Cybersecurity is not a cost, it's an investment, experts say

Credit: Coolcaesar.

Cybersecurity is not part of a hospital's core competency. Executives would much rather be spending money on what hospitals are in the business of doing.

University of California Irvine Health CIO Chuck Podesta knew this when he joined the health system three years ago after working in a similar capacity in Vermont.

So getting the medium-sized academic medical center to invest $7 to $8 million the first year came down to telling the CEO, and other executives, that it would cost them a lot more if the system suffered a data breach.

[Also: 7 largest data breaches of 2015]

And not just financially due to fines and possible civil suits. The CEO would have to apologize to the community.

From that point on, the C-suite had buy-in on the importance of cybersecurity, the first step in having a successful program.

"You walk your leadership team through a breach," Podesta said.

[Also: What to look for when hiring healthcare cybersecurity pros]

What executive leadership needs to know is the risk profile of the organization, not the details of how data loss prevention works, he said.

At that time, UC Irvine had an encryption program and policy and procedures in place. Podesta and team hired CynergisTek to do an assessment of the security systems. They found holes that needed to be plugged.

That first year they got that $7 to $8 million and hired Optimum Health to do a remediation plan.

[Also: 'Warfare mindset' key to justifying cybersecurity investment, experts say]

"We don't spend that much now," Podesta said.

In 2015, healthcare had the dubious distinction of experiencing seven large data breaches. In February, Anthem had the largest breach, affecting the data of more than 80 million people. Breaches were also reported by Excellus BlueCross BlueShield and Premera Blue Cross.

In fact, the wave of breaches led UC Irvine to speed up the timeline of their remediation plan from one year to four months.

CynergisTek's Vice President of Security Strategies Clyde Hewitt said sometimes it's a hard to sell the heads of health systems on the benefit of budgeting cybersecurity. They may feel they're up-to-date, but if the hospital's last update was done in 2003, it's out-of-date.

"The cyber threats we're dealing with today are radically different," Hewitt said. "In 2003 we were worried about hackers. We've moved so far beyond that. Now there's cyber terrorism."

Health systems look to HIPAA law for compliance, but that privacy law went into effect in 1996.

"There needs to be a recognition this is not a cost, but an investment," Hewitt said.

If through a cyber attack the system loses its data, it must have the financial reserves and cash flow to deal with potentially not being able to bill patients. It will impact their accounts receivable, Hewitt said.

UC Irvine installed a spam filter to catch ransomware phishing attacks. It put in data loss prevention software to map where the protected information is located. And it added improved spam filters around email.

The health system also invested in education for staff.

Through mock phishing attempts, they managed to lower the rate employees opened malicious emails from 20 percent to 2 percent.

"We put in a robust spam tool when the ransomware came out," Podesta said. "It's a struggle, you got to keep ahead of the bad guys."

Hewitt said, "I think a lot of hospitals focus on hospitals and external threats. If you look at the number of breaches, a large percentage start with actions from people inside. It's not because it's malicious. It's because people get rushed."

UC Irvine works with four other medical centers within UC Health, though security is still handled separately. The medical centers are using CynergisTek for their assessments and agreed to purchase Cisco for their security IT networks, which has led to greater alignment on security programs.

The next step will be to install a product that can alert systems on the West Coast if there's a problem on the East Coast.

Podesta started with two people on staff. Now he has five.

"We're still short," he said. "I could easily find work for another three people."

UC Irvine suffered a small data breach about six months into Podesta's tenure. The breach affected about 3,000 patients. It was caused by an error, not a hack.

Because UC Irvine was able to show work being done through a remediation plan, the system ended up with no finding and no fine.

"We basically showed," Podesta said, "that we had a culture of security across the organization."

Twitter: @SusanJMorse
Email the writer: susan.morse@himssmedia.com