Planning for Cyber Chaos: Healthcare’s Resilience Test

When a hospital, healthcare system or one of their critical third-party vendors is hit with a ransomware attack, all hell can break loose quickly. That often means ambulances must be diverted, patient appointments and procedures cancelled, business processes put on hold and other critical operations stymied.

See Also: OnDemand | Transform API Security with Unmatched Discovery and Defense

That has been the case for hundreds of hospitals and other healthcare providers, as well as their critical vendors. In fact, Heywood Healthcare and its two small, Massachusetts-based community hospitals – are still recovering from ransomware attacks that disrupted operations two weeks ago. Other major attacks have originated at third-party suppliers like the one against UnitedHealth Group’s IT services unit, Change Healthcare, which last year disrupted thousands of providers for months.

Experts say resiliency in the face of cyberattacks is a critical part of the cyber maturity model in healthcare – ensuring that hospitals and other providers can continue delivering care and conducting business when confronted with a serious disruption.

“The thing we’re trying to emphasize to hospitals is this is an enterprise risk. This is not an IT problem,” said Scott Gee, deputy national advisor of cybersecurity and risk at the American Hospital Association. Resiliency from cyberattacks was a key topic for Gee and other speakers at the recent Information Security Media Group Healthcare Security Summit.

Gee pointed out that disruptions in care create reputational risks for individual hospitals, but “if you are hit with a cyberattack and your services are offline, you’re diverting patients elsewhere. It’s a regional risk,” he said.

Resiliency has several core interdependent components, experts say. Those pillars include operational resiliency for the continuity of care, automation and architectural resiliency to help improve detection and containment of the incident – and provide a level of functionality through backups, redundancies and other measures. Other key pillars are related to governance, cultural, workforce and leadership issues.

“For healthcare organizations preparing for disruptive cyberattacks, it’s important to take a whole-of-business approach,” said Jamie Singer, senior managing director and co-leader of cybersecurity and data privacy communications practice at FTI Consulting, a crisis management consulting firm.

Cyberattacks can lead to disruptions in patient care, “staff burnout from extended downtime procedures, regulatory scrutiny and litigation risk, theft of highly sensitive personal and protected health information, financial impacts, extended news cycles and diminished stakeholder trust,” she said.

“Effective preparedness plans for healthcare organizations should go beyond IT considerations and also incorporate robust business continuity, legal, regulatory and communications planning.”

Most experts argue that patient care considerations should be central to the planning.

“We encourage hospitals to approach resiliency thinking about it in terms of clinical continuity. How can you continue to deliver that high-quality healthcare that your patients expect and deserve in the absence of technology? And as long as they’re approaching it from that lens, we feel like they’re on the right track,” Gee said.

“It’s not just having a plan. It’s having a plan that you can successfully execute for up to 30 days, sometimes longer.”
—Scott Gee, AHA

Having well thought-out and rehearsed downtime protocols, redundant communication systems and role-specific playbooks can be major differentiators between chaos and control during disruptions, experts said.

That includes being able to carry out continuity procedures for the long haul. “It’s not just having a plan. It’s having a plan that you can successfully execute for up to 30 days, sometimes longer,” Gee said.

Creating the Best Response Plan

So what are critical pieces of that plan?

Cross-functional incident simulations that involve clinical, IT, legal and communications teams are vital – as is intra-cross functional incident preparedness, Gee said.

“There are dozens and dozens of applications that you wouldn’t necessarily have thought were dependent on the electronic medical record, but they are,” he said. If a cyber incident brings the EMR down or forces an organization to take EMRs offline to prevent a compromise from spreading, many different clinical activities can be affected, he said.

“Your radiation oncology linear accelerators depend on a network connection. You’ve got your cancer treatment plans all on the network. If an institutions does medical research, if they have patients on experimental therapies, they’re doing human trials and if they lose their network, and that patient shows up at the treating physician or at the ER, or wherever – those providers may or may not know what experimental treatments the patient is on,” he said. “That’s a huge impact to patient care.”

Operational Readiness

But a key part of resilience also depends on detection and containment of threats before a suspicious activity explodes into a crisis.

Vince Crisler, CISO of Celerium and former White House CISO, said ransomware incidents have become a litmus test for operational maturity, exposing weak detection, incomplete inventories, and poor communication between IT and clinical teams. Most healthcare entities still detect breaches months after initial compromise, allowing attackers to establish persistence before encryption, he said.

That’s where architectural readiness and automation comes in, some experts said.

Automation can be key for resilience in a risky environment like healthcare where overwhelmed security teams can’t keep up, Crisler said during the recent ISMG healthcare summit in New York.

