Medical facilities and professionals have duties to protect patients. Today, this can include protecting against cyberattacks and other technical vulnerabilities that could affect patient care.
What is at risk?
Nearly every aspect of modern medicine involves computer software in some way. Thus, cyber vulnerabilities can affect a range of medical systems and products, including:
- Connected medical devices
- Servers and software
- Electronic medical records
- Medical testing
- Usernames, passwords and other credentials
When outside parties compromise these systems and information, patients’ personal information and medical records could be at risk. Hospitals and staff can also be at risk when attacks require shutting down systems or inoperability.
So, what are hospitals and health professionals supposed to do?
To protect sensitive information and medical systems, parties who manage digital information for hospitals and individuals must take steps to keep unwanted parties out.
What this process entails precisely depends on several factors. For instance, what information is involved, and what resources do parties have?
That said, some basic steps to take include:
- Installing and updating software
- Keeping up with patches
- Configuring firewalls correctly
- Requiring multi-factor authentication
- Encrypting information
- Establishing and training on security policies
Parties who take these and other reasonable steps to protect against cyberattacks can be more confident that their information and systems are safe.
On the other hand, failure to do this could expose healthcare delivery organizations, administrators and device manufacturers to negligence claims.
Looking ahead
As our reliance on technology continues to increase, so too could the number of claims involving medical malware and malpractice. In fact, the number of individuals affected by healthcare attacks in 2021 reached an all-time high of 45 million people.
These increasing threats to medical data, records and systems mean that healthcare organizations would be wise to prioritize cybersecurity. While it may not be realistic to prevent every attack, taking reasonable steps to keep this information safe can make the difference between a mitigated threat and a lawsuit.
