Five Building Blocks to a Resilient Healthcare Cybersecurity Culture

By Edward Myers, National Director of Cyber Security, Crothall Healthcare Technology Solutions (HTS)

The Need For A Resilient Healthcare Cybersecurity Culture

US hospitals are stepping up their defenses against cybersecurity attacks. Much of the focus on recent cyber spending is in response to the February 2024 hack of payments manager Change Healthcare. A whopping 94 percent of American Hospital Association members reported suffering a financial impact from the event, with more than half saying the impact was “significant or serious.”

Crothall’s expertise in healthcare technology management, supported by our CyberHUB Defense Team’s specialized focus on medical device cybersecurity, enables close collaboration with healthcare executives and IT experts. Our approach is tailored to address the unique challenges of protecting connected medical devices within clinical environments.

To help your hospital or health system foster a resilient cybersecurity culture, here are five essential building blocks to strengthen security practices across all levels and ensure the protection of your critical medical devices.

1. Cybersecurity Demands Constant Vigilance

With the CISO setting the tone and driving implementation, cybersecurity becomes an ongoing focus embedded into daily operations. Establishing and regularly testing a well-defined incident response plan is essential. More than three-quarters of global healthcare professionals reported experiencing at least one cybersecurity incident at their organizations in 2023, according to Claroty, a cyber security technology company. To build a resilient cybersecurity posture, establishing and regularly testing a well-defined incident response plan is essential. Routine risk assessments help focus on the overall cybersecurity landscape, identifying broad organizational vulnerabilities and prioritizing actions to strengthen defenses across all levels. Incorporating tabletop exercises—allows teams to rehearse their responses in a controlled environment, building preparedness for real-world situations. Continuous monitoring addresses real-time, device-specific threats by detecting unusual activity immediately, enabling quick responses to protect patient care. Medical Device Vulnerability Reports provide in-depth, periodic insights on specific device risks, trends, and resolved issues, offering leadership a clear link between cybersecurity measures and patient safety.

2. Continuous Training and Awareness

Most hospitals recognize their responsibility to train staff regularly on the best cybersecurity practices. Regularly training frontline staff that use and protect medical devices every day helps establish a strong security mindset among hospital employees, significantly reducing a hospital’s attack surface and creating a “human firewall.” Training can be structured into three tiers: general staff, specialized departments (such as radiology), and IT personnel.

• General staff: Training ensures all employees understand basic cybersecurity protocols, like recognizing phishing emails or securing passwords.
• Specialized departments: For departments like radiology, which rely on critical medical devices, more comprehensive training is essential. For example, restricting access to these devices to only trained personnel to mitigate exposure.
• IT personnel: As connected medical devices become more integrated into hospital networks, they introduce unique vulnerabilities that demand specialized knowledge. Advanced training from patch management to device encryption—along with regular protocol updates, and device-focused simulations enhance incident response and strengthen hospital-wide security.

3. Promote Shared Accountability

Everyone needs to understand the potential consequences of their actions. Gone are the days when cybersecurity was solely the IT department’s concern. Hospitals must encourage and empower employees to take ownership of their cybersecurity habits and understand their role in protecting sensitive information. Empowering healthcare workers as the front line of defense is essential to a resilient cybersecurity culture. To promote individual accountability, hospitals should establish clear reporting protocols for suspicious activity or potential threats. Implementing user-friendly reporting tools allows staff to easily communicate potential threats, further encouraging a proactive culture. Helping employees understand how hackers can deploy viruses to infiltrate a network and that malware can be introduced from any vulnerable spot in your network or operating system—from unauthorized downloads to contaminated USB drives—fosters a culture of cyber vigilance.

4. Provide the Right Tools and Resources

Hospitals need more than just awareness and training to stay ahead of cybersecurity threats—they need the right tools in place especially when it comes to protecting medical devices. Real-time monitoring technology helps identify weak spots or potential threats before they escalate. Crothall’s CyberHUB, powered by Asimily, passively monitors and protects connected medical devices in real-time using AI-based risk management technology and supported by our CyberHUB Defense Team. These technologies act like an extra set of eyes watching for unusual activity to catch vulnerabilities early and respond, minimizing the risk of an incident. The goal is to integrate these technologies into your daily operations, so they become a natural part of how you protect your hospital and patients. Beyond technology, it’s crucial to have a clear plan in place for how to respond if something goes wrong. This includes knowing who to call, what steps to take, and how to prevent future issues. Having the right tools and resources isn’t just about technology—it’s about being ready when it matters.

5. Implement Initiatives Gradually

Building a strong cybersecurity culture requires patience and steady effort. Hospital staff already have a lot on their plates, so introducing too many new systems and protocols all at once can easily become overwhelming and that’s when mistakes are more likely to happen.

When rolling out new cybersecurity measures, a good first step is to collaborate with Clinical Engineering, the team responsible for the maintenance and safety of medical devices, to ensure that your Computer Maintenance Management System (CMMS) is up to date with essential details—such as MAC addresses, serial numbers, and hostnames for all IoMT devices. Proactively managing this information reduces risks and keeps essential equipment secure.

When time is of the essence, quick access to this data speeds up troubleshooting and facilitates collaboration among IT, clinical engineering, and medical staff. Consider piloting initiatives with one department, gather feedback, and adjust accordingly before expanding. This allows your hospital to detect and resolve any issues early in the process before expanding hospital wide. Taking these steps not only strengthens your hospital’s security posture, but it also enhances patient safety—ensuring that the devices and systems you count on are not just reliable but are also safe and secure when needed most.

Healthcare Systems Remain Targets for Growing Cyber Threats

As users navigate sophisticated risks, continuous training, shared accountability, and proactive security strategies are essential building blocks to a Resilient Healthcare Cybersecurity Culture. Hospital leaders play a critical role by remaining engaged in cybersecurity efforts, promoting shared accountability, and investing in the right tools and resources, while implementing new initiatives gradually.