Hospital systems expenditure on protections as part of IT budgets increased 6% year-to-year but physician organization cybersecurity spend has decreased since 2018, and 92% lack full-time security staff.
Black Book Market Research LLC surveyed over 2,876 security professionals from 733 provider organizations to identify gaps, vulnerabilities and deficiencies that persist in keeping hospitals and physicians proverbial sitting ducks for data breaches and cyberattacks. 96% of IT professionals agreed with the sentiments that data attackers are outpacing their medical enterprises, holding providers at a disadvantage in responding to vulnerabilities.
A fragmented mix of 415 vendors offering data security services, core products and solutions, software, consulting and outsourcing received user feedback including large IT companies, mid and small security vendors and start-ups in the polling period Q4 2018 to Q3 2019.
Thus far in 2019, healthcare providers continued to be the most targeted organizations for industry cybersecurity breaches with nearly 4 out of 5 breaches, whereas successful attacks on health insurers and plans maintained with more sophisticated information security solutions with little change year to year. Over half (53%) of all provider breaches were caused by external hacking according to respondents.
Over 93% of healthcare organizations have experienced a data breach since Q3 2016 and 57% have had more than five data breaches during the same timeframe. Not only has the number of attacks increased; more than 300 million records have been stolen since 2015, affecting about one in every 10 healthcare consumers.
The dramatic rise in successful attacks by both criminal and nation-state-backed hackers illustrates how attractive and vulnerable these healthcare enterprises are to exploitation. Despite these wake-up calls, the provider sector remains exceedingly susceptible to ongoing breaches.
Budget constraints have encumbered the practice of replacing legacy software and devices, leaving enterprises more susceptible to attacks. “It is becoming increasingly difficult for hospitals to find the dollars to invest in an area that does not produce revenue,” said Doug Brown, founder of Black Book. According to 90% of hospital representatives surveyed, IT security budgets have remained level since 2016. As a percentage of IT health systems and hospital organizational budgets, cybersecurity has increased to about 6% of the total annual IT spend for CY 2020, however, physician organizations and groups report a decrease in actual cybersecurity expense allocated, with less than 1% of their IT budgets earmarked for cybersecurity in 2020.
A third of hospital executives that purchased cybersecurity solutions between 2016 and 2018 report they did so blindly without much vision or discernment. 92% of the data security product or service decisions since 2016 were made at the C level and failed to include any users or affected department managers in the cybersecurity purchasing decision. Only 4% of organizations had a steering committee to evaluate the impact of the cybersecurity investment.
“The situation did not improve in 2019 and dilemma with cybersecurity budgeting and forecasting is the lack of reliable historical data,” said Brown. “Cybersecurity is a newer line item for hospitals and physician enterprises and budgets have not evolved to cover the true scope of human capital and technology requirements yet, including AI.”
Last year’s Black Book cybersecurity survey revealed 84% of hospitals were operating without a dedicated security executive. As a solution to unsuccessfully recruiting a qualified healthcare chief information security officer, 21% of organizations opted for security outsourcing to partners and consultants or selected security-as-a-service options as a stop-gap measure.
In 2019, 21% of hospitals surveyed report having a dedicated security executive, although only 6% identified that individual as a Chief Information Security Officer or CISO. Only 1.5% of physician groups with over ten clinicians in the practice report having a dedicated CISO.
The estimated cost of a data breach by the respondent hospital organizations with actual breaches in 2019 averaged $423 per record.
Source: Yahoo Finance
