Medical Offices

Ransomware was by far the most popular attack method in 2020, making up 46% of the breaches. Ransomware is a malware that encrypts and locks your data making it inaccessible unless a ransom fee is paid to get it back. Success in extorting ransom payouts has made ransomware the top cybersecurity threat in the near future.  The University Hospital in New Jersey paid out $670,000 only to encourage further attacks. And while larger institutions can pay those ransoms, that does not mean they overlook smaller practices, which can be tempting targets of opportunity — particularly those with lax security. The dark web are run by these threat groups, and data from doctors’ offices show patient information, including photographs, health history forms and other private details. Avoid HIPAA Penalties and Fines resulting from:

• Compromised communications due to phished or compromised email accounts
• Inability to access medical data due to ransomware (i.e., where hackers encrypt files and demand money to restore access)
• Unauthorized disclosure of PHI – Resulting in Breach and Notification to the OCR
• Loss of public and patient trust – reputational damage
• Malpractice allegations and lawsuits
• HIPAA Regulatory Compliance Penalties and Fines

Hackers are opportunists and will often target the practice or facility with the lowest level of security. Instead of trying to spend weeks or months trying to get into a hospital, they can target smaller medical practices with weak cybersecurity in a couple hours.  It adds up too, if a hacker hits multiple smaller practices they can walk away with more money instead of trying to extort a large healthcare organization that will bring in the law enforcement and government agencies.