Cyberattacks on Canadian health information systems

How have cyberattacks affected Canadian health information systems?

Cyberattacks against health information systems are most commonly ransomware or data breaches (Figure 1). At least 14 major cyberattacks on Canadian health information systems have occurred since 2015, 9 of which attempted ransom and 6 of which compromised PHI. Ransomware involves the installation and activation of a malicious program (i.e., malware) that locks or encrypts a computer system and its stored data until a financial ransom is paid. Access to data is commonly lost even when ransoms are paid.4 The attack can also entail data breaches, whereby PHI is exfiltrated off health information systems and shared illicitly in online marketplaces. Another form of extortion relies on denial of service, whereby an attacker overwhelms a site through fake traffic to make it unavailable for authentic users (e.g., patients attempting to book an appointment) until a payment is made.9 Although most cyberattacks against health organizations are attributed to criminals, they can also be perpetrated by nation-states, terrorist groups, online “hacktivists” and ideologically motivated violent extremists (e.g., those targeting abortion centres).10^–12

• Download figure
• Open in new tab
• Download powerpoint

Figure 1:

Recent cyberattacks on Canadian health information systems, including denial of service (red), ransomware (green), data breach (blue), mixed (orange) and unknown (purple). Note: IT = information technology, PHI = personal health information.

Health organizations, irrespective of their size, make attractive cyberattack targets. First, they are financially lucrative targets because of the value of PHI but are also likely well-resourced enough to pay ransoms. Since attackers adjust ransom amounts to the perceived ability of the target to pay, attackers can hold health information systems in individual physician offices for ransom in the Can$3000–Can$5000 range and still expect a reasonable likelihood of payment.13 Canadian hospitals have not been reported to pay ransoms, but American health systems have paid ransoms well into the millions of dollars.14 Even if no money is paid, the extortion attempt can still incur extended periods of downtime of the health information system with substantial (and very public) impacts to IT and patient services. Second, the extensive media coverage of cyberattacks on health systems increases the pressure on victims to pay the ransom quickly before it becomes public. Third, health organizations often have a history of underinvesting in IT systems and rely on outdated or legacy systems that are vulnerable to exploitation. Finally, health organizations can also lack the capacity to respond to cyberthreats, which increases the damage of hacks as well as the probability of paying ransoms.

What can Canada learn from the cybersecurity practices of peer countries?

Comprehensive comparison of the burden of attacks between jurisdictions is difficult since many cyberattacks on health information systems are unreported.15 Although effective cyberhygiene (i.e., daily routines, good behaviours and occasional check-ups akin to principles in health) strategies for end-users are essentially universal across organizations, sectors and jurisdictions, cybersecurity policy in Canadian health information systems has considerable room for improvement.

In June 2022, the House of Commons proposed the Critical Cyber Systems Protection Act (CCSPA). The CCSPA defines critical cyber systems as those with serious implications for public safety if compromised. These systems include telecommunications, pipelines, nuclear energy, federally regulated transportation and banking — but not health organizations.16 In contrast, the United States Cybersecurity and Infrastructure Security Agency supports a range of Sector Coordinating Councils that collaborate with the government for information sharing, coordination and the establishment of voluntary practices to promote resilience. The Healthcare and Public Health Sector Coordinating Council has dozens of members, including health systems, advocacy groups, insurers and nonprofit organizations.17 Although the exclusion of health organizations from the CCSPA could be viewed as consistent with the federal–provincial principles of the Canada Health Act, governance mechanisms such as Sector Coordinating Councils could promote adherence to common standards while also fostering innovation and experimentation.

Within the provinces and territories, considerable heterogeneity exists in cybersecurity posture among broader public sector organizations, as smaller institutions often lack requisite financial and human resources. Shared services models can help address disparities. For example, Ontario Health is piloting 6 regional security operation centres.18 Each centre would continuously monitor the security practices of member institutions, defend against breaches and proactively isolate and mitigate security risks. Regional security operation centres are similar to the well-received, health-related computer emergency response teams in the United Kingdom, Norway and the Netherlands.10 As governments establish these bodies, clinicians and health organizations must develop familiarity with them and their incident reporting and escalation pathways. During establishment of these bodies, governments should also endeavour to engage clinicians to ensure their needs and perspectives are considered. Provinces and territories should be wary of regulating cybersecurity practices beyond reporting at the level of the individual provider or health organization (e.g., mandating biannual cybersecurity audits) as top–down requirements can be overly onerous in terms of effort, capital and human resources, especially for smaller practices. Finally, provinces and territories should establish publicly available repositories of cyberattacks on health information systems.15 Such repositories can serve as a useful aid for research and guide consumer choice as patients may preferentially seek out providers with strong cybersecurity track records.

