Guarding your practice against cyber threats: Real-life lessons and practical tips

Cybersecurity is a crucial aspect of running a medical practice. An Avant webinar on cybersecurity and privacy highlighted an all-too-common scenario, the ramifications, and practical tips to help protect your practice.  

The phishing email 

Mary^*, a receptionist at a busy medical practice, received an email that looked like it was from their telecommunications provider. The email included a link to view an outstanding bill. After clicking the link and entering her Microsoft 365 email and password, Mary realised there was no bill.  

The next day, patients started calling about emails they received from the practice, asking them to click a link to view their test results. It turned out the email was a phishing attempt. By entering her credentials, Mary had unknowingly given hackers access to the practice's email account. The hackers then used this access to send phishing emails to patients.  

To prevent these kinds of incidents, it's crucial to implement multi-factor authentication (MFA) to add an extra layer of security and prevent unauthorised access even if passwords are compromised. Regularly training staff to recognise phishing emails and other cyber threats is also essential. Additionally, avoid using email as a storage system for sensitive information; instead, transfer important data to secure storage locations and delete unnecessary emails. 

The network compromise 

Following the phishing attack, the practice's IT provider conducted a thorough threat hunt to check for any further network compromise. They discovered the entire email inbox, containing five years of emails, had been downloaded by the hackers. This meant the hackers had access to a significant amount of sensitive patient information. 

To mitigate these risks, it's important to ensure all critical data is backed up regularly and stored securely, separate from the main network. Engaging an external IT provider with healthcare experience can help implement robust cybersecurity measures and conduct regular security audits. Additionally, developing a contingency plan to prepare for cyber incidents and ensure operations can continue if systems are compromised is vital. 

The data breach notification

The practice, with the help of a law firm, assessed the data breach and determined it was likely to cause serious harm to individuals. They notified the Office of the Information Commissioner (OAIC) and took steps to contact affected patients. The practice reviewed all emails to identify affected individuals and notify them about the breach, providing guidance on how to protect their data.  

To handle such situations effectively, it's important to be aware of the requirements under the Notifiable Data Breach scheme and take appropriate steps to notify affected individuals and authorities. Working with legal and public relations experts to create clear and concise communications for patients is crucial. Plus, providing support to staff involved in the incident to manage stress and ensure they understand the steps being taken to resolve the issue is key. 

The importance of cyber insurance 

Despite best efforts to prevent cyber incidents, they can still occur. Cyber insurance, such as the one offered through Avant Practice Medical Indemnity Insurance, can provide protection and support in the event of a cyber-attack. It can cover cyber incidents involving digital asset damage, extortion, and reputational damage. 

Key lessons: 

• Implement multi-factor authentication (MFA): MFA adds an extra layer of security, making it harder for hackers to access your systems.  
• Train staff regularly: Regular staff training ensures everyone can recognise and respond to cyber threats. 
• Ensure regular backups and engage an external IT provider: Regularly back up critical data and store it securely, separate from your main network. An external IT provider with healthcare experience can help implement strong cybersecurity measures and conduct regular audits. 
• Develop a contingency plan: Have a plan in place to maintain operations during a cyber incident.  
• Understand legal obligations: Understand your legal obligations under the Notifiable Data Breach scheme to ensure timely notification of affected individuals and authorities. 
• Consider cyber insurance for financial protection and expert support: Cyber insurance provides financial protection and expert support in the event of a cyber-attack, covering costs like data recovery, legal fees, and reputational damage. 

More information 

If you are a victim of a cyber-attack on your practice and you are an Avant practice policy holder, you can contact the medico-legal advice team here, or call 1800 128 268, 24/7 in emergencies. 

Not an Avant practice policy holder? Protect your practice with Avant’s comprehensive practice indemnity and complimentary cyber cover for eligible practices. Learn more about our policies here. 

Useful resources

Avant webinar: Protecting your practice: A webinar on cybersecurity and privacy 

Avant case study: Unauthorised access to patient records  

Avant factsheet: Storing, retaining, and disposing of medical records  

Avant factsheet: Responding to a cyber security incident 

*Fictional character

Disclaimers