Healthcare: Best practices to stop data breaches before they start

Healthcare workers deliver care around the clock, every day of the year. Unfortunately, cybercriminals and their bots keep the same hours. Stealing protected health information (PHI) can be a big moneymaker for cybercriminals, as just one medical record can be sold for $1,000 on the dark web. However, the prognosis for better cyberdefense in healthcare improves every day. 

Individual PHI brings a high price because it includes names, addresses, credit card numbers, medical conditions, health history and insurance information. All these data points are fodder for fraud. Hackers can also reach out directly to potential blackmail victims by threatening to release private personal information, including things like psychiatric notes and evaluations.

Although PHI breaches are deeply disturbing to the folks involved, ransomware attacks have proven to be the most disruptive to the availability of healthcare services. The most common approach involves two steps. One: gain access to an organization’s network, often using social engineering tactics through a phishing email or text. Two: use that access to install ransomware that encrypts and locks healthcare systems so they can demand a ransom for their release. 

Ransomware numbers are alarming

According to The HIPAA Journal, “There were 181 confirmed ransomware attacks on healthcare providers in 2024 involving 25.6 million healthcare records. The average ransom demand was $5.7 million, and the average ransom paid was $900,000.”   

All told, for all types of US healthcare cyberattacks, the Department of Health and Human Services' Office for Civil Rights' (OCR) HIPAA Breach Reporting Tool website lists a total of 677 major health data breaches affecting more than 182.4 million people in 2024.

The OCR doesn’t anticipate a slowdown in cybercrime targeting the healthcare sector anytime soon: “Cyberattacks continue to impact the health care sector, with rampant escalation in ransomware and hacking causing significant increases in the number of large breaches reported to OCR annually. The number of people affected every year has skyrocketed exponentially, a number we expect to grow even bigger this year,” says OCR Director Melanie Fontes Rainer.

Fighting back on several fronts

New rules have been proposed by the US government to ensure that healthcare organizations (HCOs) are using all the technology they can to battle cybercriminals. “This proposed rule to upgrade the HIPAA Security Rule addresses current and future cybersecurity threats. It would require updates to existing cybersecurity safeguards to reflect advances in technology and cybersecurity, and help ensure that doctors, health plans, and others providing health care meet their obligations to protect the security of individuals’ protected health information across the nation,” explains Rainer. 

The HIPAA Security Rule update outlines specific steps that must be taken by healthcare providers and all of their business associates to strengthen cybersecurity protection.

With a scalable, flexible, and reliable IT infrastructure, HCOs can leverage the full potential of their current digital tools and technology to protect PHI. A strong infrastructure partner that understands the healthcare industry can support HCOs in these efforts. Hospitals and practices of all sizes can modernize their networks now, and rely on fast, symmetrical fiber-powered internet connectivity up to 100 Gbps to power their digital health transformation efforts when they choose flexible, scalable, and secure solutions from trusted partners. 

Secure access service edge, or SASE, is quickly becoming a standard approach for securing HCO networks with distributed users, data, and applications. With the increase of cloud computing in healthcare, IT teams are challenged to keep providers securely connected to the resources they need. SASE technology combines several core networking and security solutions to ensure that users have secure, anywhere, anytime access from any device.

SD-WAN and SASE can be offered as partner-managed services, which take the burden of maintenance and ongoing management off the HCO. Equipment is usually included as part of the monthly service, allowing organizations to avoid CapEx investments or long-term hardware commitments. Partnering with a trusted provider to manage your network extends the capabilities and capacity of your team — freeing up time to focus on strategic initiatives.

Smaller practices and clinics

Clinicians and smaller healthcare clinics face the same security challenges as large HCOs. However, they may not have the resources or IT staff necessary to secure their data. These smaller organizations can access connectivity and firewall solutions that enable fast, secure access to patient data and seamless communications. With the Managed Practice Package, organizations of any size with a single- or multi‑site network can enjoy secure, scalable network(s) that include the equipment, connectivity and support they need.

How Spectrum Business can help

Our secure solutions enable dependable, fast, and safer access to the Internet and cloud-based applications, which helps providers, and their employees conduct business and deliver healthcare with fewer interruptions and cybersecurity risks. We offer attractively priced, all-inclusive, dedicated internet access, a managed router and integrated advanced, managed security and the ability to add features and capabilities (WiFi, cameras, etc.) simply and quickly.

The security protections we provide include a Next Generation Firewall and Unified Threat Management (UTM), providing strong security for users, content, and applications, plus visibility into security threats. And all updated automatically, to reduce exposure to new cyberthreats.

Spectrum Business provides technology solutions to 80% of the largest health systems in the US, and partners with healthcare organizations of all sizes. Learn more about HITRUST and HIPAA-compatible solutions that offer the equipment, connectivity, management, communications, and support needed to spur secure digital healthcare transformation.