How can clinicians prevent and navigate cyberattacks?

The US National Institute of Standards and Technology outlines 5 stages to effectively navigating cyberattacks: identification, protection, detection, response and recovery.19 For simplicity, we have combined the stages of identification and protection into a single prevention stage (Figure 2).

• Download figure
• Open in new tab
• Download powerpoint

Figure 2:

Four stages of cyber resilience, with suggested actions. Note: CMPA = Canadian Medical Protective Association, EMR = electronic medical record, VPN = virtual private network.

Prevention

At the individual level, cyberhygiene prevents attacks. Clinicians should be vigilant for phishing attacks via email or other suspicious behaviour (Figure 3). Phishing refers to targeted, deceptive efforts to gain access to a victim’s device or network. Once access has been obtained, an attacker can install malware to exfiltrate or encrypt data for ransom. Clinicians should ensure they use unique, strong passwords (i.e., at least 8 characters with a mix of letters, numbers and special characters) and 2-factor authentication for their logins, as well as set up verification questions and auto-lock devices with access to PHI. Password managers can generate and store unique, strong passwords for each site and provide notifications when user information is compromised. Clinicians should avoid sensitive tasks without adequate network protections (e.g., accessing patient records on public Wi-Fi) as data can be intercepted or malware can be installed in “man-in-the-middle” attacks. Software must be kept up to date as developers release patches for security vulnerabilities on an ongoing basis. Health organizations are notorious for relying on legacy systems (e.g., Windows XP) well past the date of their security support deprecation.

• Download figure
• Open in new tab
• Download powerpoint

Figure 3:

Anatomy of a hypothetical phishing attack.

At the institution or practice level, a key aspect of preventing cyberattacks is to reduce the attack surface, or the number of entry points an intruder would have into health information systems. This is especially important with setups in which individuals can use their personal devices and with increasing numbers of IoT devices.20 Techniques for reducing attack surfaces include auditing all devices on the network, ensuring that their software (including operating systems) are up to date, installing antivirus and antimalware software, and setting up a firewall to monitor both outbound and inbound Internet traffic. Practices can also set up a virtual private network (VPN), which encrypts and disguises online traffic, making it much more difficult to intercept. Virtual private networks are particularly important for clinicians who wish to access PHI from environments outside their health organization’s network, such as to complete charting at home. Although clinicians in larger organizational settings will have the benefits of a standardized approach, those in private practice will have to rely on third-party vendors. Luckily, many traditional antivirus vendors now have comprehensive bundles of services. Professional support from organizations such as the Ontario Medical Association exists, including privacy breach and cyber coverage to assist with forensics, public relations and legal services. These should be viewed as essential office expenses and, in many jurisdictions, may be eligible for tax credits.

What are emerging areas of cybersecurity in health care?

Emerging technologies require attention to ensure that the risk of compromise does not grow with improvements in utility. Clinicians who are adopting a virtual care platform should note that consumer video-conferencing solutions (e.g., Zoom, Face-Time) often do not meet provincial privacy and security requirements. Instead, clinicians should use tools built into their EMR or versions of videoconferencing solutions that specifically meet health care standards such as Zoom for Healthcare.28 Provincial health authorities provide lists of verified solutions for virtual care.29 Personal medical devices — such as pacemakers, insulin pumps and blood glucose monitors — are connected to the Internet for remote biomarker monitoring, as well as to receive software updates. Hackers have shown the ability to rapidly drain device batteries, provide too much stimulus (e.g., pacing, insulin bolus) or fail to provide a stimulus when clinically indicated. 30 In 2019, Health Canada recalled several models of insulin pumps that were susceptible to attack and encouraged patients to discuss switching to other models with their physicians. 31 Finally, machine learning tools are actively being developed and integrated into health care workflows.32 These tools can be vulnerable to adversarial attacks or subtle changes to input data that are carefully designed to mislead algorithms toward incorrect outputs.33 For example, a hacker can add very small amounts of noise to pixels in a radiograph that would be imperceptible to humans but change model outputs (e.g., from benign to pathologic or vice versa). Across these novel areas, clinicians and health organizations should be vigilant for recalls, keep software up to date and discuss possible risks with patients.

Conclusion

Preventing cyberattacks involves navigating trade-offs between keeping workflows efficient and reducing risk amid threats that are growing in frequency, severity and sophistication. As national and regional policies develop, health organizations, practices and individual clinicians must take a proactive approach to improving their cybersecurity posture. Methods for handling personal and professional risk go hand-in-hand, including leveraging tools and best practices, being vigilant and having an incident response plan. With respect to cybersecurity, a bit of prevention is worth a terabyte of cure.