Automated detection and containment tools that reduce alert fatigue, shorten dwell time and “let analysts focus on what matters most,” ultimately helping under-resourced hospitals to stay operational in the face of dealing with a potential incident, he said.

“There’s a lot of threat intelligence out there that you can integrate” to help with identifying and isolating validated threats without halting critical operations. “You need to block that connection as quickly as possible, and you need to do it in real time or near real time, or else that data is gone,” Crisler said.

“We have to stop the spread. Keep the business process running while still stopping the bad guy from being successful while we do our incident response and forensics activity,” he said. “That’s this idea of surgical containment.”

Overcoming ‘Accidental Architecture’

Tom Davis, vice president of industry solutions at Aviatrix Systems, framed resilience in healthcare as a function of architecture and intentional design rather than reactive defense.

Davis said that many healthcare organizations have developed what he described as “accidental architectures” – fragmented hybrid cloud environments created piecemeal over time, often without a cohesive security or visibility strategy. This hybrid model can undermine security and uptime, including when dealing with potential cyber incidents, he said.

“Be proactive, be intentional about what your architecture is and making sure that it’s got the right operational capabilities, it’s got the right networking, it’s got the right security, it’s got the right visibility,” he said.

Third-Party Resilience

But of course, hospitals or healthcare providers aren’t always the target of attacks. Ransomware and other incidents hitting third-party vendors have been at the center of many of the most disruptive episodes in healthcare cybersecurity.

The February 2024 ransomware attack on Change Healthcare disrupted thousands of pharmacies, doctor practices, clinics and other healthcare providers for months, and resulted in a record-breaking health data breach affecting 193 million individuals.

This isn’t about just protecting hospitals anymore, “we’re protecting an entire care ecosystem,” said Rob Suarez, CISO at health insurer CareFirst and former CISO of medical device maker Becton Dickinson.

Medical device manufacturers and other suppliers often connect directly into hospital networks, creating indirect paths for ransomware propagation and other compromises, Suarez said.

He and other experts urge organizations to implement vendor telemetry, not questionnaires, and share intelligence on exploit activity across supply chains.

The same threat actors targeting hospitals are now probing vendors and device ecosystems, exploiting unpatched firmware and legacy connectivity protocols.

One of the key aspects of a third-party risk management program is to have business intelligence to understand how a vendor or prospective vendor is behaving outside in the marketplace, said Steven Adler, partner at The Edmund Group and former director of enterprise third-party risk management at health insurer Humana.

“The neat thing about resilience is your patients should never know this is happening to you.”
—Bindu Sundaresan, LevelBlue

Healthcare providers should look into whether a supplier has had a previous business interruption – and its plans for dealing with one in the future. “Do they have a continuity plan? Do they have a business impact analysis? Do they know what a business impact analysis is? Any evidence of testing? So, it’s really trust but verify,” he said.

Communication Breakdown

Among common mistakes that healthcare sector organizations make that can undermine their resilience in the face of a cyber crisis is failing to maintain a line of communication with staff and leadership teams.

“Internal communications and workforce engagement is a commonly under-appreciated aspect of effective cybersecurity preparedness and response,” FTI Consulting’s Singer said.

“The industry is no stranger to workforce challenges today, and a disruptive cyberattack can only exacerbate disengagement and low morale. Healthcare organizations should incorporate into their incident response planning a strong focus on employee wellness and communication,” she said.

As part of that, experts recommend healthcare entities maintaining current lists of contact information for staff – on paper – in case email and phone systems are down during a cyber incident.

Also often overlooked in incident response is the barrage of inquiries healthcare organizations receive from stakeholders, especially from vendors, Singer said.

Often these external players threaten to disconnect from healthcare organizations’ systems during cyber incidents until they complete lengthy security questionnaires, arrange calls with their CISOs and provide third-party letters “attesting” to a clean bill of cyber health, she said.

“Healthcare entities should have a robust infrastructure in place to track and respond to these requests, especially from critical EHR and other connected vendors.”

Building Long-Term Resilience

But getting systems back online isn’t the end of a crisis. Healthcare organizations must prepare for the “long game” of incident response, Singer said. “While the focus of incident response plans is often on the initial days after an attack, effective resilience programs consider the key inflection points throughout the incident response process – from discovery to containment and remediation to investigation and data analysis to legal notifications,” she said.

“Resilience is a hot topic for every industry, but more importantly, for healthcare,” said Bindu Sundaresan, director of cybersecurity at LevelBlue.

“Irrespective of what technology stack you have, you will get attacked,” she said.

“The neat thing about resilience is your patients should never know this is happening to you. It should never reach your end user, as long as you’re able to keep that resilience goal in mind,” Sundaresan said.

“That’s really the gold standard we are going after.”