Healthcare CIOs battle Covid cybercrime

As if Covid-19 wasn’t chal­leng­ing enough, the pan­dem­ic also brought a surge in cyber attacks on hos­pi­tals and health cen­tres. As inten­sive care units (ICUs) strug­gled with high num­bers of patients, Chief Infor­ma­tion Offi­cers (CIOs) played a crit­i­cal role in keep­ing hos­pi­tals open. 

“The last 18 months have been relent­less,” says the head of cyber secu­ri­ty at one NHS hos­pi­tal. “You’d think that with the whole world fac­ing the same strug­gle, hack­ers would have left us alone. But the oppo­site hap­pened.” 

The UK’s Nation­al Cyber Secu­ri­ty Cen­tre (NCSC), work­ing in part­ner­ship with NHS Dig­i­tal, respond­ed to more than 200 major cyber-attacks relat­ed to Covid-19 in the first months of the pan­dem­ic. The health ser­vice was NCSC’s top pri­or­i­ty; more than 1 mil­lion NHS IP address­es were sup­port­ed, while “threat hunt­ing” was per­formed on 1.4 mil­lion end­points.  

The threat lev­el also increased in the US. The Health­care Man­age­ment and Infor­ma­tion Sys­tems Soci­ety report­ed that 70% of hos­pi­tals it sur­veyed expe­ri­enced a sig­nif­i­cant secu­ri­ty inci­dent in 2020, includ­ing phish­ing and ran­somware attacks that result­ed in the dis­rup­tion of IT oper­a­tions and busi­ness func­tions, as well as data breach­es and finan­cial loss­es. Ran­somware, bot­nets, remote code exe­cu­tion and dis­trib­uted denial-of-ser­vice (DDoS) attacks were the most com­mon inci­dents faced by health­care organ­i­sa­tions.

Integration priority

CIOs play a much broad­er role in health­care than pro­tect­ing an organ­i­sa­tion against cyber­crime. The con­fi­den­tial­i­ty of patient records is para­mount; patients and ser­vice users need to be absolute­ly con­fi­dent that their data is secure before they ful­ly par­tic­i­pate in dig­i­tal health sys­tems.  

As well as striv­ing to ensure that the NHS remained oper­a­tional at every lev­el, retain­ing pub­lic con­fi­dence is also crit­i­cal. Writ­ing in Impe­r­i­al Col­lege London’s 2020 report into NHS cyber­se­cu­ri­ty, Lord Darzi of Den­ham said: “The NHS holds large amounts of sen­si­tive and valu­able data in vul­ner­a­ble sys­tems. Effec­tive cyber­se­cu­ri­ty is not just about pro­tect­ing data, it is fun­da­men­tal for main­tain­ing the safe­ty, pri­va­cy and trust of patients.”

Health­care CIOs are also cen­tral to the dri­ve towards greater inte­gra­tion between dif­fer­ent sys­tems. This is par­tic­u­lar­ly evi­dent in the new inte­grat­ed care sys­tems in Eng­land, which are com­mit­ted to remov­ing the tra­di­tion­al bar­ri­ers to joined-up care. This requires cre­at­ing com­pat­i­ble IT sys­tems across GP prac­tices, phar­ma­cies, hos­pi­tals and social care providers. Increas­ing­ly, the CIO’s role is mor­ph­ing into chief inte­gra­tion offi­cer. 

A major focus is end­ing the use of paper records and putting them online so they can be accessed by dif­fer­ent parts of the health sys­tem. When Shau­na McMa­hon became CIO of North Lin­colnshire and Goole NHS Foun­da­tion Trust, one of her first inno­va­tions was the intro­duc­tion of dig­i­tal out­pa­tient appoint­ment let­ters. This has reduced the num­ber of missed appoint­ments, while allow­ing the trust to be more respon­sive to dai­ly changes in demand. This means that more patients are seen and less time is wast­ed, help­ing to man­age wait­ing lists. 

But inte­grat­ing IT sys­tems also cre­ates new risks. The NHS is made up of thou­sands of dif­fer­ent enti­ties, from GP prac­tices and phar­ma­cies to hos­pi­tals and dis­tri­b­u­tion cen­tres. In a typ­i­cal day, about 1 mil­lion items are processed by the Elec­tron­ic Pre­scrip­tion Ser­vice, an aver­age of 68,000 appoint­ment book­ings are made via the NHS e‑Referral Ser­vice and 35 mil­lion trans­ac­tions are sent through the NHS Spine, the core infra­struc­ture that allows secure com­mu­ni­ca­tion across health­care IT sys­tems in Eng­land. In addi­tion, it deals with tens of thou­sands of exter­nal sup­pli­ers, each with its own net­works and vul­ner­a­bil­i­ties. 

Unsecure secure network 

Small won­der the NHS has been described as “the most unse­cure secure net­work in the world”, with mil­lions of end­points, lap­tops and con­nect­ed machines that are sim­ply impos­si­ble to safe­guard. As well as try­ing to ensure that all IT sys­tems remain robust, the NHS has tens of thou­sands of phys­i­cal loca­tions to secure, while keep­ing tabs on a work­force of more than 1 mil­lion peo­ple. 

Dur­ing the pan­dem­ic, new sys­tems were cre­at­ed at speed, such as Test and Trace, which added to the com­plex­i­ty. Test and Trace sought sup­port from the UK cyber­se­cu­ri­ty com­pa­ny Risk Ledger to proac­tive­ly man­age sup­ply chain risks. It used Risk Ledger’s secure “social net­work” plat­form, which enables organ­i­sa­tions to con­nect and share risk data secure­ly. Risk Ledger’s client base includes organ­i­sa­tions like Bae Sys­tems, City of Lon­don Police and Asos. 

Haydn Brooks, CEO and co-founder of Risk Ledger, says “cyber­se­cu­ri­ty issues are broad­ly sim­i­lar across all large organ­i­sa­tions. It isn’t just about IT, but also about apps, premis­es and the sup­ply chain. If some­one can break into a build­ing and hack into a com­put­er, it can be just as seri­ous as a cyber attack.”

What sets a health sys­tem like the NHS apart is the com­plex­i­ty of the organ­i­sa­tion, Brooks says. In the NHS, cyber­se­cu­ri­ty risks are mul­ti­plied thou­sands of times over because it is a com­plex net­work of enti­ties, he says.

“I think the NHS has a lot of good CIOs backed by expert teams who do a great job to make NHS sys­tems as secure as pos­si­ble. I’m sure they could do with more mon­ey and resources, but it is a ques­tion of bal­ance between risk and cost, and the need to pri­ori­tise treat­ment and care.” 

This is sup­port­ed by research from Cyber­MDX and Philips, pub­lished in August, which showed that cyber­se­cu­ri­ty invest­ment in hos­pi­tals remained a low pri­or­i­ty in the US, because of the need to increase spend­ing on front­line treat­ment and care. Just 11% of hos­pi­tals said cyber­se­cu­ri­ty was a high pri­or­i­ty. 

The digi­ti­sa­tion agen­da was tur­bocharged by the pan­dem­ic and will con­tin­ue at pace. This requires more advanced dig­i­tal prod­ucts and plat­forms and more sophis­ti­cat­ed use of data and ana­lyt­ics. But it also cre­ates more oppor­tu­ni­ties for cyber attacks to exploit sys­temic vul­ner­a­bil­i­ties. Big chal­lenges lie ahead for health­care CIOs.