As of late, ransomware attacks are inspiring a reassessment of cybersecurity in the healthcare industry. Cyberattacks in the healthcare industry are spreading like wildfire across the globe, affecting thousands of individuals and healthcare companies. So, what should the response be to these threats?

David P. Saunders, partner at Jenner & Block, sat down with Inside Counsel to discuss steps for companies to take to better defend against the next cyberattack. As evidenced by many recent attacks, it is likely that the volume of cyber incidents will increase before it decreases, according to Saunders.

“Going for medical treatment is typically a scary enough experience, which puts everyone on edge. Now imagine a world in which patients are told by their doctors, hospitals, and other healthcare providers that they must wait, go to another facility, or worse yet, have their treatment postponed because the healthcare provider cannot access necessary records or machinery,” he explained. “Such is the age we live in.”

For several years, IT and cybersecurity consultants have been warning that hospitals and healthcare providers who historically have used outdated operating systems, software, or technology were prime targets for a ransomware or other cyberattack. Yet, cybersecurity is expensive and has received a lower priority in the healthcare space as opposed to upgrading the equipment needed to perform services like new MRI tubes or better physical spaces. With the recent surge of cyberattacks, business people who drive healthcare spending are finally reprioritizing that spending to fund cybersecurity.

When WannaCry effectively shut down medical treatment in the United Kingdom, and then weeks later, another attack hit the medical and healthcare providers in the Ukraine, the healthcare industry was served a wakeup call that few outside the IT and cybersecurity world could have imagined. In June 2017, just a few weeks after WannaCry swept the globe, the Health Care Industry Cybersecurity Task Force issued a report on improving cybersecurity in the healthcare industry. While the Task Force's report spanned many issues related to healthcare, there was one theme: the need to improve awareness of cybersecurity threats from the doctors to the board room.

According to Saunders, the recent cyberattacks have demonstrated to everyone that the risk of lax cybersecurity measures is real and costly. While upgrading and enhancing electronic systems to be more secure is expensive, that cost pales in comparison to the cost of breach penalties and fines; defending litigation arising out of cyberattacks; and brand damage that occurs to major hospitals that are struck by an attack. Over the past several years, healthcare providers, electronic health records companies and insurance providers have been the targets of cyberattacks. A big reason for the increased attention of hackers on healthcare services is because the industry has a lot of sensitive information like social security numbers, insurance IDs, and bank account or credit card information.

“The seriousness of WannaCry, Petya, and subsequent attacks has caused those in the healthcare space to reassess how to prepare for a cyberattack, and identify and mitigate cybersecurity risks,” he said. “We are seeing increased spending on cybersecurity, increased attention being paid to it in the board room, increased training and awareness efforts, and industry-wide efforts to share information to combat attacks as they happen.”

The key steps for companies to take to better defend against the next cyberattack, according to Saunders, include the following:

Update Operating Systems and Retire Legacy Systems: Most cybersecurity threats focus on low-hanging fruit: companies, tools, and applications that rely on operating systems that are no longer supported by their designers. These older systems leave exposed security flaws and gaps that hackers and others can readily exploit.

Test, Test, Test: Test infrastructure and employees. Make sure that the systems are responding the way they should to pings and other attempted penetrations. For your employees, send fake phishing emails and see if people take the bait. If they do, direct them to a training page, where they can learn the risks of their actions. Make sure that your infrastructure and your people know how to identify and appropriately respond to potential attacks.

Plan: What happens when you detect an attack? This question should be clearly answered in an internal document that is distributed to the appropriate personnel at the company.

“The wealth of information that can be obtained or the value of preventing access to the information is immense,” he explained. “Therefore, the smart money is on an increased volume of cyber incidents until the healthcare services industry proves that it is no longer low-hanging fruit. Only when a hack becomes easier somewhere else, or when the healthcare services industry has fortified its defenses to deter attacks, will the amount of incidents decrease in the healthcare arena.”