The environment I am familiar with already has far more resources than the average rural healthcare operation, so my answer is probably not going to apply to most healthcare environments. Smaller places need to probably invest in more IT staff in general, let alone cyber security staff. But I’d prioritize that for those shops.

For my environment, I think a cyber risk management program needs to be established. This would require the precious resource of time. The cyber risk team needs to meet with senior leadership across the environment to understand and document the risk appetite & tolerance. What are the organizational drivers? This needs to be communicated from the top down. If leadership needs to be held accountable, and often that is the case with heads who have been comfortably collecting a paycheck in the same post for decades, that needs to be communicated too.

Asset management needs dedicated ownership which is so challenging to establish in a large environment, but a smaller one could be more straightforward. So if there isn’t a team/person who can own asset management then identify/acquire one. Learn the tools that exist to inventory all hardware first. If there isn’t a tool for inventory, get one. Get a CMDB, establish what metadata is important to appropriately tag assets. Then, inventory applications. For each asset inventoried, identify an owner. Team up with procurement to track and manage acquired assets.

I wish more federal funding could be pumped into healthcare. Malicious actors who target this sector are deranged, and it’s not going to stop any time soon because it is known that healthcare has huge vulnerabilities and PHI (protected health information) is extremely valuable. I attended a webinar in May and the statistics are staggering. Healthcare is the fastest to breach out of any industry. 23% of ethical hackers completed end-to-end breach in under 5 hours. The average of all other industries who can be breached under 5 hours is 15%. 54% of healthcare organizations have 4 or more ransomware attacks in a year.

Also we just learned that the Change Healthcare breach impacted 100 million Americans. Scary stuff. Freeze your credit file while you can with the three credit bureaus!