#211 $1.3 Million and 18 Days: What a Cyberattack Actually Costs an Independent Practice

Resources 

• Cybersecurity Incident Response Checklist: https://eligibility.natrevmd.com/natrevmd-cybersecurity-checklist 
• natrevmd.com 
• Trusted Resources: https://natrevmd.com/trusted-resources/ 

A healthcare record sells for 10 to 40 times more than a credit card number on criminal markets, and it cannot be cancelled the way a card can. Independent practices hold that data with the least defense in the entire healthcare system: one IT contractor, a server in a closet, and no one whose job it is to think about security. Attackers know it. 

Why independent practices are the target 

Three attack vectors specific to practice settings:  

Phishing emails that look like they are from an EMR vendor, billing company, or payer. Remote access set up for telehealth or post-COVID flexibility that was never properly secured. Third-party vendor access, where a billing company or IT contractor gets breached and the practice is compromised through them. 

What to do in the first 24 hours if you are hit 

1.  Isolate immediately. Disconnect affected systems from the network, but do not power them down, powered systems preserve evidence forensic teams need. 

2.  Call your cyber insurance carrier first, then your attorney. Do not call the attackers, and do not pay anything without guidance. 

3.  Document everything from the moment you discover the breach. This becomes the foundation of your HIPAA breach report if one is required, and the 60-day notification clock starts at discovery. 

4.  Do not restore from backup until forensics has cleared the system. Restoring too early can reintroduce the attack. 

Three asks for your team this week 

• Ask your IT contractor: do we have multi-factor authentication enabled on our EMR, our email, and our remote access tools? If not, when can you turn it on? 
• Ask your IT contractor: when was the last time we tested a restore from our backup? Can you run a test this month? 
• Call your business insurance broker: do we have cyber liability coverage? If not, what would it cost to add it? 

Episode breakdown 

• Why independent practices are the target 
• Three attack vectors specific to practice settings 
• Five things most practices are not doing 
• What to do in the first 24 hours if hit 
• Three asks for your team this week 

