A variety of market, societal and economic challenges in recent years have made it harder for healthcare organizations, big and small, to maintain a thriving, profitable practice. To shore up the business and allow the continued treatment of patients, many Healthcare Delivery Organizations (HDOs) have signed agreements to be acquired by private equity firms. Private equity’s investment in healthcare has rapidly increased over the last few years, particularly in the acquisition of physician practices, senior living facilities, and dental practices. In fact, 2022 was the second biggest year on record for healthcare private equity deals in the U.S.
Healthcare is an attractive industry for private equity because, as stated at the 2022 AMA Annual Meeting, there is an opportunity to get their money back in roughly five to seven years, historically at a 20 to 30 percent profit, while at the same time reducing spending and waste in healthcare.
Unfortunately, this trend is also attractive to bad actors on the hunt for highly sensitive medical data and Protected Personally Identifiable Information (Protected PII) information. HDOs of all sizes are particularly vulnerable and targeted by cyberattacks because they possess a tremendous amount of information of high monetary and intelligence value to cyber thieves and nation-state actors. For cybercriminals, stealing patient data is the big win – one record can elicit up to $250 on the Dark Web, approximately 50x more than the next best stolen data, credit and debit card numbers. The ransom demand is also higher at $4.5M on average because the adversaries know that patient lives are at stake.
Further, cybercriminals are known to track HDOs that receive PE funding, because they know these companies now have more capital, and that many of these companies may not have sophisticated IT and cybersecurity solutions to prevent or detect an attack. Private equity firms are known for their financial expertise, but not necessarily for their experience in healthcare information security and may not have adequate experience or resources to manage complex healthcare regulations under HIPAA rules.
The number of individuals affected by healthcare attacks has tripled in just three years, according to breach data reported to the U.S. Department of Health and Human Services (HHS) by healthcare organizations. These attacks can take a healthcare facility off-line, leading to the disruption of care, resulting in longer lengths of stays in hospital and delays in procedures and tests. When cyberattacks happen to a healthcare provider, the cost – financial, reputational and patient mortality – can be astronomical. For example:
IBM’s Cost of a Data Breach Report 2021 revealed that, “healthcare organizations experienced the highest average cost of a data breach, for the eleventh year in a row” and that those costs have risen 29.5 percent from 2020 to an average of $9.23 million USD.
In October 2021, an alleged attack by the Conti ransomware group, described as “the worst in Canadian history,” forced the Newfoundland and Labrador healthcare system to cancel thousands of appointments and procedures.The same gang of cybercriminals has targeted approximately 290 healthcare organizations in the U.S since mid-May 2021.
West Virginia-based Mon Health reported a breach during the same time period to the U.S. Department of Health and Human Services’ Office of Civil Rights saying that 398,164 people had been affected.
Earlier in 2021, Texas ENT, which operates several locations in the state, reported a major breach that affected 535,489 individuals’ personal information.
On December 18, 2022, cybercriminals hit The Hospital for Sick Children (SickKids) in Toronto. This ransomware incident impacted several network systems, resulting in SickKids calling a Code Grey — a system failure — that lasted for weeks while the hospital rebuilt its systems.
The fact that healthcare organizations utilize multiple software platforms for patient records, booking tools, payment systems, and more makes them even more vulnerable due to multiple points of entry. Threat actors are adept at bypassing traditional defenses like firewalls and antivirus systems, often remaining undetected within the environment for days or weeks before ‘detonating’ a ransomware attack or disabling services. Additionally, in recent years, healthcare organizations have even fallen prey to a new trend of double-extortion and triple-extortion ransomware attacks. In a double-extortion, the cyberattackers exfiltrate data and threaten to sell it unless they’re paid a higher ransom. In a triple-extortion, the cyberattackers threaten to launch a distributed denial-of-service (DDoS) attack that could further disrupt healthcare services.
To mitigate these risks, it is important for PE firms and the HDOs being acquired to prioritize cybersecurity when executing a deal. This involves conducting thorough cybersecurity assessments, implementing effective security protocols and systems, and providing ongoing training and education for employees.
The first step in managing cyber risk in today’s threat environment is to adopt the mindset that cybersecurity isn’t an IT problem to solve—it’s a business (and patient outcome) risk to manage. Adopting a risk-based approach to cybersecurity includes:
Phishing and Security Awareness Training to level-up employees’ understanding of the most common tactics, techniques, and procedures that attackers use.
A comprehensive vulnerability management program that includes three elements: awareness of the cyber threat landscape (e.g., from advisories, notifications, cyber news, etc.); vulnerability scanning to understand your attack surface and blast radius, including ‘discovering’ systems that are inadvertently exposed; and disciplined patch management.
24×7 Managed Detection and Response (MDR) to identify when a threat actor has bypassed traditional defenses and respond rapidly to contain it before they can achieve their objectives to limit the scope of the breach and prevent business disruption.
Having a Digital Forensics and Incident Response provider on retainer to provide guidance with incident response plans and post-incident expertise.
By prioritizing cybersecurity in their acquisition strategies and investing in appropriate technology and training, private equity firms can better safeguard both their investment and medical records, demonstrating commitment to patient privacy and security. Implementing a risk-based approach and partnering with a reputable MDR firm will greatly diminish the impact a cyberattack has on a healthcare system, keeping both patients and the business itself safer.