gets impacted by just 6%.

Notably, healthcare companies happen to hold an outsized amount of sensitive data as compared to other sectors, averaging around 42 million sensitive data records as compared to a global average of 28 million records. The gap between sectors is indeed anticipated to grow as healthcare organizations go on to accumulate sensitive data more rapidly.

The fact of the matter is that cyberattacks happen to be quite a serious threat to healthcare operations, and there is no shred of doubt that they have gone on to become very common over the last 5 years.

Ransomware, which happens to be a kind of malware, goes on to deny users access to the data until the ransom gets paid, and it can very well have some drastic impacts when it comes to hospitals- in a way potentially cutting-off access to some prominent tools such as electronic health records- EHRs and pushing them to shift patients to other facilities.

The healthcare sector happens to be still recovering from the UnitedHealth-owned technology vendor Change Healthcare attack that took place in February 2024. This cyberattack went on to affect major tasks like billing, prior authorization requests, eligibility checks, and prescription fulfillment, to name a few.

The company opted to pay the ransom; however, a large amount of patient data may as well have been compromised. Because of a targeted sampling of the impacted data, UnitedHeath went on to find files with protected health information that could go on to cover a sizeable population in America.

All this has led regulators and lawmakers to take notice pertaining to cybersecurity risks. In early 2024, the HHS went on to release voluntary cybersecurity goals for the industry, with plans looking for enforceable benchmarks.

The budget proposal laid down by the Biden Administration for 2025 happens to have funds in it so as to boost hospital protection with penalties in case the providers do not adopt benchmarks.

The witnesses at a house subcommittee hearing pertaining to Change Cyberattack went on to argue that the funding might not be enough to shore up the defenses of the hospitals, specifically in the case of small and rural providers that are very vulnerable.

The Federal Trade Commission has gone on to solidify the data breach reporting needs on healthcare applications in the April 26, 2024 rule with the objective of stopping firms from trafficking medical information that’s potentially sensitive.

It is worth noting that the Health Breach Notification Rule requires companies to have personal health information so as to notify regulators, consumers, as well as in certain cases, the media too when the data gets breached, which enables the regulators to find bad actors.

The fresh final rule goes on to clarify that it happens to apply to health applications and also expands the information that went on to cover entities requirements to disclose in case of a breach.

The FTC first went over to warn the health apps that the HBNR went on to apply to them in a 2021 policy statement right before proposing a rule in 2023 spring which stated its case directly.

The FTC, apparently, is looking forward to keeping pace with the evolving health data use when it comes to updating the HBNR, which was first issued in 2009 and, in fact, has rarely been used pertaining to breaches so as to penalize the companies. But apps as well as other direct-to-consumer wearables such as fitness trackers have gone on to become much more popular, all thanks to COVID-19, which went on to push the adoption of new health tech. These applications commonly go on to make use of consumers’ data in terms of marketing as well as other purposes that users aren’t aware of and that are outside the HIPAA privacy law purview.

The final rule goes on to revise the existing definitions within the HBNR. However, highlighting the rule’s applicability to health apps can very well have greater ramifications for the sector since the FTC has been looking forward to having more enforcement actions relying on the HBNR.

In 2023, the FTC went on to notch its very first settlement under HBNR, thereby forcing drug discount provider GoodRx to shell out a $1.5 million civil penalty post finding that it disclosed consumer data to third party marketers such as Facebook and Google. In May, same year, the FTC went on to settle with Easy Healthcare with regards to similar concerns, and a fine of $100,000 was paid.

The comparatively lower fine amounts along with settlements suggest that the FTC has not been quite certain when it comes to its ability as far as enforcing its new interpretation of the HBNR in court is concerned, say experts.

This final rule is likely to bolster the enforcement position, and can as well lead to much larger civil penalties in the future.

The rule also goes on to clarify the definition of personally identifiable health data, which, when breached, goes on to trigger the HBNR’s reporting needs. This includes traditional health information such as diagnoses as well as medications, data acquired from interacting with applications, and also a category named emergent health data.

It is well to be noted that the emergent health data has in it purchase records that are related to healthcare as well as location data, which can be made use of to get results on a person’s medical history.

Location data happens to be a specific focus for regulators due to the Supreme Court’s decision, which overturned the constitutional right pertaining to abortion in 2022.

The Biden administration has been looking for novel ways to make use of the existing tools, such as HIPAA and HBNR, to stop data sharing over issues that the data can as well be made use of prosecute individuals who happen to receive, perform, or even help facilitate abortion.

The FTC, in a recent move, has taken certain steps against the data brokers, stopping them from leaking location info that can very well be made use of to track consumers medical clinic visits. The final rule also goes on to broaden what the companies have to tell consumers in a scenario of a data breach, such as what the third parties who have acquired personal information. It also helps companies to inform consumers with regards to an email breach or other electronic modes, and to set a deadline so as to report breaches that are large.

