Skip to main content
Rural Health Information Hub

Oct 04, 2023

Recovering from a Cybersecurity Attack and Protecting the Future in Small, Rural Health Organizations

by Tami Lichtenberg

computer screen with extortion message from cyberattack. Complex information systems such as electronic health records, patient portals, and telehealth equipment, as well as high-tech radiology like CT and MRI machines, allow rural healthcare organizations to operate more efficiently and provide a similar level of service as larger, more urban facilities. In fact, during the recent COVID public health emergency, technological solutions were key to the continuity of care in many rural communities. However, the increased use of information systems, digital medical equipment, and computer networks escalates the risk of attacks by outside threat actors seeking to shut down systems and steal data through malicious cyber-attacks.

Threat actors — individuals or groups that want to hack systems that contain electronic personal health information (e-PHI) — often lurk on the dark web and operate in the crevices of networks. They attempt to penetrate information systems, firewalls, email, or computers to create havoc, steal data, or hold providers “hostage” for a monetary ransom.

According to the U.S. Department of Health and Human Services (HHS) Office of Civil Rights (OCR) portal detailing breaches, 54 million patients were affected by data breaches in 2022. According to the HHS Cybersecurity Program, 60% of the ransomware attacks in 2020 were aimed at healthcare organizations. The introduction of the 2022 update to the MITRE publication, Medical Device Cybersecurity Regional Incident Preparedness and Response Playbook, commissioned by the Federal Drug Administration, provides a more sobering statistic: “From mid-2020 through 2021, 82 percent of healthcare systems reported a cybersecurity incident, while 34 percent were ransomware attacks.” The publication also cautions that attacks are starting to involve supply chains and cloud-based applications as the attacks become increasingly sophisticated.

Joe Wivoda.

Small and rural healthcare providers, which often cannot afford the expansive information technology (IT) teams of larger facilities, are especially vulnerable. A survey of 100 hospital IT experts by cybersecurity firm CyberMDX and Philips, found that small and midsize hospitals had the most vulnerability. In addition, 48% of hospital executives shared that their organization was affected by an attack in the last six months. In fact, in June 2023, a small rural hospital in Illinois closed, and it was the first to point to a ransomware attack that left them unable to bill Medicare, Medicaid, and other payers for months as one of the major causes.

This is not just an IT problem.… Everyone must be vigilant.

Healthcare security expert Joe Wivoda, a senior director of compliance at a HIPAA compliance solutions company, emphasized that cybersecurity is everyone's issue: “This is not just an IT problem. IT must do a better job, yes, but this is an organizational issue. Everyone must be vigilant.”

However, even the most vigilant organizations are not safe from cybersecurity threats and threat actors looking to do harm.

McKenzie Health System

Steve Barnett.

Steve Barnett, Chief Executive Officer of McKenzie Health System, a Critical Access Hospital (CAH) in Sandusky, Michigan, knew that he was in trouble when his information systems started shutting down. He did not know it yet, but the cyber-attack that had started the day before was an attempt to grab as much data as possible and extort the hospital system for a hefty ransom. These network breaches, known as ransomware attacks, are often launched by threat actors who may not even have a specific target in mind. Their goal is just to hold an organization's information hostage or get as much sensitive and potentially protected health information as possible.

McKenzie Health System, according to Barnett, then began the tedious task of taking all systems offline, trying to identify and block the threat, and rebuilding the network from backups. He pointed to the fact that rural providers are resilient by nature as the reason his team was able to move back to paper-based systems in the meantime and continue to provide critical services to the community: “That's the nature of rural. Our team knew how to do things differently and adapted quickly despite the mounting stress and need to get systems back online as soon as possible.”

Learn more about McKenzie Health System's experience in our Rural Emergency Preparedness and Response Toolkit.

Estes Park Health

Gary Hall.

Like Barnett, in June 2019, Gary Hall, then the Chief Information Officer of Estes Park Health in Estes Park, Colorado, also watched systems shut down before his eyes. At first, when his on-call IT person phoned him at about 1:00 a.m. and told the bleary-eyed Hall that they were having trouble with the emergency department systems, things seemed disconnected. He tried logging in from home and experienced the same difficulty that IT had reported, but the system seemed to be intact. He headed into the hospital to check the network and try to figure out what was happening. In hindsight, he said, he should have started shutting down the servers before he left the house, but cyber-attacks were fairly new to rural health at the time. “My nightmare moment was when I got into my office, logged into the location where our shared folders were held, and literally watched as the code came across the screen and the files flipped as they locked one by one.”

