News | Cybersecurity | August 20, 2019

New Report Examines Hospital Cybersecurity Challenges in Georgia

Report summarizes cybersecurity challenges faced by CIOs across the state, highlights recommended actions to protect patient data

August 20, 2019 — Healthcare data breaches are currently being reported at a rate of more than one a day, according to a new report from the nonprofit Institute for Healthcare IT (IHIT). And for those who think it can’t happen to them, the odds are not in their favor. Breaches reported between 2009 and 2018 have resulted in the theft or exposure of almost 190 million healthcare records, a number equal to 59 percent of the U.S. population, according to the HIPAA Journal.

A breach can be problematic for large hospitals with the resources and budget to survive a cyberattack, but it can absolutely devastate a smaller facility, and with it, the surrounding community. That thought started keeping Georgia Sen. Bruce Thompson awake at night a few years ago. He was the impetus behind a grassroots initiative that brought together hospital chief information officers (CIOs) statewide to research and discuss the magnitude of the problem along with measures to support cybersecurity. The efforts of Thompson and the hospital CIOs have been summarized in the new IHIT report, titled “The State of Cybersecurity Among Georgia Hospitals.”

“I learned that a fifth of the nation’s rural hospitals are near insolvency and at a high risk of closing, according to a recent Navigant analysis,” Thompson said. “If you want to watch a rural community die, kill its hospital. After Lower Oconee Community Hospital (Glenwood, Ga.) shut down in 2014, other mainstays of the community followed. The bank and the pharmacy shuttered, and the only grocery store in the county closed. On Main Street, building after building closed or fell into disrepair.”

Hospitals have become a popular target among hackers because the electronic healthcare record (EHR) is worth more than any other data on the black market. Medical records could be worth $1,000 each while social security numbers are just 10 cents and credit card numbers are worth 25 cents.

Beginning in October 2017 and continuing through 2019, Georgia hospital CIOs gathered to explore the issues and determine ways they could work together to make a difference. These meetings included hospital CIOs from across the state, with regional working groups pulling together small groups to discuss specific challenges and exchange ideas on ways to solve them.

Among the top issues were: 

  • Preventing phishing attacks; 
  • Maintaining legacy technology that was not built to withstand the sophistication and volume of today’s cybersecurity attackers; 
  • Managing the increasing number of third-party systems that require access to patient health information; 
  • Grappling with the shortage of IT security talent, especially in rural markets; and
  • Overestimating the protection afforded by cybersecurity insurance policies.

The IHIT report summarizes recommendations from the CIOs around two primary initiatives:  establish a healthcare-specific resource center offering Georgia hospitals and healthcare providers access to the most current cybersecurity tools and information; and establish regional online networks for IT Safe Zones where providers can confidentially share threat and incident response insights.

At the heart of the IHIT recommendations is the need to immediately mobilize both executive branch and legislative resources to prepare for the next cyberattack before it sinks a community hospital, and its community.

Calvin Rhodes, the CIO of the State of Georgia, has embraced the IHIT findings and is working with the hospital CIOs to identify ways to offer support. “We saw a real need to extend the cyber academy training developed for state employees to cities and counties in Georgia, and we want to encourage hospital participation as well. Georgia’s new state-of-the-art Cyber Center is serving companies ranging in size from start-ups to the Fortune 500.”

The state is also offering organizations access to a service that provides a seasoned information security officer who will work with an organization one or more days a week with a one-year commitment. “We’re looking to other states for best practices as well,” said Rhodes. “One item that a couple other states often speak to is the benefits of the formation of a volunteer cyber event response task force; in those states it required legislation that provides liability protection for not only the volunteers but also the companies that employ the volunteers.”

For more information:

Related Cybersecurity Content

PODCAST: 5 Low-Cost Ways To Slow Hackers

PODCAST: Hear and Now: How to Boost Cybersecurity in Medical Imaging

Agents of Change: Cybersecurity In A World Of Old And New

VIDEO: Cybersecurity in the Medical Imaging Department


Related Content

iCAD's ProFound AI Wins Best New Radiology Solution in 2019 MedTech Breakthrough Awards
News | Computer-Aided Detection Software | September 09, 2019
iCAD Inc. announced MedTech Breakthrough, an independent organization that recognizes the top companies and solutions...
A smart algorithm has been trained on a neural network to recognize the appearance of breast cancer in MR images

A smart algorithm has been trained on a neural network to recognize the appearance of breast cancer in MR images. The algorithm, described at the SBI/ACR Breast Imaging Symposium, used deep learning, a form of machine learning, which is a type of artificial intelligence. Image courtesy of Sarah Eskreis-Winkler, M.D.

Feature | Society of Breast Imaging (SBI) | September 06, 2019 | By Greg Freiherr
The use of smart algorithms has the potential to make healthcare more efficient.
Philips and Fujifilm booths at SIIM 2019.

Philips and Fujifilm booths at SIIM 2019.

Feature | SIIM | September 06, 2019 | By Greg Freiherr
Pragmatism from cybersecurity to enterprise imaging was in vogue at the 2019 meeting of the Society of Imaging Inform
Heath information technology diagram showing use of cloud storage.
Feature | Archive Cloud Storage | September 04, 2019 | Tyna Callahan
In healthcare, critical systems are being used to deliver vital information and services 24x7x365.
Global Diagnostics Australia Incorporates AI Into Radiology Applications
News | Artificial Intelligence | September 04, 2019
Global Diagnostics Australia (GDA), a subsidiary of the Integral Diagnostics Group (IDX), has adopted artificial...
The CT scanner might not come with protocols that are adequate for each hospital situation, so at Phoenix Children’s Hospital they designed their own protocols, said Dianna Bardo, M.D., director of body MR and co-director of the 3D Innovation Lab at Phoenix Children’s.

The CT scanner might not come with protocols that are adequate for each hospital situation, so at Phoenix Children’s Hospital they designed their own protocols, said Dianna Bardo, M.D., director of body MR and co-director of the 3D Innovation Lab at Phoenix Children’s.

Sponsored Content | Case Study | Radiation Dose Management | September 04, 2019
Radiation dose management is central to child patient safety. Medical imaging plays an increasing role in the accurate...
New Report Reveals Vulnerabilities of Internet of Things-enabled Healthcare Devices
News | Cybersecurity | August 29, 2019
Use of the Internet of Things (IoT) is booming, with IHS Markit forecasting there will be 73 billion connected devices ...
Royal Solutions and ZipRad Partner to Tackle Order Entry and Pre-authorization
News | Electronic Medical Records (EMR) | August 27, 2019
August 27, 2019 — Medical data delivery company Royal Solutions has partnered with ZipRad to streamline imaging exam
Glassbeam Introduces AI-powered Rules and Alerts Engine for Clinsights
News | Analytics Software | August 23, 2019
Glassbeam Inc. revealed several technology enhancements in its Rules & Alerts engine that make it dramatically...
Sectra Signs Enterprise Imaging Contract With Vanderbilt Health
News | Enterprise Imaging | August 21, 2019
Sectra will install its enterprise imaging picture archiving and communication system (PACS) and vendor neutral archive...