Are Efforts to Help Secure Rural Hospitals Doing Any Good?

Even though rural hospitals and other small healthcare providers don’t have deep pockets, cybercriminals continue to target them with ransomware, often causing serious disruption and compromises affecting large swaths of patients with no access to other medical services.

See Also: New Attacks. Skyrocketing Costs. The True Cost of a Security Breach.

Ransomware operators realize most smaller organizations such rural hospitals, clinics and doctor practices don’t have the staff and cybersecurity resources needed to address common threats, said Denise Anderson, president and CEO of the Health Information Sharing and Analysis Center.

“It comes from the top. The CEOs have to be invested in cybersecurity because it’s easier to defend and spend money upfront with investments than have an attack and spend millions trying to fix it.”

The plight of rural healthcare was once again a recurring topic at the Healthcare Information and Management Systems Society conference in Las Vegas this week, and various programs in recent years have sought to bolster cyber defenses at these less-defended organizations. Some progress has been made in building awareness among those entities about the cyber threats and risks they face, but making serious investments to address those issues is easier said than done for many small organizations.

Over the past year or so, the federal government, tech vendors, industry groups such as the Health ISAC, and others have stepped up efforts to help these small and rural hospitals and clinics ease their cybersecurity struggles.

Microsoft in a report this week said that so far, about 550 of the approximately 2,000 rural hospitals in the U.S. have signed on to participate in a cyber program it launched last year to help smaller healthcare organizations.

Microsoft’s Cybersecurity for Rural Hospitals Program, part of an initiative announced last year by the Biden administration in partnership with the American Hospital Association and the National Rural Health Association, offers free and heavily discounted cybersecurity services to rural and critical access hospitals (see: Microsoft, Google Offering Cyber Help to Rural Hospitals).

Microsoft’s offering of tools and resources to help rural hospitals mitigate cyberthreats and enhance their resilience continues on despite the transition to the Trump administration, which no longer features a statement about the launch of the initiative on the White House website issued by the Biden administration last June.

Besides Microsoft, Google is also participates in the rural hospital cybersecurity initiative announced last year by the White House. Google did not immediately respond to Information Security Media Group’s request for an update on the status of its work with rural hospitals under the program.

But in January, Google also announced a partnership with the Health ISAC to provide training and other resources to rural hospitals.

Google said most of the resources – including security technology, consulting, support services and security training – are offered at no cost or with significant discounts.

Serious Disruptions

When ransomware hits rural and critical access hospitals, attacks can take down IT systems for days, weeks or even months, causing serious disruption to patients and the community.

“Rural hospitals may not have deep pockets, but they do have insurance, which can be attractive to cybercriminals,” said Paul Underwood, vice president of security at managed services firm Neovera.

“The health systems may be more susceptible to pay ransoms to restore operations too. The reason? An attack that halts operations can send emergency services transporting patients with immediate or life-threatening needs to other institutions further away. In some cases, that 45 minutes can be life or death.”

Besides the IT and patient care disruption, attacks on small rural hospitals that involve data exfiltration also can affect large numbers of people. A November ransomware attack on Georgia-based Memorial Hospital and Manor, an 80-bed rural hospital and its 107-bed long-term care facility affected about 120,000 patients (see: Georgia Hospital, Nursing Home Notifying 120,000 of Hack).

These types of attacks have also attracted attention of U.S. lawmakers.

Over the last couple of years, a handful of bills introduced in Congress aimed to help rural hospitals with cybersecurity related challenges, but despite their bipartisan support, the proposals have so far not gained much traction (see: Bill for Rural Hospital Cyber Skills Passes Senate Committee).

Paul Nakasone, four-star U.S. Army general and former director of the National Security Agency, said that the federal government can do a lot more to help under-resourced healthcare sector groups contend with cybersecurity threats, most notably ransomware attacks, which he called a “scourge” on healthcare.

During his keynote presentation during the Healthcare Information and Management Systems Society conference in Las Vegas this week, Nakasone suggested the government should consider building a dedicated, highly secure network for sharing cyberthreat information quickly to the healthcare sector, and provide other critical security services to struggling organizations.

This concept would be akin to a highly secure network that was built during the development of the COVID-19 vaccines early in the early days of the coronavirus pandemic to share confidential information between the U.S. federal government and the U.S. medical industry under Operation Warp Speed, he said.

“Why don’t we do that same thing with rural healthcare?” he said. “Why don’t we figure out a way we can provide major healthcare providers and anyone that wants it with scanning, protective DNS, secure email to make the bar that much higher for attackers to come into?” he said.

“You don’t have to be the fastest gazelle in the jungle to maintain your security in cyber space. You just can’t be the slowest.”

In the meantime, smaller healthcare providers and rural hospitals with limited resources also can take certain critical steps to bolster their cybersecurity posture and reduce the risk of serious outages affecting patient care, some experts suggest.

“Smaller budgets prevent them from being able to deploy robust software and services to improve resiliency,” said Jeff Wichman, director of incident response at security firm Semperis and former ransomware negotiator.

So, what can they do with no budget? “At a minimum, I strongly suggest that the hospitals assess what their most critical assets are, in most cases electronic medical records. Be able to isolate those records in time of crisis,” he said.

“It is also important for any hospital using Windows to assess how vulnerable their identity system is. Most often it will be Active Directory,” he said. “In 90% of ransomware attacks, ransomware gangs compromise AD,” he said.

“My advice to any rural health system is also to prepare before an attack occurs,” said Underwood. “Assess vulnerabilities in your software, perform thorough IT audits, and ensure you’re providing the appropriate privileges to your most important systems.”