This year will see one of the highest percentages of US hospitals in bankruptcy or near bankruptcy, further aggravating financial constraints the health sector has long faced and widening the gap between “cyber -haves and have-nots,” said Christian Dameff, a physician at the university. of California San Diego, during the 2022 HIMSS Cybersecurity Forum on Monday.
“It is likely that we represent the 1%, those who have cybernetics,” Dameff opened. The event dives into the nuances of advanced technology and cybersecurity programs focused on improving cyber resilience. But “who is not in this room?”
How many hospitals or providers don’t make their voices heard about their specific struggles and issues with industry leaders who can help them?
Dameff led the discussion on the risk posed by resource and knowledge gaps and possible solutions, along with M. Eric Johnson, dean of the Owen Graduate School of Management at Vanderbilt University, Anahi Santiago, CISO of ChristianaCare , and Costis Toregas, director of The George Research Institute for Privacy and Cyber Security at the University of Washington.
Perhaps the biggest divide for the have-nots is cyber insurance coverage, or the lack thereof.
While all industries face concerns about rising costs of cyber insurance premiums and the potential loss of coverage, healthcare arguably faces one of the biggest uphill challenges. According to Santiago, the increase in premium costs in the health industry is around 103%, on average, “unlike the other industries where the average was a little below 40%.”
ChristianaCare, in the top 1% of those with cyber, went through the renewal process earlier this year. The changes in the process and costs are drastic.
“I’ve been in healthcare cybersecurity for the last 18 years and have seen the questionnaire grow from one page to three pages, plus supplemental, plus several phone calls in the span of three months,” as well as coordinating with the relevant team . members to align with the security measures in place,” she explained.
“Based on a very healthy budget, we were able to check every box and keep our premiums up just 46% compared to 103%,” added Santiago. The reality is, “Based on what’s being asked of us, I know there’s absolutely no way that 99% of other healthcare organizations can afford the investments that are being asked of us.”
As SC Media previously reported, the seismic shift in cyber insurance has resulted in increased scrutiny during the application process. It is clear that this untenable situation will affect the vast majority of healthcare providers who cannot afford the investments in the technologies required to obtain coverage, or the premiums they will face if they cannot afford to implement the necessary technology.
At the same time, these are the organizations with “the greatest risk of suffering a breach,” Santiago explained. If they are exploited, “they probably won’t be able to recover financially from those breaches, so they may have to file for bankruptcy or go out of business.”
Many of these “organizations are probably in critical access areas or in underserved communities where access to healthcare is very important,” he added. The sector may experience a lack of healthcare services for patients due to this evolving financial crisis.
For Toregas, “a second strategy at the local level for the small ones and the 99% is self-insurance.”
These entities can pool risk by creating self-insurance pools to “really find a way forward. It does not relieve the responsibility that the insurers” place on the entities, but the leaders must begin to take action, “because otherwise I see no way out, except a disaster on my hands.”
A call for greater transparency in cyber incidents
The lack of data and a willingness to provide transparency into incidents is only making the chasm worse and increasing cyber insurance premiums and coverage requirements in the process “because we don’t have the data to make sound actuarial decisions,” Toregas said.
Healthcare entities are notoriously quiet after a cyber incident or data breach, with well-crafted notifications omitting fine details that could benefit others in the industry. Compared to the post-mortem of the cyberattack shared by the Irish Health Service Executive with step-by-step details on their mistakes and the attackers’ entry points, it’s easy to see why this information would be critical to successfully mounting an effective defense. .
“The healthcare industry has to start reaching out to people who care about insurance,” Toregas said.
In particular, the have-nots are not just smaller organizations, which may actually have a strong case due to their limited attack surface. Johnson noted that “the weakest link in our own investigation right now is some of the midsize hospitals.”
“They are big enough to go unnoticed and have a big enough brand and attack surface to be interesting to attackers,” he added. “But they often don’t have the resources of the really big players and are in some ways the poorest in terms of cyber risk.”
However, it is very difficult to find good data, data that can help inform these important discussions and support congressional efforts to give the sector much-needed support, Toregas explained. Mandatory reporting at the federal level that will take effect in a few years may help change the current state of communication.
For now, gaps in transparency and threat sharing are affecting the industry’s response.
The good news is that there are a plethora of resources available. The unfortunate news is that some of the small or medium-sized organizations are not aware of it, even though they need it the most.
As an example, the Health Coordinating Council’s cybersecurity working group created a series of different test scores focused on providing resources to support health entities “so they don’t have to start from scratch,” Santiago explained.
“I think what’s important is that we find ways to communicate this, to socialize these things that are readily available to healthcare systems across the industry,” he added.