My nightmare moment was when I got into my office, logged into the location where our shared folders were held, and literally watched as the code came across the screen and the files flipped as they locked one by one.

Although the cyber-attack on Estes Park Health happened a little more than four years ago, Hall recounts the event in vivid detail because it is never far from his mind. The ransomware attack — one that systematically shut down their network and computers and caused them to take other systems, such as their digital phone system, offline to protect them from corruption — locked files and shut down pieces of the network, but it did not result in data or protected information leaving the organization. Nevertheless, it was a devastating event for the small CAH and its affiliate outpatient clinic, requiring an incredible amount of staff time, many months of recovery efforts, and an enormous financial outlay to restore systems and prevent another attack.

The Toll of Cyber-Attacks

Ransomware attacks like the ones that these two rural healthcare organizations experienced can be costly. A report by IBM estimated the average healthcare ransomware attack cost organizations $4.2 million and that healthcare breaches were the most expensive overall. In addition to financial losses, a provider's reputation and trust in the community is also at risk. Barnett cited McKenzie Health's clear message, transparency, and communication with the media and the community as factors that helped the facility maintain community trust. He also credits preparation, his team's resolve, and the use of a disaster recovery organization in helping them get through the cleanup and repair after the cyber-attack, some of which was still going on months later.

Early on we established an incident communication strategy to share the event in all necessary detail with the public.

Hall identified those same factors as extremely important in ensuring that community trust is maintained in the organization: “Early on we established an incident communication strategy to share the event in all necessary detail with the public. We assured them that no data was stolen and that their healthcare was still safe and secure.” He also cited the openness of the leadership and board, which were closely involved in the recovery: “We have good relationships with the two newspapers here and used social media, but not to the extent we would today. Our elected board was engaged in the community and so we used service clubs like Rotary, community forums, emails, and the board even had a table at the local farmers market to communicate with the public about the incident.”

A little over a year past their incident, Barnett estimates that out-of-pocket costs are over a quarter of a million dollars and may not be complete. Some of these costs include legal fees, forensic work by a data mining company, notifications to patients and employees, monitoring software, file exploration, and credit monitoring costs for those potentially affected by the breach. He pointed out that the level of cybersecurity insurance an organization has will decrease some of the out-of-pocket described. Barnett commented that when his insurance broker recommended cybersecurity insurance five to six years prior to the cyber-attack, he really did not know what to make of all of it, but they started small and built up the protections over time.

As these events may be subject to federal audit, McKenzie Health System will not know for some time — despite believing that they did everything possible to protect patient information — if it was enough.

While the cyber-attack at Estes Park Health is further in the past, Hall recounted how he and his IT staff spent almost 140 of the 168 hours in that first week in the facility — even opening a room in the hospital so that the IT person, who lived a distance away, could stay nearby and catch a few hours of sleep while monitoring the recovery. He estimated that it took a full year of a staff person's time to complete the recovery and protect the organization for the future. In addition, even though the Federal Bureau of Investigation (FBI) did not recommend it, the organization felt it had no choice but to pay a bitcoin ransom through their cyber insurance company to recover the network keys and unlock their systems. When the first set of keys did not unlock all the data, a second ransom was paid, which freed up additional files. Aware that the threat actors could keep “spoon-feeding” the data keys for additional ransom, Hall acknowledged that some lower-level files and information simply had to be locked away and archived instead of continuing to pay.

He lamented about what good all the money that was spent — whether it was the ransom or the costs to protect the facility from another attack — could have done if it had been used to pay for the healthcare of the community instead.

Taking Stock and Protecting for the Future

It is believed that the attack on McKenzie Health System originated offshore; however, the country and culprit remain a mystery. Although the true root of the incident may never be known, Barnett said that the recovery has proceeded unhindered and as expected. “We get an occasional request to extend the credit monitoring we gave to anyone who we suspected may have been compromised, but nothing concerning has come from it,” he added. He explained some of the enhancements that McKenzie Health System has put in place since the attack: “We have been using software that does a much better job looking at incoming email traffic and we've implemented EDR (endpoint detection and response) software running on all endpoints. EDR quarantines anything suspicious for further evaluation and kills all malicious code.” However, he cautioned that organizations need to be careful not to tighten incoming emails to a point where appropriate emails are not coming through, and it can be challenging to find that sweet spot.

