Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint //

Privacy

Fixing Hacks Has Deadly Impact on Hospitals

A study from Vanderbilt University shows that remediating data breaches has a very real impact on mortality rates at hospitals.

Breaches of private information in hospital records are serious and expensive security events but remediating them can be deadly. That's the conclusion of a study presented last week at the 4A Security and Compliance Conference.

The data shows that the type and scale of a breach don't have an impact on patient outcomes but that breaches do have an effect, and it appears to come from the hospital's response rather than the attack itself. The effect is serious: mortality rates go up significantly.

Dr. Sung Choi, a post-doctoral fellow at Vanderbilt University, says that the study looked at a common metric available to researchers: the 30-day mortality rate from AMI (acute myocardial infarction), which is basically how many people who come through the hospital door because of a heart attack are still alive 30 days later.

They chose that number because it's commonly collected and frequently used by researchers and allows different factors to be compared in their impact on this metric, and it allows different facilities to be compared on a similar metric.

The 30-day mortality rate also allows for tracking a hospital's performance through time, and that's where this study gets very interesting.

The general 30-day mortality rate has been falling at a fairly consistent rate for at least the last five years, which is good news. But, according to the study, "The .34 to.45 percentage point increase in 30-day AMI mortality rate after a breach was comparable to undoing a year’s worth of improvement in mortality rate." 

Behind the Bad Number

There are two key findings in the study's working paper that are surprising from a computer security perspective. "The association between data breaches and AMI mortality rate did not differ significantly by the magnitude of the breach," the paper said. So the outcome wasn't significantly different whether there were 1,000 records hit or 500,000.

The second key finding contains an important caveat. According to the paper, "The relation between breaches and AMI mortality did not differ significantly by the type of breach." The caveat is the timing of the study's data; the last year included was 2015, before ransomware became a major malware issue.

Choi says this appears to point in the direction of a cause for the worsening mortality rate. "It's not the immediate effect of the breach but what happens afterward that has such an impact on the patients," he says. And the research paper begins to explore why that is so: "...regardless of the source the resulting discovery and mitigation of a breach can be viewed as a random shock to a hospital's care-delivery system."

(Lack of) Speed Kills

Healthcare IT systems may show that shock in slower and more disruptive change than those in other industryies because they start from a relatively weakened position security-wise. "For the most part the healthcare industry, and especially the providers, has been a laggard  for information security," says Larry Ponemon, founder and chairman of the Ponemon Institute.

When hospitals respond to a breach, the response tends to have a major impact on their legitimate users. According to Choi's research, "new access and authentication procedures, new protocols, new software after any breach incident is likely to disrupt clinicians."

That disruption is where the patient is affected, through inaccurate or delayed information reaching the people caring for them. And how much, in blunt terms, can that effect be? The study says an additional 34- to 45 deaths per 1,000 heart attack discharges every year.

Good and Bad on the Horizon

Choi says that hospitals should be careful to focus changes in their security processes, procedures, and technology to improve both data security and patient outcomes.

Ponemon sees healthcare organizations starting to improve in security. "We do see healthcare organizations starting to take care of security and rising to the next level of security. I think the public demands it," he says.

Two factors contribute to the improvement across the industry, he says. The first is the simple acknowledgement that doctors and hospitals are targets - an acknowledgement that was a long time coming. The next is the march of technology. "There are technologies that healthcare can now afford because they're available in the cloud and it provides the opportunities for healthcare security to improve," Ponemon says.

The improved security may come just in time to have an impact on a looming area of security concern: The medical IoT. "There's a universe of devices, many of which are implanted and many can be communicated with through WiFI or Bluetooth," Ponemon says. "Right now, the providers are looking at records but the devices are really an area of huge concern."

Related Content:

Interop ITX 2018

Join Dark Reading LIVE for two cybersecurity summits at Interop ITX. Learn from the industry’s most knowledgeable IT security experts. Check out the security track here. Register with Promo Code DR200 and save $200.

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/14/2020
Lock-Pickers Face an Uncertain Future Online
Seth Rosenblatt, Contributing Writer,  8/10/2020
Hacking It as a CISO: Advice for Security Leadership
Kelly Sheridan, Staff Editor, Dark Reading,  8/10/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 New Cybersecurity Vulnerabilities That Could Put Your Enterprise at Risk
In this Dark Reading Tech Digest, we look at the ways security researchers and ethical hackers find critical vulnerabilities and offer insights into how you can fix them before attackers can exploit them.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-8033
PUBLISHED: 2020-08-14
In Textpattern 4.5.7, the password-reset feature does not securely tether a hash to a user account.
CVE-2020-15692
PUBLISHED: 2020-08-14
In Nim 1.2.4, the standard library browsers mishandles the URL argument to browsers.openDefaultBrowser. This argument can be a local file path that will be opened in the default explorer. An attacker can pass one argument to the underlying open command to execute arbitrary registered system commands...
CVE-2020-15693
PUBLISHED: 2020-08-14
In Nim 1.2.4, the standard library httpClient is vulnerable to a CR-LF injection in the target URL. An injection is possible if the attacker controls any part of the URL provided in a call (such as httpClient.get or httpClient.post), the User-Agent header value, or custom HTTP header names or values...
CVE-2020-15694
PUBLISHED: 2020-08-14
In Nim 1.2.4, the standard library httpClient fails to properly validate the server response. For example, httpClient.get().contentLength() does not raise any error if a malicious server provides a negative Content-Length.
CVE-2015-8032
PUBLISHED: 2020-08-14
In Textpattern 4.5.7, an unprivileged author can change an article's markup setting.