Chris Mazzolini

In a recent interview, Peter A. Halprin, Esq., discussed the threat of ransomware in healthcare and the steps medical practices should take to protect themselves. Halprin is a partner in Pasich LLP’s New York office who specializes in complex insurance coverage matters in relation to cybercrime.

How big of a problem is ransomware in health care?

It is a massive problem. We’re talking about billions of dollars in impacts. And I think the average cost of a breach tends to be around $2 million, with about 10% of that being ransomware payments, and the rest being recovery. As I said, the numbers are going up and up and up. So any number I’d give you is already stale. Unfortunately, the trend is only going to continue.

I think health care is a particularly risky sector in this regard for two reasons. One is there is lots of personal information. So data-rich target, if you will, and then the flip side being you’ve got a lot of proprietary systems, you’ve got a lot of older systems that haven’t been updated, don’t get regularly updated. I think in some ways, doctors, like lawyers — they’re focused on their craft. And they’re not necessarily focused on these other things, assuming, Why would anyone do this? Why would anyone target a medical facility or doctor’s office or anything else? And the answer is you’re a target-rich environment and (cybersecurity is) not a priority. So I think health care has continued to be a particularly fertile source for ransomware actors.

How has the COVID-19 pandemic affected cybersecurity?

Negatively, for sure. I think that the bad guys have taken advantage of people working from home, people being distracted. It’s very hard to stay focused on your tasks. All of a sudden, you get an email that comes in and it looks very convincing. And I’m telling you, the bad guys are bad. For example, people were getting emails in March of 2020 talking about the cure for COVID-19, or the email looked like it was coming from the World Health Organization or the CDC. So they took advantage of that. Cyber hygiene was definitely down.

I think the other side of it is that the bad actors are targeting specifically vulnerable institutions and organizations. So we saw attacks on vaccine research centers, hospitals, doctor’s offices. For those vulnerable sectors, part of their vulnerability is that it is a matter of life and death. The bad actors take advantage of that vulnerability.

I’m hesitant to say that it’s inevitable because I don’t want people to just throw their hands up, so I don’t love the word. But it is highly, highly probable that there will be an attack or there will be some form of cyber incident or cybercrime involving a health care institution.

So the question is, knowing that there’s that high probability, how do you address that? You really want to beef up your security, what I call cyber hygiene. It’s protecting your business, it’s making sure that people don’t click those bad links, it’s making sure that you clearly identify when an email comes from an outside source, it’s making sure that sensitive areas in a business are closed off so that people can’t penetrate security.

The second instance can come in the form of limiting access. If someone’s able to access your account, then they can get no further than what you can access. It’s that kind of internal security.

Yes, the third layer is cyber insurance. So you get insurance for when things go wrong. This is the same kind of product. Once you have that in place, remember, it’s not a fail-safe; it’s not a defensive system. That’s why I say it’s the third and final resort. But it offers two things. It offers bottom-line protection: Let’s say you have $10 million worth of coverage, and then the bad thing happens. You know that you can be restored up to the $10 million that hit your bottom line.

The other thing that cyber insurance often entails is breach response services. So they can help you build out a program to protect yourself when something happens. They can provide you with vendors, they can provide you with legal counsel, they can provide you with public relations experts, and so they can help build that suite of services around you and your business that are needed to deal with an incident.

Now, most businesses have their own cybersecurity plans and their own incident response plans. One of the biggest flaws that I see in incident response planning is that a company will have its own incident response plan, and then it will also have these cyber insurance resources, but they won’t be integrated. And so the problem there is if you use your own people, and you don’t get consent to use them, the insurance company might say, Hey, we’re not paying for that. So the best thing that you can do is work to get insurance involved on the front end working to make sure the insurance company signed off on the plan so that seamlessly integrates. So when something bad happens, you can bring all those resources to bear.

Should health care organizations ever pay the ransom?

This is probably one of the trickiest moral and ethical dilemmas for businesses. As a lawyer, I can’t advise anyone to break the law. And if you speak to law enforcement, the overwhelming suggestion is don’t pay. The reason they don’t want you to pay is they don’t want the criminals to be incentivized to continue doing what they’re doing. There are also sometimes actors that are on the sanctions list, right? They’re people that we as a country do not permit our citizens to engage with. So there are a lot of considerations as to why it’s not a good idea to pay.

