Healthcare breaches have exposed 385 million patient records from 2010 to 2022, federal records show, though individual patient records could be counted multiple times.

Hacking incidents, a type of breach, at healthcare firms have skyrocketed in the past five years as cybercriminals demand ransoms in exchange for restoring access to sensitive medical data.

While healthcare companies have to improve their cybersecurity given the rise in breaches and cyberattacks, regulators need to raise the bar on cybersecurity standards, experts told Healthcare Dive.

"Could all these organizations do a better job? Absolutely," said Jim Trainor, former assistant director of the Cyber Division at the Federal Bureau of Investigation and who is now a senior vice president of Aon Cyber Solutions, a global professional services firm.

Disrupting any one of the nation's 16 critical infrastructure sectors, including the healthcare industry, poses a national security threat. These sectors are vital to daily life for millions of Americans and disabling them would have a debilitating effect on society, according to the Cybersecurity and Infrastructure Security Agency, or CISA, the country's cyber defense agency.

Cyberattacks that disrupt hospital operations put patients' lives at risk. The FBI said that the healthcare industry was hit the hardest by ransomware attacks in 2021 compared to other critical infrastructure. And the threats come as hospitals struggle with staffing shortages and financial pressures exacerbated by the COVID-19 pandemic.

In the wake of a ransomware attack on one of the nation's largest hospital operators last year, Healthcare Dive analyzed more than 5,000 breaches reported over the past 13 years to the HHS Office for Civil Rights, the agency tasked with enforcing privacy and security laws in the healthcare sector.

A breach is a broad term for when protected health information that can identify patients is improperly revealed or used. A hacking or IT incident is a type of breach that involves a technical intrusion, according to the HHS, and is just one type of breach tracked by the agency.

Breaches can dramatically range in size in terms of the number of people affected in each incident.

Health insurers, providers, clearinghouses and business associates are required to notify the HHS OCR when breaches occur. If a breach affects the private health information of more than 500 people, covered entities have 60 days to notify regulators.

The rise in breaches comes as healthcare companies have increasingly adopted digital services over the past decade, leaning more heavily on health information technology.

The use of electronic health records by hospitals, especially, has soared since 2010, when providers began to take advantage of federal incentive programs that made billions of dollars available to those that opted to use EHRs.

Still, that connectivity can lead to cyber vulnerabilities and create avenues to access protected data, they said.

During just one episode of care, multiple entities may access a patient's information, including doctors, hospitals, X-ray facilities and insurance companies, Aon Cyber Solutions’ Trainor said.

"The complexity of the network to facilitate the events is unbelievable," Trainor said.

A rush to remote work fueled more entry points for attackers

The hospital sector became even more vulnerable during the pandemic, which dramatically accelerated the use of network- and internet-connected devices, said John Riggi, who advises the American Hospital Association on cybersecurity and risk. As non-clinical employees pivoted to working from home, hospitals increased their reliance on third-party and cloud services.

It led to an "expanded digital attack surface," said Riggi, who previously served as an FBI section chief overseeing cyber issues.

Hospitals' dependency on third-party technology also makes them more vulnerable because they don't have total control over the security of third-party tools, Riggi added. As a result, hospitals have to wait for vendors to send patches for connected medical devices and are prohibited from patching problems themselves.

"The key is we are being attacked by foreign adversaries. The vast majority of compromised records are from hostile acts, meaning foreign-based adversaries that even the FBI can't put their hands on," Riggi said.

"It becomes very, very difficult to secure this expanded attack surface under increased fire during a pandemic," Riggi added.

Israel Barak, chief information security officer at Cybereason, a cybersecurity firm based in Boston, added that many healthcare companies lack robust cybersecurity programs.

"The chain is only as strong as its weakest link and there are so many weak links," Barak said.

This makes healthcare an easy and profitable target for cyberattackers, he added.

When breaches do occur, "the blast radius is bigger because of the information sharing," said Christina Powers, partner at West Monroe who leads the firm's Cybersecurity Advisory for Private Equity Program.

