While COVID-19 has showcased the healthcare industry's overall resilience, it has also increased its cybersecurity risk with new and emerging threats—particularly around telehealth—according to a new report from SecurityScorecard and DarkOwl.
The rapid adoption and onboarding of telehealth vendors led to a significantly increased digital footprint and attack surface, leaving both provider and patient data at risk, according to the report. The analysts noted that according to a brief from the U.S. Department of Health and Human Services, at the height of the pandemic, the number of telehealth primary care visits increased 350-fold from pre-pandemic levels.
As such, SecurityScorecard and DarkOwl focused the 2020 healthcare report on reviewing the 148 most-used telehealth vendors according to Becker's Hospital Review. The report indicates that telehealth providers have experienced a nearly exponential increase in targeted attacks as popularity skyrocketed, including a 30 percent increase of cybersecurity findings per domain, notably:
- 117 percent increase in IP reputation security alerts
Malware infections—as part of successful phishing attempts and other attack vectors—ultimately cause IP reputation finding issues
- 65 percent increase in patching cadence findings
Patching cadence is the regularity of installing security patches and is often one of the primary security policies that protect data
- 56 percent increase in endpoint security findings
Exploited vulnerabilities in endpoint security enable data theft
- 16 percent increase in application security findings
Patients connect with telehealth providers using web-based applications including structured and unstructured data
- 42 percent increase in FTP issues
FTP is an insecure network protocol that enables information to travel between a client and a server on a network
- 27 percent increase in RDP issues
RDP is a protocol that allows for remote connections, which has seen increased usage since the widespread adoption of remote work
Back in March, the Office for Civil Rights (OCR) announced that it would waive potential penalties for HIPAA violations against providers who serve patients through everyday communications technologies during the COVID-19 public health emergency. According to OCR, “This exercise of discretion applies to widely available communications apps, such as FaceTime or Skype, when used in good faith for any telehealth treatment or diagnostic purpose, regardless of whether the telehealth service is directly related to COVID-19.”
At the same time, DarkOwl's research showed a noticeable increase in mentions of major healthcare and telehealth companies across the dark web since February 2020. There was evidence of prolific and emerging threat actors selling electronic patient healthcare data, malware toolkits that specifically target telehealth technologies, and strains of ransomware that are uniquely configured to take down healthcare IT infrastructure, the company stated.
Over the past four years, SecurityScorecard has reported on the cybersecurity struggles the healthcare industry faces. In this year's report, SecurityScorecard and DarkOwl looked at over one million organizations—more than 30,000 in healthcare alone—from September 2019 to April 2020 and analyzed terabytes of information to assess risk across 10 factors.
The healthcare industry, despite new risks from telehealth vendors, slightly improved its security posture compared to 2019. The industry moved to 9th place out of 18 reviewed industries (up from 10th in 2019.) “This is heartening, especially as the industry has been overwhelmed by an influx of patients, limited resources, rationing, and other challenges due to COVID-19,” researchers stated.
"While telehealth is an integral part of maintaining social distancing and providing patient care, it has also increased healthcare providers' digital footprint and attack surface, which we see with the increase of findings per telehealth domain, and in factors like endpoint security," said Sam Kassoumeh, COO and co-founder of SecurityScorecard. "It's an indicator that healthcare organizations should continue to keep a focus on cyber resilience."
