A variety of market, societal and economic challenges in recent years have made it harder for healthcare organizations, big and small, to maintain a thriving, profitable practice. To shore up the business and allow the continued treatment of patients, many Healthcare Delivery Organizations (HDOs) have signed agreements to be acquired by private equity firms.
Private equity's investment in healthcare has rapidly increased over the last few years, particularly in the acquisition of physician practices, senior living facilities, and dental practices. In fact, 2022 was the second biggest year on record for healthcare private equity deals in the U.S.
Healthcare is an attractive industry for private equity because, as stated at the 2022 AMA Annual Meeting, there’s an opportunity to invest over a horizon of 5-7 years, historically at a 20-30% profit, while reducing spending and waste in healthcare at the same time.
Unfortunately, this trend is also attractive to bad actors on the hunt for highly sensitive medical data, including Protected Personally Identifiable Information (Protected PII) and Protected Health Information (PHI and ePHI). HDOs of all sizes are particularly vulnerable and targeted by cyberattacks because they possess a tremendous amount of information of high monetary and intelligence value to cybercriminals and nation-state actors. The more sensitive the data, the higher the probability threat actors will attack it.
For cybercriminals, stealing patient data stored from all those connected devices is the big win – one record can elicit up to $250 on the Dark Web, approximately 50x more than the next best stolen data, credit, and debit card numbers. Ransomware is a particularly acute problem as ransom demands are also higher at $4.5M on average because the adversaries know that patient lives are at stake.
The number of individuals affected by healthcare attacks has tripled in just three years, according to breach data reported to the U.S. Department of Health and Human Services (HHS) by healthcare organizations. These attacks can take a healthcare facility offline, leading to the disruption of care, resulting in longer lengths of stays in the hospital and delays in procedures and tests.
When cyberattacks happen to a healthcare provider, the cost – financial, reputational, and patient mortality – can be astronomical. For example:
- IBM’s Cost of a Data Breach Report 2023 stated that the healthcare industry reported the highest costs out of all industries for the 13th year in a row. In fact, healthcare data breach costs have increased 53.3% since 2020 to an average of $10.93 million USD.
- In October 2021, an alleged attack by the Conti ransomware group, described as “the worst in Canadian history,” forced the Newfoundland and Labrador healthcare system to cancel thousands of appointments and procedures. The same gang of cybercriminals has targeted approximately 290 healthcare organizations in the U.S. since mid-May 2021.
- West Virginia-based Mon Health reported a breach during the same time period to the U.S. Department of Health and Human Services’ Office of Civil Rights, saying that 398,164 people had been affected.
Moreover, healthcare is a unique business, encompassing hundreds or even thousands of staff at one location, where only a small proportion are IT professionals. Their first priority is the delivery of healthcare so when budgets are tight, the patients get priority (understandably so), not technology.
Plus, most healthcare facilities today have dozens of vendors installing and maintaining technology solutions to improve patient care outcomes and/or the efficiency of the business. With the onset of the Internet of Things (IoT), many healthcare items are networked today, such as insulin pumps, heart monitors, and many more. It should be also noted that the IT departments within healthcare facilities rarely manage the third-party vendor systems themselves.
Cybercriminals are known to track HDOs that receive PE funding for two primary reasons: a) the infusion of capital and b) the fact that many of these companies may not have sophisticated IT and cybersecurity solutions to prevent or detect a cyberattack.
The reality is that while PE firms are known for their financial expertise, many lack the experience in healthcare information security and may not have adequate expertise or resources needed to manage complex healthcare regulations under HIPAA rules.
The fact that healthcare organizations utilize multiple disparate platforms for patient records, booking tools, payment systems, and more (often on a surprisingly “flat” network topology) makes them even more vulnerable due to multiple points of entry. Threat actors are adept at bypassing traditional defenses like firewalls and antivirus systems, often remaining undetected within the environment for days or weeks before ‘detonating’ a ransomware attack or disabling services.
Additionally, in recent years, healthcare organizations have even fallen prey to a new trend of double-extortion and triple-extortion ransomware attacks. In a double-extortion ransomware attack, the threat actors exfiltrate data and threaten to sell it unless they’re paid a higher ransom. In a triple-extortion ransomware attack, they threaten to launch a distributed denial-of-service (DDoS) attack that could further disrupt healthcare services.
To mitigate these risks, it’s important for PE firms and the HDOs being acquired to prioritize cybersecurity when executing a deal to minimize surprises. This involves conducting thorough cybersecurity assessments, implementing effective security protocols and systems, and providing ongoing employee training and education.
The first step in managing cyber risk in today’s threat environment is to adopt the mindset that cybersecurity isn’t solely an IT problem to solve – it’s an organizational risk to manage. What’s more, managing your cyber risks is only the first step; to truly stay ahead of the ever-evolving threat landscape, the goal should be to build a truly cyber resilient security operation so you can anticipate, withstand, and recover from the toughest cyberattacks.
To that end, I recommend adopting the following cybersecurity practices:
- A comprehensive vulnerability management program that includes three elements: awareness of the cyber threat landscape (e.g., from advisories, notifications, cyber news, etc.); vulnerability scanning to understand your attack surface and blast radius, including ‘discovering’ systems that are inadvertently exposed; and disciplined patch management.
This is typically a difficult piece of the puzzle to place. As stated above, many HDOs don’t have a solid inventory of what they have, where it is at any given point in time, and who is responsible for it. As the acquiring company, PE firms need to recognize where these weaknesses in the tech system are to minimize security vulnerabilities. This requires doing a deeper dive into IT assets than a firm normally might execute.
- Phishing and Security Awareness Training
to level-up employees’ understanding of the most common tactics, techniques, and procedures that attackers use. Within a healthcare facility, there are various levels of security among all staff.
- If a specialist with elevated access clicks on a suspicious link, that’s considerably more dangerous than someone with access to only email. In short, those staffers with elevated security privileges need a higher level of cybersecurity training.
- Having a Digital Forensics and Incident Response
provider on retainer to provide guidance with incident response plans and post-incident expertise. Outside expert incident response counsel should execute a quarterly “table-top” exercise for the organization, walking through a mock security breach or cyberattack. HDO staff should be trained for various levels of technology crises, just as they are for healthcare crises.
- 24/7 Multi-Signal Managed Detection and Response (MDR) to identify when a threat actor has bypassed traditional defenses and respond rapidly to contain it before they can achieve their objectives to limit the scope of the breach and prevent business disruption.
It’s also important to remember that just because a healthcare organization hasn’t yet been directly affected by ransomware doesn’t mean it won’t ever be. And, even when PE firms have cyber insurance coverage, the insurance provider may or may not cover a security breach (given that many insurance firms don’t like to pay out when they can point to signs of contributory technical negligence).
By prioritizing cybersecurity in their acquisition strategies and investing in appropriate technology and training, private equity firms can better safeguard both their investment and medical records, demonstrating a commitment to patient privacy and security.
Implementing a cybersecurity strategy that builds resilience and partnering with a reputable MDR firm will greatly diminish the impact a cyberattack has on a healthcare system, keeping both patients and the business itself safer.
