Tackling Healthcare Data Breaches: MFA and Zero-Trust Approach

The rise in healthcare data breaches in recent years has highlighted the need for healthcare practices to invest in cybersecurity services. Implementing advanced security measures, such as multifactor authentication (MFA) and zero-trust security networks, either on their own or with the help of a managed IT services provider, can help protect healthcare organizations from cyberthreats.

A Rise in Recent Security Breaches

Over the last several years, major security breaches in healthcare organizations have been rapidly rising. Some of the more recent examples include:

Trinity Health

In 2020, this healthcare provider experienced a significant data breach impacting 3.3 million patients due to a ransomware attack on their third-party vendor, Blackbaud.

Shields Healthcare Group

In 2022, a cyberattacker accessed Shields Healthcare Group’s network server, potentially compromising the data of 2 million people.

Broward Health

In 2022, a data breach affecting 1.3 million patients occurred due to a compromised third-party medical provider with access to Broward Health’s patient database.

Morley Companies

In 2022, a ransomware attack on Morley Companies, a third-party provider of business services, resulted in the exposure of over 521,000 individual records.

L’Assurance Maladie

In 2022, this French insurance body experienced a data breach affecting 510,000 people after hackers compromised 19 accounts, primarily belonging to pharmacists.

ARcare

In 2022, cybercriminals accessed ARcare’s computer systems for over a month, reviewing and stealing the sensitive individual information of 345,000 people.

OneTouchPoint (OTP)

In 2022, a breach at OTP, a third-party mailing and printing vendor, affected 2.6 million people across over 30 healthcare providers.

Several factors have contributed to the increase in healthcare data breaches, including:

• Growing reliance on digital health records
• Rapid adoption of telemedicine and remote work during the COVID-19 pandemic
• Increasing sophistication of cyberattacks
• Inadequate security measures and lack of employee cybersecurity training
• Vulnerabilities in third-party vendors and business associates

The Impact of Healthcare Data Breaches on Patients and Organizations

Healthcare data breaches have far-reaching consequences for both patients and healthcare organizations. Patients may face identity theft, financial fraud, and potential privacy violations due to the exposure of their sensitive information. Meanwhile, healthcare organizations can suffer financial losses from regulatory fines, legal costs, and the expenses associated with remediation and notification. Additionally, healthcare organizations often face reputational damage, which can result in a loss of trust among patients and other stakeholders.

The Role of Multifactor Authentication (MFA) in Incident Prevention

Multifactor Authentication (MFA) is a security measure that requires users to provide two or more forms of identification before granting access to sensitive data or systems. MFA typically combines something the user knows (e.g., a password), something the user has (e.g., a physical token or smartphone), and/or something the user is (e.g., a fingerprint or facial recognition).

The benefits of MFA in securing healthcare data

Implementing MFA can significantly enhance the security of healthcare data by:

• Reducing the risk of unauthorized access: MFA makes it more difficult for cybercriminals to gain access to sensitive data using stolen or guessed credentials.
• Enhancing overall security: MFA adds an additional layer of protection, making it harder for attackers to breach systems even if they have already compromised other security measures.
• Increasing awareness of potential breaches: MFA can help detect and alert organizations to unauthorized access attempts, enabling a quicker response to potential threats.

Best practices for implementing MFA

• Apply MFA to all users and endpoints: Ensure MFA is required for all staff, including administrators and third-party vendors, across all access points.
• Use strong authentication factors: Combine various authentication methods, such as biometrics, hardware tokens, and software-based tokens to increase security.
• Regularly review and update MFA policies: Monitor the effectiveness of your MFA implementation and update your policies as needed to respond to evolving threats.
• Train employees: Provide staff with the necessary training to understand and use MFA effectively, ensuring they are aware of the importance of securing their credentials.

How MFA Could Have Helped Prevent a Real-Life Event

In the case of L’Assurance Maladie’s data breach, hackers were able to gain unauthorized access to 19 accounts, primarily belonging to pharmacists. The attackers likely retrieved the passwords for these accounts from a Dark Web forum hosting credentials stolen in previous data breaches.

If MFA had been implemented, the cybercriminals would have faced significant difficulties in gaining access to the compromised accounts. MFA would have required the attackers to provide at least one additional authentication factor, such as a one-time code sent to the user’s registered mobile device, a hardware token, or biometric data like fingerprints or facial recognition. This additional layer of security would have effectively blocked the attackers from logging in with the stolen credentials alone.

