Cyber Risk in Medical Devices: Part V

EDITOR’S NOTE: Edward Roche, in association with RACmonitor, is writing a series on the need for U.S. healthcare facilities to protect themselves from cybercriminals demanding ransoms for patient records. This is the fifth installment in that series and comes on the heels of a reported cyberattack Tuesday at Heritage Valley Health System, based in Sewickley, Pa.

The U.S. House of Representatives’ Committee on Energy and Commerce held a hearing last week on cybersecurity in healthcare. In addition, the U.S. Department of Homeland Security (DHS) Cybersecurity Task Force recently released a report suggesting that current guidelines are not adequate to meet the threat posed by cyberattacks.

Of particular concern is risk associated with medical devices, especially when they are connected to networks.

If your devices become infected with malware, then it may start to alter their data, leading to incorrect diagnoses. This could result in deadly consequences in many cases. Hackers could connect to a device, break in, then change its function – for example, something like a heartbeat monitor might be changed into an eavesdropping device.

In the same way that websites sometimes are obstructed and made unreachable by a firestorm of robot-generated inquiries – a “distributed denial of service,” or DDoS, attack – so too would it be possible for devices and the networks that support them to be shut down or made unusable by a sudden and uncontrolled flood of information or requests.

It also is possible that medical devices could be converted into a portal from, through which sensitive patient data could be exfiltrated out of a health provider’s information system. In this case, the login and security credentials of the device itself would be harnessed in order to gain entry into the back-end information system containing patient information. 

Sale on the Dark Web

The prices for raw patient data are not terribly high. Reports from the Identity Theft Resource Center indicate that there were 355 breaches of patient information in 2016, constituting about 15 million records. Banner Health in Phoenix, Ariz. lost 3.7 million records; Newkirk Products in New York City lost 3.3 million; 21st Century Oncology in Fort Myers, Fla. lost data on 2.2 million individuals; and such examples go on and on.

The records have a fluctuating price on the dark web: a place where illegal transactions take place behind a wall of encryption and virtual IP addresses. On a per-record basis, patient medical records go for between 24 cents and $2 per patient.

There are relatively low prices because this information represents only preliminary raw material being used for fraud. After obtaining items such as birthdates, social security numbers, driver’s license information, insurance information, and other details, then the trained criminal can begin the process of impersonating the identity of patients.

New Audits on the Way

In 2017, we will see a wave of new audits of healthcare providers. These will not come from the Recovery Audit Contractors (RACs) but instead from the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR). Evidently, the Civil Rights Act has been broadened in its scope to allow the government to audit providers, because having one’s personal information kept securely is considered to be a “civil right.” The audits are not only targeting hospitals, but also business associates. What types of punishment are available? Both civil fines and criminal penalties are being leveraged by the government to encourage good practices.

We can expect much more audit risk from cyber in the future, and we will continue to discuss these new audits in future installments of this series in RACmonitor.

Print Friendly, PDF & Email
Facebook
Twitter
LinkedIn

Edward M. Roche, PhD, JD

Edward Roche is the director of scientific intelligence for Barraclough NY, LLC. Mr. Roche is also a member of the California Bar. Prior to his career in health law, he served as the chief research officer of the Gartner Group, a leading ICT advisory firm. He was chief scientist of the Concours Group, both leading IT consulting and research organizations. Mr. Roche is a member of the RACmonitor editorial board as an investigative reporter and is a popular panelist on Monitor Mondays.

Related Stories

Leave a Reply

Please log in to your account to comment on this article.

Featured Webcasts

Leveraging the CERT: A New Coding and Billing Risk Assessment Plan

Leveraging the CERT: A New Coding and Billing Risk Assessment Plan

Frank Cohen shows you how to leverage the Comprehensive Error Rate Testing Program (CERT) to create your own internal coding and billing risk assessment plan, including granular identification of risk areas and prioritizing audit tasks and functions resulting in decreased claim submission errors, reduced risk of audit-related damages, and a smoother, more efficient reimbursement process from Medicare.

April 9, 2024
2024 Observation Services Billing: How to Get It Right

2024 Observation Services Billing: How to Get It Right

Dr. Ronald Hirsch presents an essential “A to Z” review of Observation, including proper use for Medicare, Medicare Advantage, and commercial payers. He addresses the correct use of Observation in medical patients and surgical patients, and how to deal with the billing of unnecessary Observation services, professional fee billing, and more.

March 21, 2024
Top-10 Compliance Risk Areas for Hospitals & Physicians in 2024: Get Ahead of Federal Audit Targets

Top-10 Compliance Risk Areas for Hospitals & Physicians in 2024: Get Ahead of Federal Audit Targets

Explore the top-10 federal audit targets for 2024 in our webcast, “Top-10 Compliance Risk Areas for Hospitals & Physicians in 2024: Get Ahead of Federal Audit Targets,” featuring Certified Compliance Officer Michael G. Calahan, PA, MBA. Gain insights and best practices to proactively address risks, enhance compliance, and ensure financial well-being for your healthcare facility or practice. Join us for a comprehensive guide to successfully navigating the federal audit landscape.

February 22, 2024
Mastering Healthcare Refunds: Navigating Compliance with Confidence

Mastering Healthcare Refunds: Navigating Compliance with Confidence

Join healthcare attorney David Glaser, as he debunks refund myths, clarifies compliance essentials, and empowers healthcare professionals to safeguard facility finances. Uncover the secrets behind when to refund and why it matters. Don’t miss this crucial insight into strategic refund management.

February 29, 2024
2024 ICD-10-CM/PCS Coding Clinic Update Webcast Series

2024 ICD-10-CM/PCS Coding Clinic Update Webcast Series

HIM coding expert, Kay Piper, RHIA, CDIP, CCS, reviews the guidance and updates coders and CDIs on important information in each of the AHA’s 2024 ICD-10-CM/PCS Quarterly Coding Clinics in easy-to-access on-demand webcasts, available shortly after each official publication.

April 15, 2024

Trending News

Happy National Doctor’s Day! Learn how to get a complimentary webcast on ‘Decoding Social Admissions’ as a token of our heartfelt appreciation! Click here to learn more →

SPRING INTO SAVINGS! Get 21% OFF during our exclusive two-day sale starting 3/21/2024. Use SPRING24 at checkout to claim this offer. Click here to learn more →