After working with local police forensics and the FBI, Hall said that the attack on Estes Park Health, fortunately, was a low-level attack that could be tracked back to access to Estes Park Health remote desktop servers via the hacking of some contractors' passwords. At the time, Estes Park Health did not have multi-factor authentication. He explained once the threat actors had access, they moved in what is referred to as an “East-West” pattern gaining access to other servers and applications down the line.

Hall also described the measures put in place after the ransomware attack at Estes Park Health. Having caught the culprits in what he describes as mid-stream, some of the damage was minimized by having systems backed up to the cloud. Now, he explained there are “protections upon protections. It's a wearying job. We have an IT staff that are on call, I am permanently on call, but you cannot physically watch everything all the time. So we have two different firms that monitor our systems continually — one that audits our data logs looking for anomalies and sending us alerts and the other that can quarantine and or shut down a system if it deems it necessary.”

Hall said that the monitoring gives him great comfort, but that he will never be 100% satisfied and that organizations cannot rest. He explained that Estes Park Health is continually probing the nooks and crannies of their system, checking outside the network, and looking for holes: “It's about how safe you want to be.”

This vigilance even protected the organization when their timekeeping vendor was hit by a cyber-attack of its own in 2021. Estes Park Health was able to isolate and protect their timecard system and move to a manual time recording process until the threat was over.

The Human Element

Wivoda explained that while organizations may focus on firewalling and penetration testing, phishing and ransomware attacks are the most pervasive. He said that by far the biggest threat is the human element: social engineering. Social engineering, in terms of information security, is the use of deception to manipulate individuals into exposing protected information in order to use it for fraudulent purposes. Attacks that use social engineering rely on naivety and human error.

While healthcare providers are continually building stronger firewalls and looking for intrusions in their systems, he pointed out that healthcare organizations have hundreds if not thousands of emails that threat actors are continuously sending as phishing attempts.

Hall and Barnett agree. “We train our staff that they are all IT security staff and help protect our facility from attacks,” said Hall, “but we also have scanning software that is anticipatory. If someone clicks on something bad, it analyzes it so we can proactively act upon it.” Barnett recommended reviewing the “soft stuff” and continually educating staff on determining whether an email is real or a phishing attempt. He encourages teaching people to focus, stop, and think, “Would that person really ask me to do that?” before responding to suspicious emails. He also suggests “looking at educational opportunities, going to sessions at conferences, and finding out what you need to be paying attention to. Don't wait until it happens to you.”

Annual Security and Privacy Risk Analysis

One tool that can help rural health organizations identify potential gaps in their protection of e-PHI or vulnerabilities in their networks is the HIPAA Security Risk Assessment, required for covered entities with PHI by the HIPAA Security Rule (45 CFR § 164.308). Wivoda cautioned that too many organizations simply check the box showing that the risk assessment was completed and do not use it the way they should. “Organizations should ask themselves when was their last one. So many even should be driving your security risk analysis (SRA),” he explained. “It is so much more than penetration testing and the incident response team. It is understanding where the threats are coming from and attacking and keeping systems and training up to date to prevent phishing attacks.” Wivoda recommended updating your HIPAA Security Risk Analysis both periodically and any time there are significant changes to the system. In fact, guidance on the HIPAA Security Risk Assessment from HHS says that the risk assessment should be a continual process and, although it must contain the components outlined, it leaves the design of the assessment up to the facility.

Hall pointed to his annual HIPAA Security Risk Assessment Report as a place to document all of the improvements to his systems as well as new threats and increased protections.

Shared Learning from Cybersecurity Incidents

While healthcare organizations and their leaders are often reluctant to speak about their experience and share their cybersecurity incidents with one another beyond what is required, Barnett said that sharing what happened, how it happened, and what is being done about it in various forums is instrumental to creating awareness and combatting threat actors: “The interviews I have done with you are one step. Sharing that information with the National Rural Health Association (NRHA) through a policy paper and speaking about the problem in other forums also increases awareness.” He is part of an NRHA rural hospital contingent reviewing a cybersecurity policy paper under development by NRHA Fellows to share information and assist other rural health organizations in avoiding their own attacks. Hall concurred, “Sharing is a good thing. Organizations want to cloak what happened, which is the opposite of what they should be doing. That is how the attackers can continue to do what they do.”

Sharing is a good thing. Organizations want to cloak what happened, which is the opposite of what they should be doing. That is how the attackers can continue to do what they do.

Hall spoke to the fact that, like the “COVID-19 of IT,” he is always getting alerts about new threats known as “Zero Day” threats — an attack that no one has seen before: “We may have the tools to combat it, but we don't know yet.”

