University Presentation: Cyber Risk Management in Healthcare

This presentation addresses the critical topic of cyber risk management within the healthcare industry, focusing on the protection of sensitive patient data and organizational security. It highlights the pervasive threats, including data breaches, malware, and ransomware, that healthcare organizations face. The presentation emphasizes the rationale for implementing robust cyber risk management strategies, citing the importance of patient privacy, compliance with regulations, and the need to maintain stakeholder trust. It explores implementation strategies such as the Health Information Trust Alliance (HITRUST) Common Security Framework, outlining key steps and requirements. The presentation also acknowledges the challenges of the ever-evolving cyber landscape and suggests solutions such as regular updates, security checks, and ethical hacking. Finally, it proposes evaluation methods to assess the effectiveness of the implemented strategies, including inventory management, framework robustness, and cost-efficiency. The presentation is supported by references to credible sources, providing a comprehensive overview of cyber risk management in healthcare.

EDUCATIONAL PROGRAM: CYBER RISK MANAGEMENT IN HEALTHCARE
Name of the Student
Name of the University
Author note

Introduction.
• There are a wide range of issues that the current healthcare domains face
when it comes to managing risks in an organization.
• Risks in an organization can entail a variety of examples.
• This presentation deals with the aspect of cyber risk management in the
healthcare industry.
• The importance of cyber risk management in the healthcare industry is
associated with the vast amount and types of data and information that is
gathered in the computers and systems.
• These information can range from patient’s details to healthcare logs and
even information regarding contagious diseases and the organization’s past
involvements with other patients.

• Risk in the domain of cybersecurity allows for breaches in the system
by virtue of which, hackers and other similar entities can either gain
access to the system or corrupt the system.
• As a result, the organisation is left to face a wide range of problems
with respect to data privacy and occupational security.
• This also jeopardizes the stakeholder – organization relationship and
causes a range of issues for the organization to deal with.

Rationale.
• Hospitals and other healthcare organizations have been experiencing
both targeted and the untargeted attacks repeatedly (Shackelford, 2014).
• Patients’ information has been tampered with by accessing the
information system of the hospital in various ways.
• Hackers and cyber terrorists are able to manipulate the source code of a
particular program to install virus, malware, ransomware and other
similar types of detrimental programs in the organization’s software.
• This has led to a serious cause for concern when it comes to sensitive
information.

Rationale.
The following are the domains where the threat becomes significant to
consider:
• Patients’ privacy.
• Hospital’s patient records and healthcare records.
• Ongoing treatment details.
• Ongoing research and studies of any potentially lethal pathogen.
• Information regarding Doctors and Nurses, Scientists and researchers
etc.

Rationale.
• Implementation of cyber risk management strategies in healthcare
organizations shall minimize cyber-attacks
• It can also put on the necessary precautions that makes it hard for the
cyber attackers to access any hospital’s information.
• This shall ensure the patient’s privacy and promote patient’s rights of
quality care as it is in the health compliance standards of the local,
federal and state government.
• It also ensures compliance with the standards for general safety and
effectiveness imposed by the FDA

Support.
• Recent reports indicate that attacks from cyber criminals lead to 41%
of data breaches in hospitals in 2019.
• One third of the breaches experienced were related to malware
attacks, and the other percentage (31%) led to accidental exposure.
• Pozgar (2012) explains that it is the legal responsibility of hospitals to
protect patient data that lead to safety in the place of work.
• Quality services in healthcare industry is a professional obligation.

Implementation Strategy.
• Health Information Trust Alliance (HITRUST) Common Security
Framework.
• Based on a management of security information in healthcare using
the right guidelines and standards.
• Enhance risk management for all the Information networks used to
incorporate medical services in hospitals.
• Also requires the presence of skilled and qualified IT staff within the
administration of the healthcare system.

Implementation strategy.
• The HITRUST Common Security Framework has outlined its
applicability in a wide range of healthcare organizations.
• Besides that, the framework is also compliant with the ISO / IEC
frameworks (hitrustalliance.net)
• The CSF also includes a wide range of categories for risk management.
• Following the steps that the CSF identifies, a healthcare organization
can successfully implement the framework within their systems to
provide a wide array of benefits.

Implementation Strategy
The following steps are identified by the Common Security Framework
as preliminary requirements for an effective implementation.
• Support and commitment of management.
• Partition of the organization into auditable units of business.
• Application of the Common Security Framework to the aspect of
Protected Health Information (PHI).
• Application of the Common Security Framework to all aspects of
information systems.
• Good understanding of information security requirements.

Challenges.
• One primary challenge.
• The ever evolving cyber technology domain which makes it prudent
for constant upgrades and updates.

Challenges – overcoming them
• Regular updates.
• Security checks and scans.
• Hiring ethical hackers for testing.
• Alternate Beta Testing and feedback reports.
• Alternate backdoor information security systems.