Third-party risk costs the healthcare industry $23.7 billion per year, report finds

The inability to adequately assess and understand the risks that vendors pose is becoming incredibly costly to healthcare providers, according to a new report released today by Censinet and the Ponemon Institute.

The yearly hidden costs of managing vendor risk is $3.8 million per healthcare provider, far surpassing the $2.9 million that each data breach costs providers, the research shows. The cost across the healthcare industry is $23.7 billion per year. The research also indicates that 56 percent of healthcare organizations have experienced a data breach introduced by one or more third-party vendors in the last two years.

The report, "The Economic Impact of Third-Party Risk Management in Healthcare," analyzes the results of a survey of 554 healthcare IT and security professionals who are involved in managing their organizations' vendor risk management programs. Dr. Larry Ponemon, chairman and founder of the Ponemon Institute, and Ed Gaudet, CEO and founder of Censinet, will discuss the research and vendor risk management best practices for healthcare providers during a webinar on July 25, at noon ET.

WHAT'S THE IMPACT

The report found that 72 percent of respondents believe the increasing reliance upon third-party medical devices connected to the internet is risky, and 68 percent say moving to the cloud while connecting medical devices to the internet creates significant cyber risk exposure.

Two out of three respondents believe that current manual risk management processes cannot keep pace with cyber threats and vulnerabilities, while 63 percent believe they cannot keep pace with the proliferation of digital applications and devices. Reliance on inefficient third-party vendor risk management processes and the inability to automate risk assessments and remediation has created an environment where third-party breaches are commonplace and expensive.

These inefficiencies and escalating breaches exist despite the number of resources -- both known and hidden -- that are involved in the vendor risk management process. The report said the average healthcare provider has 3.21 dedicated full-time employees spending more than 500 hours per month completing vendor risk assessments.

But there are significant, additional hidden costs -- including the involvement of information security and risk staff, supply chain managers, clinicians, and line of business managers -- that increase the number tenfold to 5,040 hours per month that healthcare providers spend managing third-party vendor risk.

Even with this time and resource commitment, 60 percent of respondents still believe that time spent on vendor risk assessments takes resources away from other important tasks.

WHAT ELSE YOU SHOULD KNOW

Among other findings was that providers have an average of 1,320 vendors under contract, but just 27% said they assess all vendors annually. Fifty-nine percent of respondents said that they believe senior executives in their organization can bypass the third-party assessment process in order to secure a lucrative business relationship, creating an enormous loophole for even the most effective vendor risk management programs.

Meanwhile, 80% of providers believe that prioritization of vendor risks is very important -- but only 36% believe their ability to do so is very effective.

Only 40% of respondents say that they believe vendor assessments as they exist today are very valuable for the actionable insights they provide to the C-suite and board of directors. And just 21% of all vendor risk assessments result in a requirement to remediate prior to doing business with the healthcare provider, while only 11 percent result in disqualification.

The vast majority of respondents recognize the importance of automation, such as continuously updating changes to third-party risk (78%) and standardizing vendor assessment questionnaires (74%) -- but only 38% are able to achieve automation of each capability. In fact, only one-third of respondents said that they are automating most of their vendor assessment programs, which means that the vast majority of healthcare providers continue to rely on manual, inefficient processes to mitigate third-party risk.
 

Twitter: @JELagasse

Email the writer: jeff.lagasse@himssmedia.com