Change Healthcare Cyberattack: Impact and Lessons for Healthcare Cybersecurity

A recent cybersecurity panel highlighted the significant challenges faced by healthcare systems in the wake of the Change Healthcare cyberattack, which affected 100 million Americans. This attack underscored the vulnerabilities in the healthcare sector, particularly when dealing with widely used third-party vendors.

Healthcare leaders emphasized the need for robust cybersecurity measures, given the complex nature of healthcare systems. According to experts like Zoller, who has experience in the defense and financial sectors, the healthcare sector is one of the most difficult to defend due to its high reliance on third parties and the complexities of care delivery. The panel stressed the importance of adhering to basic cybersecurity practices, which can thwart the majority of attacks.

The attack on Change Healthcare also brought to light the issue of nation-state-backed ransomware groups. Riggi noted that Russia provides safe harbor for many of these groups, which are actively targeting U.S. hospitals and health systems. This highlights the need for timely updates from the government on the latest threats and for greater cooperation among healthcare organizations to share threat intelligence.

Health systems are advised to develop resiliency procedures to ensure they can deliver safe and quality patient care even without the benefit of technology. This includes training staff on response plans, especially younger clinicians who have worked primarily in a digital environment. The ability to manually process tasks and run operations without technology is crucial in the event of a cyberattack.

The importance of collaboration among healthcare organizations was also emphasized. Kim suggested that hospitals and health systems need to have regular discussions about the threats they are seeing and alert others in their region about potential problems. This collective approach is seen as vital for national security and the welfare of patients).