It is well to be noted that the FTC went on to vote 3-2 to go ahead and publish the rule in the Federal Register. Dissenting the majority, Commissioners Melissa Holyoak and Andrew Ferguson went on to argue that the rule goes on to exceed FTC authority and happens to put companies at risk in terms of perpetual non-compliance.

One of the researchers from the Rubrik Zero Labs research unit happened to find out that the average healthcare organization has more than 42 million sensitive data records, which is 50% over the global average of 28 million.

Taking in to account this figure, Rubrik went on to conclude that ransomware attacks against the healthcare organizations can have significant negative adverse effect in terms of operations, data security, and integrity.

Rubrik went on to base its findings on its own data, which was spread across 6,100 customer organizations, along with survey findings coming from Wakefield Research and data from numerous partner research organizations.

At any typical healthcare organization observed by Rubrik, 16.8 million files get impacted by every encryption event, and 8.4 million sensitive data files happen to be within the impacted files.

Researchers also went on to observe that healthcare organizations make utmost use of virtualized architecture at higher rates than organizations from other industries. It is worth noting that almost 97% of healthcare encrypted data happens to be within a virtualized architecture, as compared to 83% throughout all the industries analyzed in the report.

The point of concern here is that the effect of it on businesses as well as employees can go on to linger even when organizations come out of the cyberattack. Due to this, organizations have gone on to report dip in shareholder value; there have been mental health impacts, all of which have led to customer loss as well.

There are many organizations that have gone on to hire additional staff as well and, at the same time, have increased spending on new services after a successful recovery. The report underscored the fact that risk cannot be eliminated, but the risk cycle can be influenced and affect the new risk baseline, thereby highlighting the significance of learning from ransomware attacks and making sure to apply it to risk reduction activities in the future.

April 30, 2024, is going to be regarded as historic as the Medicines and Healthcare Products Regulatory Agency- MHRA has decided to roll out a strategic approach to AI.

Welcoming ‘A pro-innovation approach to AI regulation’, a government white paper that was published in 2023, the MHRA has taken worthy steps over the past 12 months in terms of adoption when it comes to recommendations in the work on the basis of 5 major strategic principles such as security, safety, and robustness; fairness; accountability; and governance; right transparency and explainability; as well as contestability and redress.

It is well to be noted that the MHRA was asked to give a strategic and independent view when it came to the agency’s approach to artificial intelligence as far as the field of medicine and science is concerned and the right steps that the organization is taking or intending to take that are in sync with the anticipations that are jotted within the white paper.

The MHRA, being a science-led organization, happens to have a prominent role to play when it comes to achieving the objective for the UK so as to be a superpower in science and Tech by the end of this decade. The agency is taking into account perspectives as a regulator of AI products, as a public service organization that delivers time critical decisions and as an organisation which happens to make decision based on evidence that go on to impact public-patient safety, and in which the evidence often gets supplied by the third party. All this happens to be from the viewpoint of considering the challenges and opportunities of AI.

According to the Chief Quality and Access Officer at the MHRA, Dr. Laura Squire, AI goes on to offer opportunities so as to enhance the efficiency that the MHRA offers throughout all the regulatory functions coming from regulatory science by way of enabling safe access to medicines and medical devices in order to post-market enforcement as well as surveillance.

She adds that while making the most of this opportunity, they must also take into perspective the risk proportionate regulation of AI as a medical device—AIaMD that takes into account  the risks these products have sans stifling the potential they happen to have so as to transform healthcare.

Growingly, they indeed expect AI to feature in how those that they regulate undertake their activities and go on to generate evidence, and hence they need to ensure they have an understanding of the impact in order to continue to regulate in an effective way.

Artificial intelligence happens to be already transforming the way healthcare is being delivered, by way of cutting waiting lists for patients and freeing up time for NHS staff, said Health and Social Care Secretary Victoria Atkins.

She would want to see AI and technology harnessed as part of their plan for a much faster, simpler, and definitely fairer healthcare system. The government announced a £3.4 billion investment on latest technology for the NHS in the budget so as to aid doctors and nurses to stress on patients and not admin.

Atkins added that she is pleased that MHRA has set out such principles, which will go on to help make sure that AI is consistently being used in a safe, secure, and also very transparent way throughout the health service.

Improved efficiencies will go on to result in UK patients getting benefitted from enabling safe access as far as medical products are concerned, and that too earlier than may have been possible in the past, while at the same time the MHRA will go on to have a much wider scope to focus specialist expertise on priorities like innovation and patient engagement.

Apart from this, there is a basic need for regulatory decisions to be based on robust evidence, as the MHRA process in terms of considering submissions, inspection of premises, and examination of the data is dependent on it, and as regulators, they go on to expect such processes and protocols to transition in line with innovative AI.

The MHRA is at present, in the process of executing its own set of regulatory reform programme that are related to AI-driven medical devices so as to have in it risk proportionate regulation when it comes to AI as a medical device- AIaMD.

AI is most likely, in the years to come, going to be integral to making sure of effective product regulation as well as patient safety, and hence measuring and gauging its effect is mandatory for the MHRA to be a regulator that’s regarded as innovative and effective.