Survey Highlights Ongoing Healthcare Cybersecurity Challenges
The healthcare industry continues to experience high numbers of cyberattacks and data breaches and healthcare organizations have responded by strengthening their cybersecurity programs, but they continue to face significant challenges, the biggest of which is a lack of cybersecurity staff. That was cited as the main barrier to robust cybersecurity by 61% of respondents to the 2022 HIMSS Healthcare Cybersecurity Survey of healthcare cybersecurity professionals responsible for day-to-day operations or oversight of healthcare cybersecurity programs.
The biggest problem is hiring talent. There is a global shortage of cybersecurity professionals, and with the demand for staff high, qualified cybersecurity professionals can afford to pick and choose employers carefully. Almost 84% of respondents said they struggle to attract skilled staff. Unsurprisingly, given the high demand for staff, an insufficient budget for hiring staff was a problem for 55% of respondents, with non-competitive compensation cited as a problem for 43% of respondents.
When skilled cybersecurity professionals are hired, retention is a problem. Almost 67% of respondents said retaining qualified cybersecurity professionals is a problem, which is unsurprising given that cybersecurity professionals are such a precious commodity. The survey revealed that there is a lack of training for cybersecurity staff to keep them up to date on the latest threats, with 61% of respondents saying there simply isn’t time to provide ongoing cybersecurity training. 42% of respondents said employers didn’t subsidize the cost (22%) or did not subsidize the cost enough (20%). Worryingly, given the extent to which phishing is used in healthcare cyberattacks, only 89% of cybersecurity professionals are provided with training on the detection and mitigation of phishing attacks, and only 47% are trained on how to detect and mitigate insider threats.
Cybersecurity is not just about the IT department, in fact, that is one of the biggest cybersecurity myths that needs busting. Everyone has a role to play in the cybersecurity of their organization, yet the data suggest that training for the workforce is nowhere near comprehensive enough. 91.8% of respondents said security awareness training is provided to information technology staff, but only 69% said security awareness training is provided to clinicians, and the figure fell to just 44% for contractors, and 29% for vendors.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Aside from staffing difficulties, a lack of budget is hampering cybersecurity improvements for 51% of respondents, and the problem is deepening. Only 51% of respondents said they got a cybersecurity budget increase from 2021 to 2022, with almost 7% seeing their budget decline. While there are healthcare organizations that devote around 10% of their IT budget to cybersecurity, typically only 6% or less of the IT budget goes on cybersecurity.
Other key barriers to robust cybersecurity were a lack of a data inventory showing the data held and where it is located (45%), a lack of data classification (38%), a lack of cooperation with other people in the organization (31%), policies and procedures do not reflect current practices (31%), and a lack of executive buy-in (23%).
One of the biggest security wins when it comes to phishing defense is implementing phishing-resistant multi-factor authentication (passwordless), yet despite the calls from CISA to implement phishing-resistant multi-factor authentication, only 9.4% of respondents who had implemented some form of multi-factor authentication used this gold standard. 57% of respondents were still reliant on basic single-factor authentication.
While the survey suggests improvements are being made to cybersecurity at healthcare organizations in response to the high threat level, there are still many challenges to overcome and while the problem of recruitment is unlikely to be resolved in the near future, healthcare organizations could do more and provide the cybersecurity staff they have with more support.
