Details of The Story
As reported by Dark Reading, Ascension, a major healthcare provider operating 140 hospitals across 19 states, has suffered a significant cyberattack impacting several essential systems. The attack, disclosed on May 8, resulted in the shutdown of electronic health records (EHRs), the MyChart patient communication platform, and various systems related to medication and test ordering.
The first signs of the cyber incident were noted by employees on May 7, leading to an organization-wide system shutdown. Ascension has since temporarily halted non-emergency procedures and appointments, with some hospitals even diverting emergency services. Patients have been advised to bring any available medical documentation to their appointments due to the compromised systems.
In response to the crisis, Ascension issued a statement emphasizing their commitment to patient safety, utilizing established downtime protocols to continue providing care. “We are actively supporting our ministries as they continue to provide safe, patient care,” the statement read. It remains uncertain how long these emergency measures will be necessary.
This attack on Ascension follows a similar incident in February when United Healthcare’s Change Healthcare subsidiary suffered a ransomware attack, disrupting operations for several days. Such incidents continue to highlight the ongoing cybersecurity challenges facing the healthcare sector.
With data breaches costing healthcare organizations over $10 million on average (according to IBM’s latest report), the highest number of any industry, it is imperative that healthcare organizations take several proactive steps, three of which are outlined below.
Conducting thorough and frequent risk assessments and audits is essential to identify vulnerabilities within the IT infrastructure, including networks, devices, and software systems. By pinpointing these weaknesses, healthcare providers can prioritize security upgrades, implement necessary measures, and mitigate potential risks effectively. Adopting a Penetration Testing as a Service (PTaaS) solution can help organizations achieve this goal.
Continuous education and training for all staff are critical. Employees should be trained to recognize phishing attempts, understand the importance of secure password practices, and handle sensitive information securely. Keeping training up-to-date ensures that staff are aware of the latest cybersecurity threats and prevention techniques.
Strengthen security by implementing strict access controls and adhering to the principle of least privilege, ensuring that access to critical systems is limited to those who need it to perform their job functions. Additionally, maintain a rigorous patch management system to keep all software and systems up to date, thereby reducing the risk of unauthorized access and exploitation of known vulnerabilities.
Although they will not cover all of your bases, by focusing on these three strategic areas—regular risk assessments, continuous staff training, and strong access controls with updated software—healthcare providers can better protect patient data, safeguard critical healthcare services, and ensure overall patient well-being.
