Cyber Risk Management in Healthcare

EDUCATIONAL PROGRAM: CYBER RISK MANAGEMENT IN HEALTHCARE
Name of the Student
Name of the University
Author note

Introduction.
• There are a wide range of issues that the current healthcare domains face
when it comes to managing risks in an organization.
• Risks in an organization can entail a variety of examples.
• This presentation deals with the aspect of cyber risk management in the
healthcare industry.
• The importance of cyber risk management in the healthcare industry is
associated with the vast amount and types of data and information that is
gathered in the computers and systems.
• These information can range from patient’s details to healthcare logs and
even information regarding contagious diseases and the organization’s past
involvements with other patients.

• Risk in the domain of cybersecurity allows for breaches in the system
by virtue of which, hackers and other similar entities can either gain
access to the system or corrupt the system.
• As a result, the organisation is left to face a wide range of problems
with respect to data privacy and occupational security.
• This also jeopardizes the stakeholder – organization relationship and
causes a range of issues for the organization to deal with.

Rationale.
• Hospitals and other healthcare organizations have been experiencing
both targeted and the untargeted attacks repeatedly (Shackelford, 2014).
• Patients’ information has been tampered with by accessing the
information system of the hospital in various ways.
• Hackers and cyber terrorists are able to manipulate the source code of a
particular program to install virus, malware, ransomware and other
similar types of detrimental programs in the organization’s software.
• This has led to a serious cause for concern when it comes to sensitive
information.

Rationale.
The following are the domains where the threat becomes significant to
consider:
• Patients’ privacy.
• Hospital’s patient records and healthcare records.
• Ongoing treatment details.
• Ongoing research and studies of any potentially lethal pathogen.
• Information regarding Doctors and Nurses, Scientists and researchers
etc.

Rationale.
• Implementation of cyber risk management strategies in healthcare
organizations shall minimize cyber-attacks
• It can also put on the necessary precautions that makes it hard for the
cyber attackers to access any hospital’s information.
• This shall ensure the patient’s privacy and promote patient’s rights of
quality care as it is in the health compliance standards of the local,
federal and state government.
• It also ensures compliance with the standards for general safety and
effectiveness imposed by the FDA

Support.
• Recent reports indicate that attacks from cyber criminals lead to 41%
of data breaches in hospitals in 2019.
• One third of the breaches experienced were related to malware
attacks, and the other percentage (31%) led to accidental exposure.
• Pozgar (2012) explains that it is the legal responsibility of hospitals to
protect patient data that lead to safety in the place of work.
• Quality services in healthcare industry is a professional obligation.

Implementation Strategy.
• Health Information Trust Alliance (HITRUST) Common Security
Framework.
• Based on a management of security information in healthcare using
the right guidelines and standards.
• Enhance risk management for all the Information networks used to
incorporate medical services in hospitals.
• Also requires the presence of skilled and qualified IT staff within the
administration of the healthcare system.

Implementation strategy.
• The HITRUST Common Security Framework has outlined its
applicability in a wide range of healthcare organizations.
• Besides that, the framework is also compliant with the ISO / IEC
frameworks (hitrustalliance.net)
• The CSF also includes a wide range of categories for risk management.
• Following the steps that the CSF identifies, a healthcare organization
can successfully implement the framework within their systems to
provide a wide array of benefits.

Implementation Strategy
The following steps are identified by the Common Security Framework
as preliminary requirements for an effective implementation.
• Support and commitment of management.
• Partition of the organization into auditable units of business.
• Application of the Common Security Framework to the aspect of
Protected Health Information (PHI).
• Application of the Common Security Framework to all aspects of
information systems.
• Good understanding of information security requirements.

Challenges.
• One primary challenge.
• The ever evolving cyber technology domain which makes it prudent
for constant upgrades and updates.

Challenges – overcoming them
• Regular updates.
• Security checks and scans.
• Hiring ethical hackers for testing.
• Alternate Beta Testing and feedback reports.
• Alternate backdoor information security systems.

Evaluation.
Evaluating this program can be done through identifying how successful
it has been in terms of protecting the organization’s privacy and data.
The following steps can ensure that the successful implementation can
be evaluated:
• Successful inventory management
• Tough to crack framework
• Protected information
• Reduction in cost and high operational efficiency (long term results)

Opportunity.
• Emerging technology.
• Efficient installation.
• Opportunity for knowledge enhancement.
• Constant monitoring and upgradation.

References.
Diogenes, Y., & Ozkaya, E. (2018). Cybersecurity - Attack and Defense Strategies: Infrastructure
Security with Red Team and Blue Team Tactics. MA.
Hitrustalliance.net. (2014). Introduction to the HITRUST Common Security Framework. Retrieved
From:
https://hitrustalliance.net/content/uploads/2014/05/HITRUSTCSF-2014-v6_0-Executive-Sum
mary-and-Introduction-FINAL.pdf
Hospitals face rising risk of sophisticated cyberattacks. (2020). Retrieved from
https://www.healthcarefinancenews.com/news/hospitals-face-rising-risk-sophisticated-cyber
attacks
Patrick, R. (2018). Data Science For Cyber-security. Toh Tuck Link, MA: World Scientific.
Pozgar, G. D. (2012). Legal and Ethical Issues for Health Professionals. Burlington, MA: Jones &
Bartlett Publishers
Shackelford, S. J. (2014). Managing Cyber Attacks in International Law, Business, and Relations: In
Search of Cyber Peace. Cambridge, NJ: Cambridge University Press.