Mental health care providers are among the most targeted industries in the current cybercrime environment. Mental health providers manage some of the most highly sensitive information in the healthcare space, and as they continue to rely on electronic health record systems (EHRs) and other electronic documentation methods, many of them will continue to find themselves susceptible to significant cyber threats. One such example is Awakenings Counseling, where cybercriminals gained access to their EHRs, exposing patients' health information. This was a sobering reminder that even small lapses in an organization's cyber-security policies can have catastrophic consequences for the organization itself and its patients.
As digital transformation continues to advance quickly throughout the health care industry, the behavioral health field (typically comprised primarily of smaller independent practices) will soon experience the same level of cyber risk as most hospitals and large medical networks already have. However, most mental health practices have not developed sufficient maturity in their cyber-security practices to adequately address this new wave of risks.
Why Mental Health Data Is a High Value Target
Mental health provider data is very sensitive. In addition to the identifying information, counseling centers keep psychotherapy notes, diagnosis and treatment history, medication prescription records, and insurance information.
Cybercriminals are targeting this area of the health care industry because:
- Long Term Earnings Potential of PHI is Greater Than That of Credit Cards.
- Extortion Possibilities of Mental Health Records are Greater Because of the Nature of These Records.
- Many small practices do not have the same level of cybersecurity protections as larger health systems.
- A hack to even one account, an unpatched server, or an insecure connection with a vendor could provide access to the entire system.
The Increasing Complexity of Digital Technologies Creates a Higher Risk
The continued use of electronic health record (EHR) systems is an integral component of modern mental health care: however, EHR systems add to the overall attackable surface of mental health care. The majority of all counseling centers utilize:
- EHRs hosted in the cloud
- Patient intake portals
- Tele-therapy platforms
- Scheduling and billing systems
- Third-party vendors that perform documentation and claims processing
Each of these systems provides another possible pathway into your organization's systems. The majority of small and mid-sized mental health care organizations do not have an internal cybersecurity team and therefore have to rely upon their vendors to provide cybersecurity support, but unfortunately, the vendors are often the weakest link in the protection of your organization's systems.
2025 Will Likely Bring Changes to Cyber Standards
With the implementation of the new regulations and changes, regulators are starting to enforce stricter compliance around protecting PHI. In the behavioral health arena, we will likely see increased pressure on providers in several key areas related to protecting patient information.
1. Establishing Compliance through MFA
MFA is becoming a requirement for all organizations to access EHRs.
2. Vetting All Third-Party Suppliers
The organization needs to determine if all third-party vendors are meeting the same security requirements the organization has established.
3. Changes to the Enforcement of HIPAA
Federal enforcement agencies will continue to focus on: preventing breaches, timely detection of breaches, documenting the organization's response to a breach and having oversight of vendor access to patient records.
All organizations, regardless of size, will be required to comply with new federal enforcement standards, regardless of financial constraints.
4. Need for Enhanced Incident Detection
Every organization, large or small, needs access to security monitoring tools. Attacks are getting faster and more sophisticated, making manual monitoring ineffective on its own.To decrease the increasing risk of cyberattacks, mental health providers should address four critical areas in order to strengthen their security now.
- Encrypt all data stored and transmitted
- Have multi-factor authentication on all systems
- Restrict access based on staff job responsibility
- Have regular backups of data and keep a copy of that backup offline
- Do an annual review of your vendor’s security practices
- Train your staff to recognize phishing and social engineering attempts.
The steps listed above are no longer "best practices," but rather the minimum expectations of any provider dealing with PHI.
Why the Industry Needs to Move Faster!
Cybercriminals see Behavioral Health as a soft target that holds significant value. This means: Sensitive information is the primary component of most electronic health records and has little protection. A series of unlinked Healthcare Management Systems, and limited IT resources complete the "perfect storm" of vulnerability for cybercriminals.
The Awakenings Counseling Incident shows that smaller counseling offices are considered equal to larger healthcare providers for all Cybersecurity standards. Making your electronic records secure in 2025 pertains to compliance issues and trust between your clients and you as a qualified professional.
