Black Book’s annual Cybersecurity Survey reveals healthcare enterprises are not maturing fast enough, processes continue underfunded and understaffed
Black Book Market Research surveyed over 2,464 security professionals from 680 provider organizations to identify gaps, vulnerabilities, and deficiencies that persist in keeping hospitals and physicians proverbial sitting ducks for data breaches and cyberattacks. Ninety-six percent of IT professionals agreed with the sentiments that data attackers are outpacing their medical enterprises, holding providers at a disadvantage in responding to vulnerabilities.
A fragmented mix of 410 vendors offering data security services, core products and solutions, software, consulting, and outsourcing received user feedback including large IT companies, mid and small security vendors and start-ups in the polling period Q3 2017 to Q2 2018.
Over 90% of healthcare organizations have experienced a data breach since Q3 2016 and nearly 50% have had more than five data breaches during the same timeframe. Not only has the number of attacks increased, more than 180 million records have been stolen since 2015, affecting about one in every 12 healthcare consumers.
The dramatic rise in successful attacks by both criminal and nation-state-backed hackers illustrates how attractive and vulnerable these healthcare enterprises are to exploitation. Despite these wake-up calls, the provider sector remains exceedingly susceptible to ongoing breaches.
Budget constraints have encumbered the practice of replacing legacy software and devices, leaving enterprises more susceptible to an attack. According to 88% of hospital representatives surveyed, IT security budgets have remained level since 2016. As a percentage of IT organizational budgets, cybersecurity has decreased to about three percent of the total annual IT spend.
Despite the lack of earmarked funds by U.S. buyers, Black Book projects the global healthcare cybersecurity spend to exceed $65 billion cumulatively over the next five years.
A third of hospital executives that purchased cybersecurity solutions between 2016 and 2018 report they did so blindly without much vision or discernment. Ninety-two percent of the data security product or service decisions since 2016 were made at the C level and failed to include any users or affected department managers in the cybersecurity purchasing decision. Only 4% of organizations had a steering committee to evaluate the impact of the cybersecurity investment.
Last year’s Black Book cybersecurity survey revealed 84% of hospitals were operating without a dedicated security executive. As a solution to unsuccessfully recruiting a qualified healthcare chief information security officer, 21% of organizations opted for security outsourcing to partners and consultants or selected security-as-a-service options as a stop-gap measure.
That shortage of healthcare cybersecurity professionals is forcing a rush to acquire services and outsourcing at a pace five times more than cybersecurity products and software solutions. Cybersecurity companies are responding to the labor crunch by offering healthcare providers and hospitals with a growing portfolio of services.