By requiring multiple forms of identification, MFA ensures that even if one factor, such as a password, is compromised, unauthorized access is still highly unlikely. This added layer of security can be critical in protecting sensitive healthcare data from being accessed or stolen by malicious actors. In the case of L’Assurance Maladie, implementing MFA could have significantly reduced the likelihood of the data breach and prevented the exposure of sensitive patient information.

The Role of Zero-Trust Security in Incident Prevention

Zero-trust security is a cybersecurity framework that operates under the principle of “Never trust, always verify.” It assumes that no user, device, or application should be trusted by default, whether inside or outside the organization’s network.

Zero-trust security networks help prevent breaches by:

• Least-privilege access: Limiting user access to only the resources necessary for their job function minimizes the potential damage from compromised accounts.
• Continuous monitoring and verification: Zero-trust security requires ongoing validation of user and device authenticity, ensuring that any unauthorized access attempts are detected and blocked in real time.
• Micro segmentation: Dividing networks into smaller segments restricts lateral movement, making it harder for attackers to navigate through the network and access sensitive data.

Best practices for implementing zero-trust security

• Assessing and identifying data, applications, and assets that require protection
• Defining access policies based on user roles and responsibilities
• Deploying robust authentication mechanisms, such as MFA
• Continuously monitoring and analyzing network traffic and user behavior
• Implementing network segmentation to isolate sensitive data and systems

Examples of zero-trust security in action:

• A healthcare organization prevents unauthorized access to its electronic health record (EHR) system by implementing role-based access control and MFA.
• Another organization detects and blocks ransomware attacks by continuously monitoring network traffic and identifying suspicious activity, such as repeated failed login attempts or unusual data transfers.
• A hospital implements micro segmentation to prevent lateral movement in its network, limiting the potential impact of a malware infection on one segment from spreading to other parts of the network.

How Zero-Trust Security Could Have Helped Prevent a Real-Life Event

In the case of Shields Healthcare Group’s data breach, an unknown cyberattacker gained access to the network server belonging to Shields Healthcare Group from March 7, 2022, to March 21, 2022. The hacker’s presence activated a security alert on March 18; however, after investigating the alert, data compromise was not confirmed at the time.

With a zero-trust security framework in place, the organization would have continuously monitored and verified user access and network traffic, potentially identifying the malicious activity sooner. In addition, least privilege access and micro segmentation would have restricted the attacker’s ability to move laterally within the network, potentially preventing them from accessing sensitive data.

By adopting a zero-trust security approach, Shields Healthcare Group might have been able to promptly detect the breach and respond effectively, mitigating the overall impact on the organization and the patients whose data was at risk. The incident serves as a reminder of the importance of implementing robust security measures, such as zero-trust security, in protecting sensitive healthcare data and preventing unauthorized access.

The Synergy of MFA and Zero-Trust Security

Multifactor authentication (MFA) and zero-trust security complement each other in creating a robust security posture for healthcare organizations. MFA provides strong authentication by requiring users to provide multiple forms of identification before granting access. Zero-trust security, on the other hand, ensures that no user, device, or application is trusted by default and that their authenticity is continuously monitored and verified. By combining these two security measures, healthcare organizations can create a multilayered defense against potential data breaches.

The importance of combining multiple security measures to protect healthcare data lies in the diverse threats that healthcare organizations face. Cybercriminals employ various tactics, from phishing attacks to exploiting vulnerabilities in software or hardware. By implementing both MFA and zero-trust security, organizations can mitigate risks associated with unauthorized access, lateral movement within networks, and potential breaches caused by compromised credentials. This layered approach is essential in safeguarding sensitive patient data and maintaining compliance with regulations like HIPAA.

As cyberthreats continue to evolve and the number of healthcare data breaches rises, there is an increasing need for robust security measures in the healthcare industry. The sensitive nature of patient data makes it a valuable target for cybercriminals, and the consequences of a breach can have lasting effects on both patients and organizations.

It is crucial to encourage the adoption of MFA, zero-trust security, and other security best practices in the healthcare industry. By implementing these measures, healthcare organizations can not only protect their valuable patient data but also foster trust in their services and maintain their reputation. The continued collaboration and sharing of best practices among healthcare professionals, IT security experts, and industry leaders will be essential in building a more secure healthcare landscape for the future.

If you’d like to discuss your own security, reach out to Technology Assurance Group today!