Risk management focusing on the best practices of data security systems for healthcare

Abstract

Objective of the study: Statistics shows a worrisome picture of challenges to be overcome by cybersecurity in the healthcare sector. Data evidence that the healthcare industry experiences four data breaches per week in the United States alone, making it the sector most often affected by digital security breaches. Thus, the current article aims to investigate risk management focusing on identifying requirements and best practices for healthcare data security systems.Methodology/approach: It is based on a systematic literature review. Studies on state-of-the-art data security systems were collected and interpreted through content analysis. Assertive keywords, source-selection criteria, interpretation of selected articles, and database analysis were used to form the investigated sample and to represent the broad applications of this study’s objective.Originality/Relevance: The current study contributes to define a set of minimum requirements and best practices that can be adopted to manage data security risks in the healthcare sector and medical devices.Main results: Results have pointed out that there is no fully effective way to prevent all violations by cybercriminals; however, cybersecurity must be part of management processes adopted by different organizations.Theoretical/methodological contributions: It is found that cybersecurity has a great importance for the healthcare sector, the information generated is rich in content and that cybersecurity is neglected in the sector, that is not able to deal with the reality of cyber threats in the industry 4.0 context.Social /management contributions: By the good risk management practices and the adoption of minimum security items, institutions can ensure that managers can prepare and respond efficiently to cyber risks.

A Systematic Literature Review on Cybersecurity Threats to Healthcare Data and Mitigation Strategies

“…Another human factor-related mitigation strategy against cybersecurity attacks is password management. Access to computing resources and healthcare data should be restricted to users that have been authenticated through username and password (Bhuyan et al, 2020;Dias et al, 2021). It is not uncommon for end-users to use weak and easy-to-guess passwords.…”

“…It is not uncommon for end-users to use weak and easy-to-guess passwords. Hence, healthcare institutions should encourage, and when necessary, enforce the use of strong passwords by employees (Bhuyan et al, 2020;Dias et al, 2021). Some of the password security measures that could be incorporated into a holistic cybersecurity strategy include (Dias et al, 2021;Elhoseny et al, 2021;Jalali & Kaiser, 2018;Nunes et al, 2021):…”

“…Hence, it is vital that different components of IT infrastructures, including hardware and software, are adequately maintained and upgraded to ensure that cybercriminals do not exploit their weaknesses to gain access to healthcare data (Alodaynan & Alanazi, 2021;Elhoseny et al, 2021). IT infrastructure management can also entail vulnerability management, where the vulnerability of an institution to cyberattacks is regularly assessed and classified to determine their order of priority (Dias et al, 2021). Rather than reacting to cyberattacks, healthcare institutions can be proactive by implementing intrusion detection and prevention systems to monitor their networks for suspicious activities, generate alerts to them, and automatically launch the predefined countermeasure to a potential cyberattack (Elhoseny et al, 2021;Radoglou-Grammatikis et al, 2021).…”

“…Rather than reacting to cyberattacks, healthcare institutions can be proactive by implementing intrusion detection and prevention systems to monitor their networks for suspicious activities, generate alerts to them, and automatically launch the predefined countermeasure to a potential cyberattack (Elhoseny et al, 2021;Radoglou-Grammatikis et al, 2021). A risk management approach to cybersecurity countermeasures entails conducting cybersecurity risk assessments on the configuration of health data storage location, identification of areas of vulnerabilities and recording them on a risk register, determining the severity and impact of each risk, and the preferred order of implementation of protective measures for each risk (Abraham et al, 2019;Bhuyan et al, 2020;Dias et al, 2021).…”

“…Access management entails specifying who has access to which healthcare data, and at what level (Elhoseny et al, 2021). Effective access management can mitigate insider threats (Dias et al, 2021), reduce unnecessary exposure, and inadvertent disclosure of healthcare data by unsuspecting employees (Bhuyan et al, 2020;Dias et al, 2021).…”