Cyber security framework gaps can be a costly oversight

From July to December 2023, the healthcare industry reported the most data breaches to the Office of the Australian Information Commissioner (OAIC)¹. Yet, many practices and sole practitioners operate without a cyber security framework — exposing them to risks that are costly.

Ignoring the problem can have dire results. A cyber-attack is not a question of 'if' but 'when,' as these Avant case studies show.

Data phishing

A medical practice received a phishing email disguised as a message from an existing patient, prompting staff to download a file via a malicious link.

After their login credentials failed, they contacted their IT provider, who quickly disabled the affected accounts. Since the hacked accounts did not have admin rights and weren’t linked to the practice’s software, only the mailbox contents were exposed. These included referral letters and personal information such as drivers' licence details and Medicare numbers.

Fortunately, the practice had complimentary cyber insurance with Avant, as part of their practice medical indemnity policy, and external experts were engaged for forensic analysis which identified 500 patients’ details were compromised.

Medicare fraud

A member had a laptop stolen, which they used to process Medicare claims through a secure payment platform.

Despite password protection on both the laptop and platform, criminals accessed patient information and updated bank account details to commit Medicare fraud.

The payment platform was able to identity the impacted patients, fewer than 100, and trace the criminals' IP address. With no other programs on the device, the evidence was minimal, and a full forensic analysis was not a viable option.

Email hacked

While working in shared rooms, a member discovered their secured email account had been hacked, resulting in nearly 4,000 emails being sent to patients and triggering a reportable privacy breach to the OAIC. The member did not have cyber insurance and notified Avant under their practitioner indemnity policy, but unfortunately the claim did not cover forensic analysis costs. However, Avant was still able to assist the doctor.

Avant’s assistance

In all three cases Avant’s Claims and Risk Advisory Service teams were able to assist with reporting obligations to the OAIC, notifications to impacted patients and remedial actions including implementing cyber security frameworks.

The first line of defence

The financial impact of a data breach can be significant. On average, each breach can cost a small medical practice approximately $46,000². Cybercriminals can access your sensitive information from various sources, some obvious and some less apparent.

While cyber insurance may cover costs from a cyber event, it may not protect your reputation. You and your team need to establish cyber and privacy awareness frameworks as the first line of defence and ensure staff receive ongoing training in these areas.

Your frameworks must demonstrate reasonable steps, as required under the Privacy Act 1998 (Cth), to protect patients' sensitive information from misuse, interference, loss, and unauthorised access, modification, or disclosure.

Also, having multi-factor authentication systems in place will significantly enhance your cyber security by reducing the likelihood of unauthorised access.

The importance of cyber insurance

If your practice is attacked and you don’t have cyber insurance, you’ll need to cover the costs of forensic investigations, which can be significant. Additionally, appropriate cover is essential for managing damage to your practice’s digital assets, regulatory defence costs, and business interruption expenses.

Avant provides complimentary cyber cover* (to eligible practices) with its medical practice indemnity policy. This can be invaluable in avoiding these financial burdens.

Summary

No practice or sole practitioner is immune from a cyber-attack.  By acknowledging the inevitability of an attack and taking proactive measures, you mitigate risks and are better equipped to handle a cyber-attack if it arises.

Your practice's first defence should be a strong cyber security and privacy framework, along with staff training in these areas.

While Avant can assist members with reporting obligations, if you experienced a significant cyber-attack, without cyber insurance, you will likely have to deal with it on your own and at a considerable cost.

More information

For medico-legal advice, please contact us on nca@avant.org.au or call 1800 128 268, 24/7 in emergencies.

For Avant Risk Advisory Services visit avant.org.au/risk-advisory-services.