Transcript

Copy Transcript Copied

SPEAKER_00 0:00

So, what would you do with 18 days of downtime and then an IT bill in the tens of thousands of dollars? Some would want to cry, and I certainly don't blame them. We recently saw a practice Living This Nightmare after a cyber attack, and while they handled it beautifully, we wanted to spend some time diving down into the details with experts to make sure that our own plan was ready for implementation. So today we're going to share steps of how to manage a cyber attack so that you have the time to prepare. And just in case anything ever happens to you or your practice, you know what to do. So last year, and I was shocked to hear this, the average ransom demand in a healthcare cyber attack was $1.3 million. And like I said, the average practice could have up to 18 days of downtime. Now that's 18 days of no patients being seen, claims going out, revenue coming in, staff locked out of their own records, patients turned away. And obviously, it's really important to have an IT team that is ready to manage these things. But you want to make sure that you at least understand the general steps so that you can act fast, which is the best thing that you can do in this scenario. The practice that we experienced doing this, they acted fast. They had an IT team. And while it was extremely stressful for everybody involved, they had a plan and they executed on that plan. So today we're going to get into why independent practices are an attractive target in healthcare. And then five things that you can do this month to make sure that you are harder to hit, but also prepared should that happen to you. All right, first, why are independent practices even the target? I asked this question myself because we all know that healthcare is a, you know, one of the most attacked sectors in the country. And having lived the world of a large healthcare company and having also been through the change healthcare scenario a couple of years ago, we all know that these things happen. Now, obviously, a healthcare record is something that has a lot of detail behind it. It is something that we learned could sell for up to 10 to 40 times more than a credit card number on certain criminal markets. So basically, you can credit cancel a credit card in 24 hours. But basically, the detailed information that you can get from a health record, so social security number, date of birth, insurance ID, diagnosis information, address, I mean, it's a lot of really, really important information that is valuable for a very long time. So attackers really aren't after the billing data. They're after everything that goes around the identity of a patient. And that's the stuff that people are going after. Now, of course, large healthcare systems, bigger institutions are going to have more targets than, say, a smaller independent practice. But that large hospital system may have dedicated security teams, enterprise firewalls, intrusion detections, a whole team of individuals that help manage that. But most independent practices, even larger ones like we serve, don't typically have a massive team behind you. Now, they do typically have some level of IT support, whether that's an IT contractor or a vendor who helps set up the system, maybe, you know, taking care of a server and really, you know, helping support the practice on an occasional basis, but they're typically not there on a day-to-day basis. And attackers know this. So they talk target those smaller practices on purpose because the defense is weaker and it's easier to get through. So what does this actually look like? So we're going to talk about the three attack vectors that we see in practice settings. So the first could be a phishing email. And I have seen this myself. So staff member gets something that looks like it's from their, you know, EMR vendor or really any vendor, and it's got a link in there where they have to click and then they have to add their credentials. So that's what it's trying to get after is your credentials. And so it's really important to teach staff about these phishing emails and make sure that if A, don't ever click on something that looks fishy, B, when you are in there, you know, you're looking at the who it's from and not just the name, but actually clicking into the email address to see where the email address is coming from. And obviously, if they if you do click into a link, certainly don't give your credentials into a link or type them in, thinking that you're trying to get access to a medical record or a secure note, but instead they're just looking to get your credentials. The second thing is that they are looking for remote access. So a lot of practices set up remote access for telehealth, for vendors. Maybe your EMR isn't on the cloud and so you have a remote access for that purpose, but maybe it's not locked down properly. Or even if it is locked down properly, there are still ways to get around that. Now, the other thing that attackers will often look for is third-party vendor access. So maybe somebody has access to your network. And if that vendor gets breached, now you're compromised through them. So important that both your practice, but also your vendors are really thinking through how do I protect myself and my clients. Now, here are gonna be the five things that are really, really important to do in order to prevent and reduce your risk. All right, number one, multi-factor auths. Now, these are low cost, sometimes free, and this will stop a lot of breaches when the password is known. And really important, and I know they're annoying because you're looking for a text message, you're looking for an email, or even using the auth app on certain cell phones. But that is an easy, easy thing to do to make sure that your passwords are protective, even if they are found. The other thing is tested off-site backups, which can be fairly inexpensive, but important to have a backup just in case something happens with the data and you need to restore from a backup. Now, most systems with a cloud system and you're using an EMR or PM vendor, you're going to want to ask them, how often is our data backed up and how do we get that should there be a breach in their system? Now, another thing that's really important is annual phishing training for your staff. So this is actually a really high yield thing that you can do for your staff members. So the weakest point is the human who actually clicks in the wrong link and then feeds the attacker their username and password. So really important to have that. Now, next is a written incidence response plan. And this really is something that a lot of AI tools or even some brief conversations with IT teams or compliance officers could help you build a plan around this. This would be a low-cost thing for most practices, even if you hired a consultant to help you put this together. Typically, this should be one or two pages, a couple steps, names and numbers for you to manage. The other thing is cyber liability insurance, which we ourselves also have, and really important to have that in place. You're going to want to have general and malpractice policies as well, but those typically do not cover cybersecurity. So you will want its own policy. And again, we have this as well. And when we recognized what was going on with one of our practices, we also just double-checked all of our processes were in place to make sure that we were also protected. So I'm just sharing some of the tips as we went through this process ourselves. And here's the good news though: none of these require a massive IT department. All of these are simple things that you can do in your practice this month. And, you know, some of these are almost free, like the multi-multi-factor auth, I think is just something that you need to have turned on everywhere, especially where patient data lives. All right, all right. So now we're going to walk through what you should do in the first 24 hours if you are hit with an incident that you need to help manage. So high level, we're going to go through the steps of isolate, call your carrier, right? And obviously, potentially even an IT vendor or an attorney, you're going to want to document everything and then wait for an analysis of what has happened and how you get out of the situation. So the first part isn't really about prevention, right? So this is all about actually what you do once the worst news has happened. So you're going to want to isolate immediately. The moment you suspect a breach or a ransomware, disconnect the affected systems from the network, but don't power them down. Powered down systems actually preserve the evidence. Powered systems, so something that is continued to have power on, actually preserve the evidence a forensic team is actually going to need to identify what happened. And step two is really about calling your cybersecurity insurance carrier. And you are going to want to make sure that they are helping you work with your IT vendor so that you can address any breaches and make the correct steps to get you back online. And typically your cybersecurity insurance carrier can help you with this. And most of them will have a 24-hour breach response line. And then they'll assign you a forensic firm to help you get through the incident yourself. And obviously, always great to have an attorney who has experience with HIPAA so that you can have client privilege and support that investigation should there be a large breach so that you can alert your patients. Now, step three is document everything, starting from the moment you discover the breach, the time of the discovery, what you saw, what you did, and when, because this becomes your foundation of a HIPAA breach report if you need to send one out. And here's the thing the 60-day notification clerks at the discovery, not at the moment the breach actually happened. And the next step is really do not restore from a backup until the forensic team has actually cleared the system. Because if you restore it too early, you might just reintroduce the attack to your new system. So this is exactly why the incident response plan matters and that you have a team of individuals who are on your side. So there are three things you can ask your team for this week. And this is going to help protect you should this ever happen. And again, hopefully this never happens to you. All right. So first thing is ask your IT contractor, do we have multi-factor auth enabled on our EMR, our email, and our remote access tools? If not, how can we get that turned on? So that's number one, safest way. Ask your IT contractor when was last time we tested a restore from our backup? And can you run a test of this this month? And then last, call your business insurance program. Do we have a cybersecurity coverage policy? If not, what would it cost to add one? And then walking through with them the steps that they would want you to take once you get that insurance in order to protect yourself and your business should something happen. And the last, which I do find to be really, really important, is making sure that you do some fishing, security training for your staff. I think these are easy things for everybody to do. And again, things that our team went through just watching our practice go through this themselves. We all just want to protect ourselves and making sure that we're protecting our patients at the end of the day. All right, so we did put together a quick checklist for cybersecurity so that you can bring this to your practice, bring it with your IT vendor and your cybersecurity insurance team so that you can make sure that you yourself have a have an easy mechanism by which to protect yourself, protect your patients' data. So grab that link down in the show notes. And as always, we would love it if you share this podcast episode with others who may be needing some recommendations to make sure that their practice is safe from any cyber attack that happens to them. All right, hopefully, you guys have a great rest of your day.