That may explain why the average breach size has surged in recent years, Powers added.

To be sure, not all breaches are the result of cyberattackers.

The federal government tracks a handful of breach types: hacking/IT incident, which can include cyberattacks; improper disposal; loss; theft; and unauthorized access/disclosure.

The second-most common type of breach in recent years is the result of unauthorized access or disclosure, which can occur when an employee accesses records outside of their job duties, according to Healthcare Dive's analysis. It can also include when patient information is exposed through misdirected communications.

Other types include loss or theft, such as when laptops or thumb drives are left in public places or stolen.

Rich data, profitable targets

Ransomware attacks are a top threat facing the industry because healthcare organizations are profitable targets, according to security experts.

In a ransomware attack, hackers lock out healthcare institutions from critical files and information and hold it hostage while demanding a payment in exchange for a decryption key to unlock the files.

Cybercriminals know healthcare organizations will feel pressure to rapidly restore access to lifesaving systems and technology.

Providers are more likely to pay a ransom when the disruption threatens patient care, such as when emergency rooms are shut down or when facilities are forced to reroute patients, Aon Cyber Solutions’ Trainor said.

The FBI has warned that these attacks can put patients at risk by delaying access to care and vital information.

A newborn died allegedly as result of a ransomware attack that disabled computers on every floor of an Alabama hospital and strained resources, according to The Wall Street Journal. The report said that Teiranni Kidd's daughter died months after she was delivered with the umbilical cord around her neck.

A 2021 survey of nearly 600 IT and health executives at provider organizations showed that ransomware attacks had a significant impact on patient care. Of those that experienced a ransomware attack, the majority reported longer lengths of stay; delays in procedures and tests; and diversions. More than one-third of respondents cited increased complications and almost one-quarter flagged increased mortality rates.

For ransomware criminals, 'it's all about ROI'

Ransomware attacks on healthcare organizations have increased in frequency and severity since 2016, researchers found and tracked through the database, THREAT, or Tracking Healthcare Ransomware Events and Traits.

"It's all about ROI" for these criminals, Trainor said.

In addition, it can be difficult to deter bad actors, who can launch attacks from other countries and are often outside the reach of U.S. law enforcement, according to security experts.

In September, three Iranians were charged with attempting to launch a cyberattack on Boston Children's Hospital, one of the largest pediatric medical centers in the country.

FBI Director Christopher Wray later characterized the foiled incident as "one of the most despicable cyberattacks I've ever seen."

While the FBI was able to intervene before the attack was committed, the incident raised concerns about nation-state attacks on healthcare operators in the U.S.

"I do think we need to be prepared about the possibility of disruptive or destructive attacks by nation-states on healthcare, too," said Morgan Demboski, a threat intelligence analyst for IronNet, a cybersecurity firm based in McLean, Virginia.

Attacks can be motivated by cyberespionage as well, Demboski added.

Some nation-states aimed to steal vaccine-related information and other medical research linked to the coronavirus to boost their own commercial sector, Demboski said.

Amid this threat landscape, healthcare firms should upgrade their cyber preparedness and may need a push from federal regulators, security experts said.

On March 1, President Joe Biden unveiled a sweeping national cybersecurity strategy that seeks to improve the nation's cyber defenses. The policy goal calls for establishing minimum cybersecurity standards across critical infrastructure, including the healthcare industry.

The policy plan, while not an executive order, will serve as a guide for federal agencies and lawmakers to enact cyber requirements.

Raising the bar on cybersecurity standards is critically important for healthcare companies, security experts said.

"I think we need to set a higher regulatory standard for healthcare organizations," Cybereason's Barak said.

To be sure, raising the bar will likely come with financial consequences for hospitals and may raise healthcare prices, Trainor said.

Still, Trainor added, "the level of security across the industry is not where it needs to be to protect patients' healthcare information."

News graphics developer Julia Himmel and visuals editor Shaun Lucas also contributed to this piece.