Our health-care data is at risk

The verdict is out on Canada’s largest cyberattack: Newfoundland’s health-care system was attacked by the international Hive ransomware gang.

Hive stole the personal health information of 60,000 Newfoundlanders and deployed ransomware that toppled the province’s healthcare operations, costing the province $16 million.

While Hive may have been shut down by the FBI this January, the threat to Canadians remains the same. The cybersecurity gains to prevent another Newfoundland have been insufficient, and the protection of patients’ digital data is critical to protecting their physical health.

Cybercriminals threaten the health of patients when trying to gain access to medical records that now live in a range of digitally-enabled health-care tools and devices. Without robust security measures, they’re wide open for cybercriminals to compromise, harming the reputation, finances or well-being of patients. Moreover, many of the tactics used by hackers — like ransomware — can disable the devices that health-care workers rely on to provide care.

Unfortunately, cybercrime is a business. Health-care data is more valuable to cybercriminals than financial data and social insurance numbers, with electronic health records selling for about 10 times more than credit card information and 100 times more than social security numbers on the dark web.

Canada’s digital health care transformation is underway, with publicly funded health care institutions relying more on virtual care options, internet-enabled medical technology, and third-party platforms for sharing information like test results with patients and other health-care professionals.

The digital transformation of health-care institutions has created more attack vectors through which cybercriminals can disseminate harmful malware and cyber threats that result in the violation and loss of patient data and the disruption of essential operations.

On the one hand, care technologies in hospitals are unique from regular internet technology. While it’s easy to download or update software on a computer that is less than a few years old, MRIs and other large care devices have life cycles up to decades-long. Their ability to “keep up” with the changing technological and cyber-threat landscape is low, and that only adds to their vulnerability.

On the other, private apps and technologies leveraging healthcare data reinforce the exponentially growing threat landscape. As people demand more at-home care, the patient-centric approach has introduced new, private players to the health-care space who operate health, wellness and fitness apps, cloud-enabled technology, biometric data services, artificial intelligence for predictive care, and more.

While these technologies are rapidly changing, they also open the supply chain of organizations that will interact with your data — necessitating security throughout the entire supply chain.

The growing reliance on digital platforms for health services creates significant cyber vulnerabilities in a vicious circle: it increases the volume of valuable health data that attracts cybercriminals and widens the threat landscape and its attack vectors.

This trend is even more complicated when the negative consequences of a cyberattack can leave irreversible and fatal damage to human health. Without balancing strong privacy and security protections for all actors in the Canadian digital health system, the frequency and severity of data breaches and cyberattacks on health care institutions only grow.

It’s incumbent on leaders in the health care and technology space to prioritize security alongside the expansion of digital care. This includes dedicated funding for health care IT shops, as limited resources have moved cybersecurity to the bottom of the priority list at a significant cost. As the recently announced 10-year federal-provincial health care funding deal takes shape, protections for patients’ data must be top-of-mind.

But responsibility for cybersecurity doesn’t begin and end with the IT team; all staff are responsible, and senior leaders are liable — ethically and legally.

Health-care professionals must treat patients’ data with the care they treat their patients’ health — having regular cybersecurity awareness training and implementing low-cost, easy-to-deploy solutions are a good place to start.

Personal data is inseparably linked to Canadians’ physical health. As the digital health system expands, it’s up to all actors at the intersection of health care and technology to prioritize privacy and security. We can’t afford another Newfoundland-scale attack.