One other consideration about not paying is sometimes you pay and the actor stays in your system and continues to extort. So you’re not even promised that you’ll get free and clear access from paying. And then even the worst part is, you could get free and clear access, but everything’s corrupted now that they’ve left. And so you get very little for what you pay. Those are all the reasons not to.

But what I think businesses often do practically, especially those in the health care space, is they just pay. I can’t give you a number or a statistic. But overwhelmingly when clients are hiring me and they’re fighting with their insurer; oftentimes it’s because they want to get the insurer to cover the ransom. And I would say if you have a cyber policy that covers ransomware, insurers are amenable to you making those payments and to reimbursing those payments.

Something we often hear from physicians at small or solo practices is they don’t believe they are really being targeted. How true is that?

It’s not true at all. It’s more kind of a buckshot and goes in a lot of different directions. I don’t think (hackers) are necessarily saying, I want to hit small practices in the Midwest, but it may necessarily end up being that way. There are targeted attacks, for sure, which do end up hitting the larger organizations, but I think that for the smaller medical practices, it’s not necessarily because they picked you. It was more that you happen to have a vulnerability that’s not patched.

Is there anything else that’s important for physicians to know about the subject that we haven’t discussed?

Just to take this seriously. Some of the questions that physicians have: If I’m going to get hit with this anyway, what’s the point? Why bother? I think the answer is you still want to be prepared. And you still want to take precautions. Because if you’re too nonchalant about it, it could end your business.

Articles

Ransomware has never been a more serious threat for health care organizations, even small medical practices. 

Expert insight on ransomware: Is your practice prepared?

Not having policies in place to regulate artificial intelligence (AI) and machine learning (ML) could have dire consequences across every sector of the health care industry.

That was the point made by Brian Scarpelli and Sebastian Holst during their presentation titled “A modest proposal for AI regulation in healthcare,” held during the HIMSS22 Global Health Conference in Orlando. Scarpelli is the senior global policy counsel for the Connected Health Initiative and Holst is principal with Qi-fense, a consulting group that works in AI and ML.

“ML properties do more than challenge domain-specific applications of technology,” Scarpelli and Holst write. “Many of these properties will force an evaluation and retooling of core manufacturing, quality, and risk frameworks that have effectively served as the foundation of today’s industry-specific regulations and policies.”

Here’s some key points from their presentation on the growth of AI/ML and the need for regulation.

AI can potentially revolutionize health care in all facets. It can reduce administrative burdens for providers and payer and allow for resources to be deployed within a health system to serve vulnerable patient populations. It can manage public health emergencies such as the COVID-19 pandemic and help improve both preventive care and diagnostic efficiency.

2. Machine learning is a rapidly growing industry.

According to Scarpelli and Holst, the growth in machine learning products has surged since 2015, starting first with processing applications, including products for processing radiological images, and has since progressed into diagnosis applications, particularly also in the radiological space to assist with triage and prioritization.

The number of patents coded to machine learning and health informatics has exploded, from 165 in 2017 to more than 1,100 in 2021.

While AI is promising, there are potential legal and ethical challenges that must be addressed. For example, one of the major themes of the HIMSS22 conference has been the challenge of achieving health equity and eliminating implicit bias. That’s one of the major challenges of AI as well since AI solutions can be biased. Many sessions focused on how diverse teams are needed when creating AI solutions to ensure that the programs don’t carry the same biases as society, which could exacerbate current social problems, according to Tania M. Martin-Mercado, MS, MPH, a clinical researcher who presented on “How implicit bias affects AI in healthcare.”

During her presentation, she pointed to an example of “an online tool that estimates risk of breast cancer calculates a lower risk for Black or Latinx women than White even when every other risk factor is identical.”

A diverse group of health agencies, including the FDA, HHS, CMS, FTC, and the World Health Organization, are developing regulations and asking from guidance from various stakeholders, including AI developers, physicians and other providers, patients, medical societies, and academic institutions.

Scarpelli says that the vision for successful AI follows four principals. It should:

Empower patients to manage their own health.

Strengthen the relationship patients have with their health care teams.

Reduce administrative and cognitive burdens for both physicians and patients.

This article originally appeared on the website 

While AI is promising, there are potential legal and ethical challenges that must be addressed, according to the experts. 

Chris Mazzolini

Articles

Expert insight on ransomware: Is your practice prepared?

Policy experts stress the need to regulate artificial intelligence in health care