By Marianne Kolbasuk McGee (HealthInfoSec)    

When a hospital or clinic is hit with a ransomware or other cyberattack, it often seems as if the electronic health record systems just can’t win. Even if the EHR system is not the prime target of the attack, it’s frequently still taken offline as the victim organization responds to the incident.

An attack earlier this month at Ann & Robert H. Lurie Children’s Hospital of Chicago forced the pediatric medical center to take many of its IT and communications systems – including email, phone and electronic health records – offline for several weeks (see: Systems, Phones Still Offline at Chicago’s Children’s Hospital).

These situations can pose significant challenges to organizations in their mission to ensure the security, privacy, integrity and availability of these critical IT systems – all underpinning the delivery of safe and timely patient care.

“EHR systems are attractive targets for cyberattacks. Once access or a compromise is made, EHRs are data-rich and can be leveraged heavily for ransom due to the operational dependency of clinicians,” said Wendell Bobst, partner and principal consultant at security and privacy consultancy tw-Security.

When cybercriminals attack hospitals, besides the risk of compromise to patient data, the ability to provide fast, efficient, quality patient care is severely hindered. “So what’s at stake is patient lives,” said Kate Pierce, the former longtime CIO and CISO of North Country Hospital in Vermont, now senior virtual information security officer at security firm Fortified Health Security.

Access Management Complexity

Exacerbating the challenges is that the security of EHR systems can be very complex, Pierce said. “Many modules are involved, and distinct access levels typically depend on the large variety of roles within the organization.”

“Managing access can be time-consuming and if not done correctly, can cause delays to patient care. If health systems are not dedicated to ensuring consistent least-privileged access, risk of breach can escalate from external and internal threats,” she said.

Application Vulnerabilities

EHR systems’ complexity and criticality also present obstacles in addressing security vulnerabilities that put these systems at risk, Bobst said.

“This tension exists as the demand for additional functionality can conflict with the testing requirements needed to prevent opportunities to exploit,” he said. “As the code base continues to grow, it becomes more and more difficult for EHR vendors to manage it. Lastly, EHR downtime – even to fix vulnerabilities – is disdained by clinicians, which can delay updates and critical patches.

MFA Adoption Roadblocks

Because the EHR system is so critical, it should be managed with tighter security, including stronger access controls – such as multifactor authentication for remote access – and more robust logging and auditing, Bobst said.

But that doesn’t always happen.

“Some organizations, including vendors and health systems, have been slow to require MFA for remote access for web-based EHR systems, which is a key to preventing unauthorized access,” Pierce said. Reasons include resistance of staff to take the extra step, the complexity of providing the options, and the cost of implementing these controls, she said.

“The data housed in the EHR is a primary target for cybercriminals,” Pierce said. Once an attacker is inside an organization’s network, EHR systems housed in the data center can be just as likely – if not more likely – to be compromised than any other information system within the environment,” she said.

A Life-and-Death Matter

Safety and other serious issues involving attacks that disrupt critical IT systems, including EHRs, are getting attention from many fields, including research, regulation and lawmaking.

An October 2023 study by the University of Minnesota found that in-hospital mortality rates increased between 33 per cent and 55 per cent on average for patients who were in hospitals during an attack. These rates are not attributed strictly to the effect of EHRs being offline. The shutdown of imaging systems and other critical clinical IT is also a factor.

And the impact of a hospital EHR outage is not limited to the attacked entity. It also affects other medical providers in a region, Pierce said.

“During a cyber event, hospitals often choose to divert patients to nearby facilities as they struggle to manage patient care. However, they often lack key information needed to make safe, informed decisions regarding that care,” she said. And when patients are diverted due to a cyberattack, the emergency rooms of these other facilities are often quickly overwhelmed.

Regulators are pushing healthcare sector entities to ramp up their cybersecurity practices and controls to better prevent falling victim to ransomware and other types of attacks that can greatly affect clinical and other IT systems.

They recommend following an evolving strategy from the Department of Health and Human Services to improve healthcare sector cybersecurity, as well as various bipartisan bills introduced in recent months that address health industry cyber issues.

Layered Security Strategy

Aside from politics and government policymaking, entities can and should take measures to better protect their EHRs from security compromises.

Layers of technologies are required to protect an organization if one or more technologies are bypassed, Bobst said. This becomes very costly if organizations don’t limit where and how confidential data is allowed to live, he added.

The critical layers range for workforce training to threat intelligence. That includes threat bulletins from vendors and law enforcement, including the FBI, to help staff stay aware of the current activities, exploits and dark web activity, he said.

Other critical layers include MFA, limited user access, and endpoint protection and network access controls that connect to a SIEM or XDR platform, he said. And EHR applications and files shares should leverage role-based access, directory authentication and extensive auditing, according to Bobst.

Pierce said the key to early identification of suspicious activity within EHR systems is frequent, regular auditing. “There are some tools out there that can be leveraged to trigger both proactive and reactive alerts on suspicious activity if organizations don’t have the resources to conduct manual audits,” she said.

She also recommended setting up alerts if an unusually high volume of data is leaving the network.

“This could be a sign that the cybercriminals are exporting your key information to hold for ransom before they encrypt the data,” she said. Along with this monitoring, health systems should adopt a culture of “if you see something, say something” that encourages staff to report any suspicious activity, according to Pierce.

Healthcare organizations must keep in mind that if cyberattackers know which layers are weak, underfunded or under-resourced, they can create a path of attack or vector to exploit various weaknesses, Bobst said. “We create incident response tabletop exercises using these principles,” he said.

But he hastened to add, “If there was a silver bullet to stop ransomware and similar attacks, we would not have the current situation.”