Medical practice consolidation is a growing trend, with smaller practices being bought out by larger healthcare systems. One intriguing result of this wave of mergers and acquisitions is the tendency of the acquiring medical system to act like a security SaaS provider to the smaller acquired practice, said Susan Biddle, Senior Director of Marketing, Healthcare at Fortinet. According to her, because these practices are smaller, they often don’t have the IT or security expertise that some of the larger practices can afford. Susan Biddle
Senior Director of Marketing, Healthcare at Fortinet This buy-in helps the acquiring health care system get more thorough and secure access to patient information, and both organizations are more likely to avoid the many cyber risks endemic to the healthcare industry. Experian predicts in its 2017 Data Breach Industry Forecast that healthcare organizations will be the most targeted sector. The reason they are top targets for cybercriminals is the nature of the data they are protecting. Patient health information is, on average, 10 times more valuable on the black market than the traditional credit card. Whereas credit card fraud is quickly detected and the card is deactivated, personal health information is difficult to mark as fraudulent and can be used for drug or other medical fraud for months or years. Protecting patient information is a priority, one made more difficult with the transition to electronic health records. In the shift from paper to paperless, security wasn’t always the primary focus. The federal government responded with strict HIPAA standards. So far in 2017, there have been nine HIPAA settlements resulting from failure to adhere to security requirements for this data. Sometimes security budgets are tied into IT budgets, and if healthcare organizations have to choose between a life-saving technology or a back-end system, they are more likely to choose the former. If healthcare providers can’t figure out how to safely adopt IoMT and operate in the digital age, they won’t survive. One of the benefits of consolidations, mergers and acquisitions is that the acquiring practice is oftentimes now acting as a SaaS provider for the smaller, acquired practice – including providing cybersecurity. Because networks are more complicated than ever before, security is only as strong as its weakest link. However, if the bigger acquiring organization employs cybersecurity best practices, they can onboard acquired practices on their network quickly and safely. Adopt a single, automated unified threat management strategy to on-board acquired care facilities. This involves multiple levels of security organized through a single integrated portal with capabilities to detect, isolate and prevent threats from permeating the network. More importantly, UTM organizes your increasingly distributed network infrastructure, providing IT teams with a clear, single-pane-of-glass visibility into the network and centralized control over policy orchestration and threat response. This eases the strain of onboarding and managing newly acquired medical offices on your already overstretched IT team. Conduct an inventory assessment and make sure to keep your software updated. This is quite challenging but critical because software vulnerabilities are a huge target for ransomware as a method for getting into your system.