4 Things You Need to Know About Health Care Cyberattacks

 he recent cyberattack on the billing and payment colossus Change Healthcare revealed just how serious the vulnerabilities are throughout the U.S. health care system, and alerted industry leaders and policymakers to the urgent need for better digital security.

Hospitals, health insurers, physician clinics and others in the industry have increasingly been the targets of significant hacks, culminating in the assault on Change, a unit of the giant UnitedHealth Group, on Feb. 21.

The ransomware attack on the nation’s largest clearinghouse, which handles a third of all patient records, had widespread effects. Fixes and workarounds have alleviated some distress, but providers are still unable to collect billions of dollars in payments. Many smaller hospitals and medical offices are still having trouble getting paid more than a month after Change was first forced to shut down many of its systems.

Even now, very little information about the exact nature and scope of the attack has been disclosed. UnitedHealth said that it had advanced more than $3 billion to struggling providers, and that it expected more of Change’s services to be available in the coming weeks as it brought the systems back online.


Cybersecurity consultants and government officials have consistently identified health care as the sector of the U.S. economy most susceptible to attacks, and as much a part of the nation’s critical infrastructure as energy and water.

“We should all be terrified,” said D.J. Patil, the head of technology at the insurance company Devoted Health and the former chief data scientist of the federal Office of Science and Technology Policy. He and others emphasized the inadequate protections in U.S. health systems, despite dramatic events such as the 2017 ransomware attack that locked up medical records at the National Health Service in Britain, leading to massive disruption for patients.

“The entire sector is severely under-resourced when it comes to cybersecurity and information security,” said Errol Weiss, chief security officer for the Health Information Sharing and Analysis Center, which he described as a virtual neighborhood watch for the industry.


Health care hacks can have deadly consequences.

Studies have shown that hospital mortality rises in the aftermath of an attack. Doctors are unable to look up past medical care, communicate notes to colleagues or check patient allergies, for example.


Medical records can command multiple times the amount of money that a stolen credit card does. And unlike a credit card, which can be quickly canceled, a person’s medical information cannot be changed.

Hospital networks and other health care groups have also been quick to pay ransoms to try to limit exposure for patients, a decision that only rewards and encourages hackers. The F.B.I. advises targets of ransomware attacks not to pay, but most hospitals do because the stakes are so high. In the case of Change Healthcare, the company is said to have paid a $22 million ransom, according to reporting by Wired.

Why aren’t hospitals and doctors doing more?

Despite the risk, smaller hospitals and doctors’ practices often don’t have the money to pay for enhanced security measures or the expertise to examine serious threats.

The regulatory framework is also old and fragmented. Hospitals are allowed to select among a range of security standards, and there is no advance auditing of compliance.

Digital security is divided among different offices within H.H.S., and much of the agency’s regulatory power still relies on a 1996 law, written before the development of modern digital health systems or the rise of ransomware hacking. The government’s regulatory focus has been on privacy and compliance rather than fortifying against attacks.

The regulation of insurer data security is even more spotty, since health insurers are largely regulated at the state level. Many vendors like Change, which provide digital services to hospitals but are not health care providers themselves, can also slip through regulatory cracks, Ms. Monson said.


https://www.nytimes.com/2024/03/29/health/cyber-attack-unitedhealth-hospital-patients.html