The Perilous Quest for Cybersecurity Funding in Healthcare 

Axio’s series on cybersecurity for healthcare providers  

Welcome to Axio’s series on cybersecurity for healthcare providers, where we share expert insights and practical advice tailored to the unique security needs of the medical sector. Our aim is to equip healthcare security professionals with the knowledge and tools necessary to safeguard sensitive patient data against increasing cyber threats. Each installment of this series will explore various aspects of cybersecurity risk management we have deployed with Axio customers. By staying informed and proactive, healthcare providers can ensure a secure environment for both their patients and their practice.  

 This piece sets the stage for the current state of cybersecurity for healthcare. 

 Introduction 

In the ever-evolving landscape of healthcare, the imperative of cybersecurity has become increasingly apparent. With the digitization of patient records, the proliferation of connected medical devices, and the surge in cyber threats targeting the sector, safeguarding sensitive data and devices has emerged as a paramount concern for healthcare providers worldwide. However, despite the urgency, attaining funding for robust cybersecurity measures remains a daunting challenge, plagued by a myriad of obstacles, which include: 

 The conundrum of low margins and budget constraints  

Healthcare providers operate within a delicate financial ecosystem, characterized by razor-thin profit margins and relentless budget constraints. Amidst the pressing demands of patient care, investing in cybersecurity often takes a backseat to immediate operational needs. With resources stretched thin, allocating funds for comprehensive cybersecurity initiatives becomes a Herculean task, leaving organizations vulnerable to potential breaches.  

 Hospitals continue to struggle with higher expenses, but increased labor costs are no longer the prime culprit, Kaufman Hall says in an article in cheiefhealthcarexecutive.com.  Health systems are spending more on goods and services. Non-labor expenses were 6% higher in February 2023 year-over-year (1).

 The peril of connected devices  

The proliferation of connected medical devices has revolutionized patient care, enhanced efficiency, and enabled remote monitoring. However, this interconnectedness comes at a price – an expanded attack surface for cybercriminals to exploit. From pacemakers to infusion pumps, the increasing reliance on medical IoT (Internet of Things) devices introduces new vulnerabilities, amplifying the complexity of cybersecurity protocols. Securing these devices demands substantial investment in both technology and expertise, a luxury many healthcare providers simply cannot afford.  

 The market for connected healthcare devices was valued at approximately $55 billion in 2023, and it’s projected to grow significantly, reaching around $240 billion by 2032. This represents a compound annual growth rate (CAGR) of 17.5% during the forecast period (2). 

 Rising threat actor activity  

Compounding these challenges is the escalating threat landscape targeting healthcare providers. Cybercriminals, ranging from opportunistic hackers to sophisticated nation-state actors, view healthcare organizations as lucrative targets rich in valuable data. With ransomware attacks and data breaches, the stakes have never been higher. Moreover, between the crippling of UnitedHealth Group’s Change Healthcare and hospital’s becoming common targets Boards can’t wait any longer to begin showing their commitment to protecting their data and devices as part of protecting patient health and safety.   

 According to a report from HIPAA Journal, healthcare continues to be a prime target for cyberattacks due to the valuable patient information these institutions hold. The report highlights that attacks on healthcare organizations can have severe impacts, such as disabling fetal monitors or compromising radiation information systems(3).

 Navigating the path forward  

In confronting these formidable challenges, healthcare providers must adopt a proactive and multi-faceted approach to cybersecurity funding:  

• Continual Evaluation and Adaptation: Cybersecurity is not a one-time investment but an ongoing process of evaluation and adaptation. Healthcare providers must continually assess their security posture, monitor for emerging threats, and adapt their strategies accordingly to keep up with cyber adversaries.  
• Risk-Based Investment Strategies: Recognizing the limitations of finite resources, healthcare providers should adopt risk-based investment strategies to prioritize cybersecurity initiatives. By conducting comprehensive risk assessments and identifying critical assets, organizations can allocate funds strategically to address the most pressing vulnerabilities. This includes reviewing the eco-system of vendors that can impact your revenue.  
• Insurance to Cover the Rest: While we need sound controls, investment decisions, and to drive towards as an industry, there will always be a gap.  A robust and thorough insurance policy stack can directly impact how difficult recovery from a cyber event can be long term.  
• Advocacy and Collaboration: Healthcare organizations must advocate for increased government funding and industry collaboration to bolster cybersecurity defenses. By partnering with regulatory bodies, industry associations, and cybersecurity experts, providers can pool resources and share best practices to mitigate risks effectively.  

 Conclusion 

The quest for cybersecurity funding in healthcare is fraught with challenges, from low margins and budget constraints to the proliferation of connected devices and escalating threat actor activity. However, by embracing a proactive and collaborative approach, healthcare providers can navigate these obstacles and safeguard the integrity of patient data and critical infrastructure. In an era defined by digital innovation and unprecedented cyber threats, the imperative of cybersecurity in healthcare has never been greater.  

  Axio360 can help healthcare providers make risk-based investments decisions and continuously improve the risk to patient health and safety. Through continuous assessments and performing cyber risk quantification security leaders can show their boards how much is at risk. With Axio’s new Healthcare Risk Scenario Catalogue, leaders can quantify the impact to their businesses faster than ever before and help drive prioritized investment decisions.   

  Over the next month, we will focus on each of these activities in more detail, discussing the ins and outs of each and how they fit into the broader goals of achieving patient health and safety that healthcare providers are known for. 

 Register for our webinar: Critical Cyber Concerns for Healthcare Providers in 2024 

 References

1. https://www.chiefhealthcareexecutive.com/view/for-hospitals-razor-thin-margins-may-represent-new-normal 

2. https://www.gminsights.com/industry-analysis/connected-healthcare-devices-market 

3. https://www.hipaajournal.com/the-riskiest-connected-devices-in-healthcare/