8 things every physician must know to stop cyberattacks

The U.S. Department of Health and Human Services received more than 700 reports of compromised health care data in 2021 that involved more than 45 million patient records, with about 75% of these breaches linked to cybercriminals.

Criminals value medical records because of the amount of exploitable financial and personal information they contain and the growing potential that exists to use the data in a wide variety of fraud schemes.

An eight-part AMA video series explains how cyberattacks happen, the impact they can have on health systems and physician practices, and why cybersecurity is a patient-safety issue. The eight video CME modules are enduring material and designated by the AMA for a maximum of 0.25 AMA PRA Category 1 Credit™️ each. 

1. Cyber safety is patient safety

   1. While a practice, hospital or system may have a dedicated IT staff whose duties include maintaining cybersecurity, every day physicians send and receive emails about their patients, enter prescription information and treatment details into the EHR, connect patients to devices either in-person or remotely, send or receive digital images, or handle insurance information and process payments. All that activity makes health care systems vulnerable to cyberattacks.
   2. Find out how cybercriminals use malicious software to encrypt or scramble important data such as patient records, appointment schedules, and payment and diagnostic systems, and then demand a payment—or ransom—to restore the information and clinical and administrative operations along with it.

2. Why health care is critical infrastructure 

   1. HIPAA requires certain technical and physical controls to protect the security of patient data. But regulations can’t keep up with constantly evolving threats—especially those that come from sophisticated adversaries such as other countries and governments. Learn why the federal government views health care as a critical infrastructure, and protecting it is seen as a key national security priority—just like access to electricity, water, fuel and communications.

3. The costs of a cyberattack can be massive

   1. Financial costs are still being added up from a 2020 cyberattack on a major health system that operates almost 400 facilities including acute-care hospitals, behavioral health centers and outpatient service locations. The attack resulted in $67 million in pre-tax losses due to related expenses and loss of services. Total losses are expected to exceed $113 million.
   2. Find out how financial losses and negative impacts on patient care can result from cyberattacks and lead to damaged reputation, lost patient trust, lawsuits, regulatory penalties, reduced stock value, strained employee morale and burnout.

4. How cybercriminals do it

   1. Malicious hackers often break into systems simply by nicely asking to be let in and finding a willing person who’s happy to oblige. Cyber criminals use social engineering techniques to deceive people into divulging personal information. These include phishing emails that ask you to download harmless-looking attachments or click on an innocent-appearing link that leads to the downloading of dangerous malware.

5. Millions of medical devices are at risk

   1. There are an estimated 930,000 staffed hospital beds across the U.S. that are connected to some 14 million medical devices. Because threats are constantly evolving, security practices can have difficulty keeping up. Learn about three other key points that make these connections vulnerable to cyber criminals.

6. These tips are essential to protecting your patients’ data

   1. Health care is a team sport, and cybersecurity is no exception. That is why physicians and other health professionals in your organization should take annual cybersecurity training sessions seriously and develop vigilance and awareness of phishing tactics to avoid falling for them. Learn about these topics and four other tips to keep your health care data safe from cybercriminals.

7. What you should do after a health care cyberattack

   1. Physician practices and other health care organizations need to develop contingency plans so that they don’t need to make snap decisions after a cyberattack. This includes developing and testing plans to continue caring for patients if medical devices don’t work or if EHR, schedule or laboratory data can’t be accessed.

8. Why physicians are the first line of defense

   1. Learn about why physicians and other health professionals should consider themselves the first line of defense against cyberattacks that target health care. Physicians also will learn why practicing good cybersecurity hygiene is important for good clinical practice.

These modules are part of the AMA Ed Hub™️, an online learning platform that brings together high-quality CME, maintenance of certification, and educational content from trusted sources with automated credit tracking, and reporting for some states and specialty boards. 

Learn about AMA CME accreditation.

The AMA also has physician cybersecurity resources and has more detailed tips for physicians and health care staff to protect patient health records and other data from cyberattacks.