Cybersecurity Services Offered in Small Rural Hospitals

Just like us, hospitals are becoming more and more connected. Everything from MRI machines to heart rate monitors are connected to the Internet. The latest equipment improves patient care, but the connection comes with risks.

Beau Woods is a cybersecurity expert and founder of Stratigos Security.

“If you can’t afford to protect it, you can’t afford to connect it,” Woods said.

Woods says investing in the latest cybersecurity tools is more important than ever for hospitals large and small. They have become prime targets because of valuable patient data that can be sold or held for ransom.

Federal reports and studies show that cyberattacks slow down doctors’ ability to treat patients and can even force hospitals to send patients elsewhere for treatment, delaying care and putting patients’ lives at risk.

Federal officials say cyberattacks on healthcare facilities doubled between 2022 and 2023.

But properly protecting against a cyberattack can be especially difficult for small hospitals, says Bob Olson, CEO of the Montana Hospital Association.

“For several reasons: it’s expensive and finding IT professionals, they have the same kind of problems recruiting people in more rural communities,” Olson said.

Experts say many high-end cybersecurity tools are marketed primarily to large hospital systems and cost six figures or more.

That’s why the White House’s announcement earlier this month is important. Google and Microsoft will offer a year of free security assessments and deep discounts on their cybersecurity tools for small hospitals.

National Rural Health Association CEO Alan Morgan helped negotiate the deal. Even though these services are temporary, he believes they will be helpful.

“You’re never going to get a level playing field here, but we need to be able to put in place at least a lower level of protection to try to keep our communities safe,” Morgan said.

Cybersecurity experts agree that this offering is a step in the right direction, but without support in the future, small hospitals could once again struggle to fund adequate cyber defenses.

Experts like Amie Stepanovich of the Future Privacy Forum would also like to see federal money help hospitals respond to attacks and recover.

“People who work in cybersecurity say they have to be perfect at all times, that the defense has to be complete. All the attacker needs is to find the only hole,” Stepanovich said.

Small hospitals have increasingly become targets. Logan Health In Kalispell has experienced several data breaches, one of which led to a legal settlement. St. Vincent in Billings and St. Patrick in Missoula were also victims of data breaches. A hospital in Gillette, Wyoming, turned away patients in 2019 during a cyberattack because it couldn’t treat them properly.

“And if you go to a hospital that’s been hit by ransomware and you’re redirected to another one an hour away, you lose all the benefits you have from the modern healthcare system,” Woods said .

Woods says doctors need to prepare for cyberattacks. He hosts simulations for providers through CyberMed Summit, a nonprofit focused on cybersecurity in the healthcare industry.

Arman Hussain, a medical resident at George Washington University, recently performed a simulation. He has treated patients suffering from strokes and heart attacks.

“In both of these scenarios, our ability to use the computer and part of our ability to use vital monitoring software disappeared in the middle of the simulation,” Hussein said.

He says there are many solutions to these problems, such as obtaining vital signs manually. But other things can slow down. Obtaining crucial medications or lab results can be difficult if it’s all done through a turned off computer system. Not knowing a patient’s allergies or viewing their digital medical record can also be problematic.

“I don’t know how I’m going to get my medication because of this or I can’t look at my old patient file because of this. Putting yourself in that scenario is going to raise all these different logistical questions that you never would have thought about if you hadn’t been in that situation itself,” Hussein said.

He says every hospital should offer this training and develop plans in the event of an attack so patients can receive the life-saving care they need.