Guarding against a cyber attack on your practice

A cyber-attack can have a devastating impact on your medical practice, potentially locking out clinical and administration systems for weeks and breaching patient privacy

Every medical practice using the internet is at risk of a cyber incident. However, practice owners and managers can be prepared for and minimise the risks of a cyber incident by having clear IT security policies and procedures for all practitioners and staff.

A hard cyber lesson

Avant member Mary (a pseudonym), spoke to Avant about the devastating impact of a ransomware attack on her practice.

It was a hard lesson on why cyber security policies and procedures are essential in every practice, particularly ensuring your backup is secure.

Mary described the cyber-attack at her practice as a catastrophe. The practice had a policy of changing passwords regularly. Beyond that, like many medical practices, it had relied on its IT provider to deal with cyber security and IT systems. The practice did not have a separate cyber response plan and staff in the practice felt unprepared to respond to a cyber incident.

When the attack happened, the paperless practice suddenly found it had no information on any patients. It discovered its backup was not sufficiently secure and had been infected as well. Ultimately all systems, data and backup files were inaccessible, from appointment books to patient records. It was five weeks before all patient information was recovered.

Finding the right IT provider

Mary’s experience also highlighted the importance of having an IT provider with the expertise and experience to understand your practice’s needs and help protect you from cyber incidents. Organising an IT risk assessment to identify any weaknesses in your system may also help offer you reassurance.

Recognising a cyber attack

It can be difficult to recognise a cyber incident, which may appear to be an internet connection or service provider problem.

Typical symptoms include the system not starting normally or repeatedly crashing, or the internet browser going to unwanted pages or advertisements popping up in an unusual manner.

Minimise the damage

If your practice experiences IT problems, assume the worst and shut down all computers, including unplugging from power points.

Be aware that if you try to restore your files from your backups while your system is still exposed to the attack, you may infect your backup. Do not connect the backup data or any portable devices such as laptops to the network. Contact your IT provider immediately.

Don’t rely on being able to pay to restore your data

Seek advice from Avant and IT experts if you receive a ransomware demand.

Mary’s practice received a ransom demand about 24 hours after the cyber-attack. After four weeks of being unable to access data and backup files, the practice owners decided to pay the ransom.

Be aware though that even if you do get a decryption code, this is no guarantee you will get all your data back. In Mary’s case, it took another week before the decryption code worked. Recent reports also now suggest ransomware files may corrupt data, so even getting it decrypted may not restore everything that was lost.

The Australian Cyber Security Centre advises against paying ransoms. In some circumstances, paying ransomware may be an offence under Commonwealth legislation that prohibits money laundering or payments to terrorist organisations.

Recreating patient records

While trying to get data restored, Mary’s practice had to rebuild its data systems, including medical records, because the backup files were also inaccessible.

If a practice has separate and secure backups, it may be able to retrieve clinical and administrative information and be operating as normal within a few days of an attack. However, when backup files cannot be accessed, the practice will have to gather patient information from other sources. You may also be able to access information from a patient’s My Health Record.

Lack of access to electronic medical records will make patient care difficult, but in most cases you should continue to see patients, unless you are unable to provide adequate health care.

In Mary’s case the practice appointments were in the IT system that could not be accessed. When a patient arrived for an appointment, the practice took demographic details and contacted the patient’s GP, other specialists, pathology/imaging practices, pharmacists and hospitals to provide clinical data for the patient.

The most concerning aspect for Mary was not knowing if patients had not attended an appointment.

Patient privacy

Mary contacted Avant for advice as soon as she became aware of what had happened at the practice. She was particularly concerned about privacy obligations. The Office of the Australian Information Commissioner (OAIC) did ask the practice for information about the incident. In this case it was ultimately agreed that as the firewall had not been breached there was no reasonable chance that data had been accessed by unauthorised people or exported. Therefore, there was no obligation to report the incident to the OAIC under the Notifiable Data Breach scheme.

However, this may not always be the case. Whenever there is a cyber incident, the practice owners or manager should check if the incident is a notifiable data breach that needs to be reported to the OAIC and patients under the Notifiable Data Breach scheme.

Why cyber security is essential in your practice

What happened to Mary and her colleagues is a sobering warning of what can happen if your medical practice does not have cyber security policies and procedures.

Their experience alerted other practices to the risks of cyber-attack. Mary said that every practice contacted to retrieve patient data looked at their systems after hearing what had happened.

The main lessons from Mary’s experience were:

• Ensure your backup is safe, secure and impenetrable.
• Have strong cyber security policies and procedures in place and ensure all practitioners and staff adhere to these, especially password security.
• Conduct a cyber audit. Mary said she would now recommend getting a second opinion on IT security from another provider or consultant to ensure there are no weaknesses in the system, rather than relying on one provider.

Useful resources:

• Avant: Cyber security - What you need to know
• Australian Cyber Security Centre
• Office of the Australian Information Commissioner: What is a notifiable breach?
• RACGP: Information security

More information

For medico-legal advice, please contact us here, or call 1800 128 268, 24/7 in emergencies.