Start Your FREE Membership NOW
 Discover Proven Ways to Be a Better Medical Office Manager
 Get Our Daily eNewsletter, MOMAlert, and MUCH MORE
 Absolutely NO Risk or Obligation on Your Part -- It's FREE!

Upgrade to Premium Membership NOW for Just $90!
Get 3 Months of Full Premium Membership Access
Includes Our Monthly Newsletter, Office Toolbox, Policy Center, and Archives
Plus, You Get FREE Webinars, and MUCH MORE!

New healthcare cybersecurity report exposes risk of attacks through social engineering

SecurityScorecard, a security rating and continuous risk monitoring platform, recently released its 2016 Healthcare Industry Cybersecurity Report. This comprehensive analysis exposed alarming cybersecurity vulnerabilities across 700 healthcare organizations including medical treatment facilities, health insurance agencies, and healthcare manufacturing companies. Security breaches in this industry pose devastating consequences because they can render an entire system or network inoperable, creating a life or death situation that needs immediate attention.

Employees and IoT devices compromising data security

The Verizon Data Breach Report ranks Social Engineering as the third most common cause for breaches, a number that is rising at the same rate as Hacking and Malware. Among all industries, Healthcare ranks 15th out of 18 in Social Engineering, suggesting a security awareness problem among healthcare professionals, putting millions of patients at risk.

“The low Social Engineering scores among a multitude of healthcare organizations show that security awareness and employee training are likely not sufficient,” said Alex Heid, Chief Research Officer at SecurityScorecard. “Security is only as strong as the weakest link, and employees are often the lowest-hanging fruit when it comes to phishing, spear phishing, and other Social Engineering attacks. For a hacker, it only takes one piece of information such as learning the email structure of an organization to exploit an employee into divulging sensitive information or providing an access point into that organization’s network.”

Another risk is the array of devices with wireless capabilities such as Internet of Things (IoT) devices, wireless medical devices and tablets, which have paved the way for medical advances benefiting hospitals and patients. However, their speedy delivery and implementation has resulted in subpar security setups.

“As long as these IoT devices are manufactured with poor security standards, the vulnerability doesn’t only lie within the devices themselves, but they also pose a risk to any hospital, treatment center, or individual using the device. If a connected device is hacked into, the device can be forced to malfunction or it can be used as a pathway to reach an organization’s primary network,” continued Mr. Heid.

Key findings

Among the report’s key findings are:

  • Over 75% of the entire healthcare industry has been infected with malware over the last year
  • 96% of all ransomware targeted medical treatment centers
  • Healthcare manufacturing nearly reaches a 90% malware infection rate
  • 63% of the 27 Biggest US Hospitals have a C or lower in Patching Cadence, which measures an organization’s ability to implement security software patches in a timely fashion
  • Healthcare has the 5th highest count of ransomware among all industries
  • Over 50% of the healthcare industry has a Network Security score of a C or lower
  • Past-breached healthcare companies still have 242% as many low scores in Social Engineering compared to non-breached companies

Ransomware and breaches are affecting the healthcare industry at an increasingly alarming rate with 22 major public breaches occurring since August 2015. Earlier this year, Hollywood Presbyterian Medical Center paid $17,000 as a result of ransomware after losing access to patient records for 10 days. In March 2016, 21st Century Oncology struggling with DNS Health, Network Security and Patching Cadence suffered a data breach that led to a loss of 2.2M patient records and a $57M class-action lawsuit. Overall, breached healthcare companies still struggle with security post-breach, according to the report.


The 2016 Healthcare Industry Cybersecurity Report identifies other major healthcare data breaches between August 2015 and August 2016. The conclusions and rankings featured in the report are based on data derived from SecurityScorecard’s patented security rating platform. For more information about these findings, download the full report.

Editor’s picks:

Improper data removal and poor enforcement of data retention policies create the ‘perfect storm’ for data breaches

Are you still complacent about mobile security risks?

Cybersecurity and social media top compliance concerns









Try Premium Membership