All security risks are not created equal. Some HIPAA regulations may protect against very minor data leaks, but a big ransom attack may cause your business to stop. The biggest impact of a ransomware attack is on your medical billing, because without the flow of bills going out and payments coming in, how are you going to pay for your staff and equipment?

With a ransomware attack, will you be able to continue to treat patients? Or will you start having to turn them away because you do not have their records and do not want to risk malpractice because your notes are not all where they should be? The ransomware economy has evolved. Like any market, it has grown and changed in response to how users react to infections. Because businesses have historically paid hefty ransoms to get their data recovered, more and more ransomware is being developed every day. What criminals understand is that businesses, and especially healthcare businesses, need their data immediately to function, and many make emotional decisions to pay ransoms at any cost.

Unpatched software is the open door

Software vulnerabilities are being identified at an astounding rate. The software you are using right now, maybe your Windows operating system, your EHR software, or even something as seemingly benign as the application you installed to print on that new fancy printer, might all be targets. Cybercriminals are scanning networks for known vulnerabilities, the ones that companies like Microsoft, Google and Adobe are publishing with fixes, and are penetrating and infecting networks at an alarming rate.

Your IT support needs to make sure your systems are patched and that patches are tested to ensure the patch actually works. That means cataloging all of your software and operating systems, checking daily for security patch releases, and applying and testing patches across your network. That is a lot of work for one or even a couple of people to do consistently while dealing with all of the other user problems eating up their time.

Most businesses have no tested recovery plan

Another reason ransomware is so successful is that most IT departments fail to plan ahead. When a virus attacks the entire network, most IT support react without a clear plan to move ahead, recover files, and get your business generating cash flow. Without a tested recovery plan that helps you detect if everything is working properly, you may risk attacks that leave your business down for weeks while an untested restore process is underway.

The same goes for backups. While many IT support teams assure you that your backups are working, they never actually check them. Without good backups to recover from, your business may have lost all of its patient records. That means no billing, no patient care, no cash flow, nothing.

Aging infrastructure and untrained users

Many IT support companies will simply give you the lip service you want to hear. If you hear things like we can do that without ever getting any pushback, there is likely something wrong. When IT support companies assure you they will support older infrastructure, old operating systems, and outdated software, what they are not telling you is that behind the scenes they are simply crossing their fingers hoping everything will continue to work.

Add to that a lack of user security training. Most of your users have no clue how to detect the latest phishing scams, and annual training is an important part of keeping your organization secure. Finally, most businesses fall to the this will never happen to us syndrome. By overcoming that mentality and getting an annual third party cybersecurity assessment, many organizations become far less likely targets.