Barnett cautioned that what McKenzie Health System and Estes Park Health experienced could happen to anyone and no organization is immune: “If you are operating in an electronic environment, as most healthcare providers are, it is not if you will suffer a cyber-attack, it is when you will become a victim, and so organizations should make sure they are educating, communicating, and preparing for disaster recovery. They [threat actors] are going to get in.”

Helpful Cybersecurity Resources

American Hospital Association (AHA)
“The AHA is dedicated to helping the health care field better prepare, prevent and mitigate cyber threats. As part of this commitment, AHA has compiled valuable resources to help hospitals and health systems develop their cybersecurity incident preparedness and response initiatives.” Their Cybersecurity Incident Preparedness and Response page has many resources for rural healthcare organizations.

Federal Drug Administration (FDA)
After the WannaCry ransomware attack of 2017, the FDA enlisted MITRE to create the Medical Device Cybersecurity Regional Incident Preparedness and Response Playbook that was published in 2018. It was recently updated in 2022 and a companion Quick Start guide was added.

Federal Trade Commission (FTC)
The mission of the FTC is “protecting consumers and competition by preventing anticompetitive, deceptive, and unfair business practices through law enforcement, advocacy, and education without unduly burdening legitimate business activity.”

The FTC's Health Privacy website has information about complying with the Health Breach Notification Rule among other resources.

Health-ISAC is the Health Information Analysis and Sharing Center. According to its website, the mission of Health-ISAC is to empower trusted relationships in the healthcare industry to prevent, detect, and respond to cybersecurity and physical security events so that members can focus on improving health and saving lives. While Health-ISAC is a membership organization, it offers free resources such as a clinician series on cybersecurity.

Health Sector Cybersecurity Coordination Center
The Health Sector Cybersecurity Coordination Center (HC3) was “created by the Department of Health and Human Services to aid in the protection of vital, controlled, healthcare-related information, and to ensure that cybersecurity information sharing is coordinated across the health and public health sector.” Resources on the website include threat and sector alerts, white papers, and other products.

HHS 405(d) Program
The HHS 405(d): Aligning Health Care Industry Security Approaches is “a collaborative effort between the industry and the federal government to align the healthcare industry security practices to develop consensus-based guidelines, practices, and methodologies to strengthen the healthcare and public health (HPH) sector's cybersecurity posture against cyber threats.”

Indiana Cyber Security Hub
“Utilizing the expertise of healthcare cybersecurity and information security professionals, Healthcare Cyber in a Box is designed to provide organizations with three levels of expert guidance — basic, intermediate, and mature — involving 10 critical areas of cybersecurity — as a FREE resource for creating more of the systems needed for keeping your operations secure while, at the same time, helping to protect your patients and preserving both their digital, as well as physical, well-being.”

According to MITRE's website, MITRE ATT&CK® is a globally accessible knowledge base of adversary tactics and techniques based on real-world observations. The ATT&CK knowledge base is used as a foundation for the development of specific threat models and methodologies in the private sector, in government, and in the cybersecurity product and service community.

MS-ISAC: Multi-State Information Sharing and Analysis Center
According to its website, “The Mission of the MS-ISAC is the overall cybersecurity posture of U.S., State, Local, Tribal and Territorial (SLTT) government organizations through coordination, collaboration, cooperation and increased communication.” While this is a membership organization that has a fee, it has a newsletter that organizations can sign up to receive at no charge as well as other resources that are accessible to non-members.

National Institute of Science and Technology (NIST)
The mission of the NIST is “to promote U.S. innovation and industrial competitiveness by advancing measurement science, standards, and technology in ways that enhance economic security and improve our quality of life.” It has published the Computer Security Incident Handling Guide to aid organizations.

National Rural Health Resource Center (NRHRC)
According to its website, “For more than 25 years, The Center's staff has provided technical assistance, information, tools, and resources to the country's rural hospitals and clinics, rural health networks, State Offices of Rural Health, and other rural stakeholders.” NRHRC published a Cybersecurity Toolkit for Rural Hospitals and Clinics and maintains a website with other tools and resources geared toward rural health organizations.

SANS Institute
The SANS Institute helps organizations mitigate cyber risk by empowering cybersecurity practitioners and teams with training, certifications, and degrees needed to safeguard organizations and advance careers.

Tami Lichtenberg
About Tami Lichtenberg

Lichtenberg has over 20 years of experience in healthcare including policy, EMS, non-clinical and clinical administration.

View all articles by Tami Lichtenberg