Survey: 4 in 5 health firms hit by hacks

The vast majority of healthcare organizations have had their networks compromised by a cyberattack, and many may not even be aware of the breach.

Eighty-one percent of health IT leaders said their systems had been breached by an attack, according to a new KPMG survey

The survey looked at both insurers and healthcare providers with revenues of at least $500 million.

But there was a stark difference in the level of cyber readiness between hospitals and insurers, according to the survey. 

Sixty-six percent of health plan executives said that they were prepared to face a cyberattack, compared with only 53 percent of healthcare providers.

“I would argue that many of the providers aren’t even aware that their systems have been compromised,” Michael Ebert, head of KPMG’s health and life sciences cyber practice, told Modern Healthcare. “They don’t necessarily know who’s in their systems or what’s occurred.”

Mammoth insurer breaches — such as the Anthem hack that exposed the records of 80 million people — have kept health plan cybersecurity in the public consciousness.

But hospitals faced their own series of high-profile breaches in 2015, including a July attack on the UCLA Health System that compromised the data of up to 4.5 million people. 

“The vulnerability of patient data at the nation’s health plans and approximately 5,000 hospitals is on the rise and health-care executives are struggling to safeguard patient records,” said Ebert. 

Ebert pointed out that health records have personal information that cannot be changed, unlike credit cards, making them a valuable target for would-be fraudsters. 

Sixty-five percent of respondents to the KPMG survey cited external attackers as the primary culprit. Just under half identified third-party data sharing as their organization’s primary vulnerability.