While their first thoughts might conjure images of a stolen credit card or hacked bank accounts, today hospitals and other healthcare organizations are some of the highest-value targets for cyber criminals. This is primarily due to the fact Hospitals Keep records of their patients that are both very specific and permanent. These records have significantly more value than a single credit card number when put into the black market. Medical and personal records are associated with a person for life, which increases the likelihood that cyber criminals will exploit this information to commit their crimes.
Public and private information for patients and families is kept by hospitals. The hospital's personal and financial information includes the following: Full Name, Home Address, Social Security Number, Date of Birth, Health Insurance, Billing Records, and Medical History. The price of a patient's file is usually several times the value of one stolen credit card if sold, and criminals often use these files for long-term identification theft, fraudulently billing, and even blackmail. Once the records are exposed, they will be forever exposed and cannot be reset, as seen in the data breach incident at St. Anthony Regional Hospital.
The way individuals and businesses use information that has been stolen from hospitals is to commit medical identity theft, which allows an individual who may be received medical treatment or prescriptions as a victim (through their own identity) and to make fraudulent claims to insurance and in large-scale Medicare fraud (billed by criminals) for operations and other services that never happened.
Individuals will typically use the information they can obtain through stolen medical information to create an open line of credit to the hospital or otherwise apply for loans or file a fraudulent tax return on behalf of patients whose medical records have been compromised.
Cybercriminals have increasingly been using more sophisticated extortion tactics by hijacking hospital data and threatening to release private medical information unless victims or the hospitals pay a sum.
As an example, if a physician relies on incorrect or altered medical information, it could result in a delayed or inadequate medical treatment for the patient, creating significant risk or the possibility of death for that patient.
Hospitals face constant attacks for two main reasons: They operate within time-sensitive settings (meaning if the hospital system goes down, it would put a patient in danger) and therefore at times feel pressured to meet ransomware demand.
Hospital systems are also generally using very old technology/legacy systems that are difficult to secure (and protect from hackers), across vast and complicated networks where there are many hospital staff and devices connected, as well as many third-party vendors that may also be exploiting those same vulnerabilities.
Lastly, hospitals often have the weakest cybersecurity resources (or budgets) compared to other areas of clinical relevance. Thus, there are often multiple exploitable vulnerabilities within hospital systems and infrastructure, which many criminals are eager to exploit.
Hospital data breaches can result in many complications that can last for many years for the patient affected. Patients could end up with unexpected bills, denied insurance claims, accounts opened fraudulently, and have their credit negatively impacted for a long time. The emotional fallout of a data breach that exposes a patient’s private medical information causes tremendous stress, fear, anxiety, and loss of trust in their health care provider. A compromised credit card can be replaced or cancelled; however, a person's medical history cannot be erased or replaced.
If you have received notification that your hospital has been the victim of a data breach, the first thing you should do is read the letter from the hospital carefully to find out what information has likely been accessed. You should monitor your bank and insurance records, as well as your medical bills, for any unusual activity. Many patients will also place a fraud alert or freeze their credit, in order to limit the chances of identity theft from the data breach. Retaining copies of the letter and any correspondence related to the breach is vital, as many times patients have legal rights and potential remedies for their losses, especially when the data breach occurred due to a breach in security protocols.
As long as patients' health records are traded on an underground market, hospitals will remain appealing targets for cybercriminals. By learning the reasons for these attacks and how criminals capitalize on stolen information, patients will be in a better position to protect themselves from the effects of the breach and understand their rights regarding the data breach. Following the breach of confidential information, the patient should consider two aspects: 1) The steps necessary to protect oneself from identity theft and fraud and 2) The legal rights available to them regarding any damage caused by the cyber attack.
