Emerging challenges
Radiology practices possess a vast volume of valuable patient data that necessitates secure storage by eliminating departmental silos and transmission, to ward off cybersecurity threats. However, the evolving radiology informatics landscape in clinical practice presents an ongoing data breach security challenge. Investment in robust cybersecurity measures, embracing interoperable systems, and deploying efficient enterprise storage solutions are imperative to effectively handle the escalating volume of radiology data.
The recent suspected cyberattack at Consulting Radiologists in Eden Prairie, MN, halted radiology operations for their affiliated healthcare facilities disrupting patient care and resulting in routing critical stroke and trauma patients to other facilities, according to a report from Pioneer Press. With growing radiology practices and outpatient imaging facilities, we will see an increase in outsourced diagnostic imaging. Designing cybersecurity training programs for radiologists is vital in order to strengthen the overall security posture of radiology practices and small healthcare facilities.
The impact of such malicious attacks is far-reaching on health organizations, leading to legal, reputational, and clinical damage or even loss of lives. Furthermore, the notable pattern between the highest average data breach costs and soaring malware costs in recent years cannot be ignored. It only makes sense that leading institutions like the World Health Organization (WHO) have called for bolstering cybersecurity through operational approaches. Indeed, the road to improved cyber resilience is tough, presenting many challenges and concerns.
Furthermore, radiology imaging IT departments still operate with legacy systems that often lack the latest security features and underlying operating system updates. Underinvestment in healthcare information technology (HCIT) cybersecurity programs is another factor; legacy radiology systems should be part of an ongoing HCIT security risk-mitigation plan. Lack of risk prioritization, fragmented governance, and cultural behaviors are other factors that hinder organizational cyber resilience. An acute shortage of cybersecurity professionals with specific skill sets only adds to the challenge of radiologists and healthcare professionals encountering unprecedented threats.
As a result, numerous radiology departments lack the necessary resources and expertise to combat these threats effectively, resulting in inconsistent adoption of stringent cybersecurity measures throughout the organization. The situation is exacerbated by the surge in data volumes from advanced imaging technologies, such as 3D mammography (also known as digital breast tomosynthesis), which produce images that are 20 times larger than conventional 2D mammograms. AI research for advanced image analytics is also playing a role.
Remote sharing of Personally Identifiable Information (PII), sensitive health data, and reliance on outdated software present significant vulnerabilities, providing potential avenues for unauthorized access and exploitation by hackers.
Securing radiology units
Surging costs associated with data breaches have radiology executives investing in robust cybersecurity infrastructure and conducting regular vulnerability assessments to mitigate threats.
Despite the foreboding threat techniques, many radiology operations tend to adopt a passive "wait-and-see" stance, however. Such a lax approach can neither safeguard patient data nor preemptively thwart security breaches. Fortunately, there are actionable measures that all radiology leaders can implement to bolster their defenses and uphold operational integrity. These steps include:
• Encourage organization-wide training: Phishing is cyber attackers' primary technique for ransomware. Radiology departments can significantly reduce the damage of such attacks with proper training and awareness. Making leaders and employees aware of phishing and associated risks, the importance of strong passwords, and other cybersecurity issues can help mitigate attacks greatly.
• Actively ensure compliance: Modernization projects such as interoperable systems and APIs can expose IT departments to potential vulnerabilities. Radiology departments should regularly audit old systems and check whether new ones comply with the latest global regulatory standards. This can help them enhance overall compliance and cybersecurity.
• Explore cloud-native security: By deploying cloud security solutions, radiology executives can store medical data in an encrypted format. These solutions are fortified by multiple protective layers and incorporate enterprise-grade security measures, real-time monitoring capabilities, and scalable storage capacity. Organizations can achieve two-way benefits by securely storing sensitive health data and driving robust security protocols.
• Safeguarding patient consent management and privacy: Patient consent is a pivotal element in ensuring the privacy and protection of patient data. Radiology departments must be upfront about how patients' data is collected, utilized, and accessed with due diligence. With patient consent at the heart of operations, radiology staff can demonstrate their commitment to upholding patient privacy standards and adhere to ethical practices regarding data handling.
• Proper scrutiny of third-party vendors: Radiology departments rely heavily on third-party vendors, including cloud, value-added service, and managed service providers, to fulfill their IT service needs. It is crucial to vet these vendors by reviewing their security protocols, evaluating their credentials, and assessing their compliance standards. For example, cloud vendors should have successfully undergone a HIPAA audit and obtained HITRUST certification. By selecting vendors through stringent cybersecurity measures and relevant certifications, radiology departments can ultimately safeguard patient data and uphold industry best practices.
• Implementing zero-trust architecture: Zero-trust architecture strategy views every user or device attempting system access as potentially malicious until authentication and trust are established. How can radiology professionals safeguard their systems and data amid potential risks after architecture deployment? By employing top-tier encryption mechanisms to protect data in transit and at rest. This added layer fortifies security measures, reducing the risk of breaches or cyberattacks. Thus, organizations can bolster their overall cyber posture while shielding sensitive data from potential threats.
• Viewing the security layer through a third-party expert lens: Are regular assessments enough to identify vulnerabilities and weaknesses in the security posture of radiology operations? A reputable third-party security firm can provide valuable insights about existing security measures and areas that need improvement. Tests are carried out to evaluate the organization's cybersecurity, penetration, and compliance standards.
• Continuous monitoring: Radiology departments must regularly review and update cybersecurity policies and procedures. They must also conduct security assessments and offer advanced training on threats and prevention techniques. Executives must foster an environment where employees feel empowered to report suspicious activities.
By implementing these measures, radiology executives can transcend from a reactive to a more proactive approach, significantly enhancing their cyber posture.