By Nam Nguyen, Vice Chair
EHRA Privacy & Security Workgroup

October is Cybersecurity Awareness Month, and the Electronic Health Record Association (EHRA) will use this opportunity to share helpful reminders of cybersecurity fundamentals throughout the month. 

The 2020 HIMSS Cybersecurity Survey provides a look into cybersecurity issues facing US healthcare organizations. Based upon the feedback from 168 US-based healthcare cybersecurity professionals, “Significant security incidents continue to plague healthcare organizations of all types and sizes. Phishing is the most common type of significant security incident.”

Phishing and ransomware are the one-two punch of significant cyber risks. Phishing is typically the initial hook for significant security incidents, and occurs when a bad actor targets a user by email, telephone, or text message, posing as a legitimate company or organization to persuade the user to provide sensitive information, such as personal identifiers, banking information, credit card information and passwords. 

Using phishing tactics, a hacker can pose as an organization to get login information from an employee. Then using the login information they stole, place ransomware in the employer company’s critical systems.

Ransomware is malicious software that blocks access to an organization’s critical computer systems until a sum of money, the ransom, is paid. The FBI and the Cybersecurity and Infrastructure Security Agency (CISA) have published guidance urging victim organizations not to pay ransoms; they warn that paying hackers does not guarantee data will be returned and may encourage future strikes.   

By Nam Nguyen, Vice Chair
EHRA Privacy & Security Workgroup

October is Cybersecurity Awareness Month, and the Electronic Health Record Association (EHRA) will use this opportunity to share helpful reminders of cybersecurity fundamentals throughout the month. 

The 2020 HIMSS Cybersecurity Survey provides a look into cybersecurity issues facing US healthcare organizations.  Based upon the feedback from 168 US-based healthcare cybersecurity professionals, healthcare organizations must deal with a growing array of significant security incidents. These issues not only compromise the integrity of your technology and the privacy of patients, but can also disrupt an organization’s ability to provide patient care.

Being prepared for cyberattacks requires doing all you can to reduce cybersecurity risks. One of the most significant risks identified by security professionals is password management. Many people are still using simple passwords such as a series of numbers (123456) or easily guessed words (password). However, the easier it is to guess a password, the higher the risk of being compromised by a cyberattack.