One of the most important lessons over the past year for the healthcare sector is planning for cyberattacks that disrupt critical third-party vendors, advises regulatory attorney Betsy Hodge of the law firm Akerman.
“This past year has driven home that it’s important that you have a good understanding of your supply chain,” she said. “Make sure you are vetting, especially the mission-critical vendors, and then also developing continbegency plans,” she said.
“That means having instead of just one vendor for a particular product or service, perhaps having a couple of vendors, so if one of them has an incident and is not able to operate, you have the other vendor who can help you continue to operate with little or no impact to your organization.”
Organizations that provide critical IT services to the healthcare sector – as well as organizations that offer life-saving supplies, such as blood – were among the hundreds hit with massively disruptive attacks affecting legions of their clients and related customers in 2024.
“I would recommend that you prioritize high-risk vendors, or those vendors that are providing services in mission-critical areas – and apply more cybersecurity diligence around that,” she said. That enhanced scrutiny can include security questionnaires to audits.
“I expect that we will see more supply chain issues going forward – attacks where a downstream entity in a healthcare organization’s supply chain has a cyber incident, and that affects all of that suppliers’ customers, who may all be healthcare entities,” she said.
In this interview with Information Security Media Group (the audio link is above), Hodge also discussed:
- Other important planning considerations for potential cybersecurity and other IT disruptions involving mission-critical third-party suppliers;
- Steps healthcare sector entities can take to best comply with upcoming state and federal regulations, as well as existing rules, during a time of political and enforcement priority uncertainty;
- Emerging issues involving the use of artificial intelligence in healthcare.
Hodge is a partner in law firm Akerman’s healthcare and data privacy practices. She focuses on compliance and regulatory issues affecting healthcare providers, payers and employer-sponsored health plans. Hodge is also the chair of the American Health Law Association’s Health and Information Technology Practice Group and an author and frequent speaker on healthcare law.