The Ongoing Cyber Threat to America’s Healthcare System

With each passing week, it seems another large and damaging cyberattack is inflicted on our healthcare system. Excellent and essential organizations are falling prey to the relentless and increasingly damaging attacks by cybercriminals and terrorists. But we are not yet responding quickly enough to protect sensitive patient and institutional data in this critical industry.

The numbers are staggering. In 2023, more than 100 million patients had their highly personal and sensitive healthcare and financial information put at risk, more than double the figure from a year earlier.

We’re only five months into 2024 and already there have been massive breaches impacting millions of Americans. This year will surely be worse.

The healthcare industry is its own worst enemy when it comes to cybersecurity. It has underinvested in protecting its assets compared to many other industries. A recent survey cited in Modern Healthcare showed the healthcare industry spent just eight percent of its annual IT budget on cybersecurity, ranking only above the retail sector.

The health industry has consistently resisted efforts to adopt mandatory standards to protect patient and institutional data. But for some, it is a matter of means versus desire. Smaller systems and hospitals often lack the resources to adopt rigorous standards without assistance from the federal government.

So, it’s no surprise that the White House has weighed in with its intention to impose minimum cybersecurity standards on the industry - although no specifics have been given on the nature or timeline of those standards. Nor was there mention of government funding to support adoption.

In 2009, the federal government drove the connectivity and increasing interoperability of the healthcare system with the financial carrots and sticks it included in the HITECH Act. This encouraged providers to adopt electronic health records and increase patient privacy protections. This interconnectedness is now an established fact of our healthcare ecosystem. And as technology advances, the system is going to become even more, not less, connected.

We can’t and shouldn’t want to go back to the days of paper files and faxed records. At the same time, we must also acknowledge the inevitable challenges this invaluable connectedness creates. The old adage that you’re only as strong as your weakest link applies to the cybersecurity of our healthcare system.

There are too many weak links, and they are not being identified and fixed quickly enough. Having compelled greater connectivity among healthcare organizations, the federal government should also require tougher cybersecurity standards and provide funding to subsidize the cost for those organizations which need help to implement rigorous protections.

It is also increasingly clear, and unsurprising, that human error is playing a key role in cybercrime and terrorism. Hackers count on exploiting mistakes or weaknesses in the design of cybersecurity systems, as well as the regrettable, but inevitable, gullibility and naivety of some users who can’t resist or fail to recognize a clever phishing ploy or other social engineering attack.

At Oracle, security is part of our organizational DNA. That’s why we’re focused on providing the healthcare industry with effective solutions to the ever-increasing challenge of cybersecurity.

While no system is bullet proof, our Oracle Cloud Infrastructure (OCI) provides healthcare customers with the same military-grade security that protects the most sensitive data of our national defense agencies and governments around the world. Running on OCI not only enhances security but also boosts operational efficiency and facilitates the swift adoption of built-in, cutting-edge innovations, such as generative AI capabilities.

The security-first design principles we adhere to at Oracle—automated security measures, always-on monitoring, and foundational security integration—should be healthcare industry standards and mindsets adopted by all. By fortifying our defenses from the ground up, we can create a more robust healthcare infrastructure resilient to the evolving landscape of cyber threats and ransomware.

Most recently, we launched our Autonomous Shield initiative to support our customers move to the cloud – at our expense. This initiative both simplifies customers’ migration to our cloud and takes human error out of the equation. Our autonomous databases and operating systems constantly patch and protect against the latest vulnerabilities, thus providing automated updates that will help our customers fortify their cyber defenses. Larry Ellison and I wrote about the importance of autonomous systems in a WSJ op-ed last month.

We are at a critical moment for the healthcare industry. Our industry must recommit to making cybersecurity resilience a top priority. The public’s faith and trust in the system is at risk, as is the ability of providers to care for patients.

I was struck recently by a quote from an article about healthcare cybersecurity that goes to the heart of this matter. “Just as hand washing is a foundational element of modern medicine, cyber hygiene must be regarded as a basic and essential component of a functioning (health) system.”

Failure to exercise proper cyber hygiene is just as dangerous to patients and threatens the fundamental mission of our healthcare system at a time when it is already under great stress. We must address this problem immediately. Effective solutions are at hand if we choose to engage them.