Healthcare cybersecurity has become a critical concern globally, and Australia is no exception, with sensitive data and critical infrastructure making the sector a prime target for cyberattacks. Just last month, 13 million Australians had their data stolen from the electronic medical prescription service MediSecure.
The increasing digitisation of health records, telehealth services, and the use of connected medical devices have expanded opportunities for cybercriminals, who are employing increasingly advanced techniques to exploit inadequate cybersecurity practices among health professionals.
Problems include the technical complexity of healthcare systems, which include a myriad of interconnected devices and software, making it difficult to secure every potential vulnerability, and the use of older, legacy systems, which lack the robust security features found in modern software.
In 2019, the Australian National University suffered a massive data breach that affected health research data. In 2020, Eastern Health, a major public health service in Melbourne, experienced a ransomware attack that disrupted their operations and forced them to temporarily revert to manual processes.
This was followed by the 2022 Medibank data breach, which affected millions of former customers, and the latest MediSecure breach. The impact of incidents like these go beyond financial loss; they can disrupt patient care and erode public trust in the healthcare system.
Strategies
In response, the Australian Cyber Security Centre is promoting the Essential Eight strategies, which include measures such as application whitelisting, patching applications, configuring Microsoft Office macro settings, and restricting administrative privileges.
These strategies are designed to mitigate the risk of cyber incidents and enhance the overall security of IT systems.
Additionally, the Notifiable Data Breaches (NDB) scheme, which came into effect in 2018, mandates that organisations, including those in healthcare, must notify affected individuals and the Office of the Australian Information Commissioner (OAIC) when a data breach is likely to result in serious harm. This scheme aims to improve transparency and accountability, encouraging organisations to adopt stronger data protection measures.
Across the country, healthcare organisations are increasingly investing in cybersecurity solutions such as encryption, intrusion detection systems, and multi-factor authentication. Regular security audits and vulnerability assessments are becoming standard practice to identify potential weaknesses, but experts believe much more needs to be done.
Dr Tafheem Wani is a lecturer in Digital Health at La Trobe University’s School of Psychology and Public Health who has also contributed to the development of healthcare cybersecurity frameworks.
Dr Wani said, ‘Healthcare experiences the highest number of data breaches globally and in Australia, over all other industries. With advancements in healthcare technology and digitisation of health services, cybersecurity risks have significantly increased, and can grow even further.’
Valuable data
He says hackers are especially interested in health records because they can sell the data for high prices on the black market. ‘They can use the information for medical identity theft, to disrupt health services through non-state actors, and for espionage.
‘Healthcare cybersecurity is mostly not given the attention it deserves, and I believe it is about time that all stakeholders – government agencies, healthcare organisations, professionals, and patients alike, recognise and understand their rights and responsibilities in securing health data.
‘A significant proportion of data breaches in healthcare are attributed to human or internal errors. We need a holistic and tailored approach in understanding and developing measures for healthcare cybersecurity,’ said Dr Wani.
‘Apart from investments in cybersecurity technology, we also need to invest in initiatives such as developing customised cybersecurity training and awareness programs for healthcare staff, streamlining enforcement of cyber policies and health data privacy regulations, and establishing a proactive cybersecurity culture in healthcare organisations,’ he said.
