网络安全评级与医院数据泄露风险之间的关系。
The relationship between cybersecurity ratings and the risk of hospital data breaches.
机构信息
School of Global Health Management and Informatics, College of Community Innovation and Education, University of Central Florida, Orlando, Florida, USA.
Owen Graduate School of Management, Vanderbilt University, Nashville, Tennessee, USA.
出版信息
J Am Med Inform Assoc. 2021 Sep 18;28(10):2085-2092. doi: 10.1093/jamia/ocab142.
OBJECTIVE
We investigated the progression of healthcare cybersecurity over 2014-2019 as measured by external risk ratings. We further examined the relationship between hospital data breaches and cybersecurity ratings.
MATERIALS AND METHODS
Using Fortune 1000 firms as a benchmark, time trends in hospital cybersecurity ratings were compared using linear regression. Further, the relationship between hospital data breaches and cybersecurity ratings was modeled using logistic regression. Hospital breach data were collected from US HHS, and cybersecurity ratings were provided by BitSight. The resulting study sample yielded 3528 hospital-year observations.
RESULTS
In aggregate, we found that hospitals had significantly lower cybersecurity ratings than Fortune 1000 firms, however, hospitals have closed the gap in recent years. We also found that hospitals with the low security ratings were associated with significant risk of a data breach, with the probability of a breach in a given year ranging from 14% to 33%.
DISCUSSION
Recent cyber-attacks in healthcare continue to illustrate the need to better secure information systems. While hospitals have reduced cyber risk over the past decade, they remain statistically more vulnerable than the Fortune 1000 firms against botnets, spam, and malware.
CONCLUSION
Policy makers should continue encouraging acute-care hospitals to proactively invest in security controls that reduce cyber risk. Best practices from other sectors like the financial services sector could provide useful guides and benchmarks for improvement.
目的
通过外部风险评级来衡量，我们研究了 2014-2019 年期间医疗保健网络安全的发展情况。我们进一步研究了医院数据泄露与网络安全评级之间的关系。
材料和方法
我们以财富 1000 强公司为基准，使用线性回归比较了医院网络安全评级的时间趋势。此外，我们使用逻辑回归对医院数据泄露与网络安全评级之间的关系进行了建模。我们从美国 HHS 收集了医院违规数据，网络安全评级由 BitSight 提供。该研究样本共包含 3528 个医院年观测值。
结果
总体而言，我们发现医院的网络安全评级明显低于财富 1000 强公司，但近年来差距有所缩小。我们还发现，安全评级较低的医院与数据泄露的风险显著相关，在给定年份发生违规的概率从 14%到 33%不等。
讨论
最近医疗保健领域的网络攻击继续说明了需要更好地保护信息系统。尽管过去十年医院的网络风险有所降低，但与财富 1000 强公司相比，它们在僵尸网络、垃圾邮件和恶意软件方面仍然更容易受到攻击。
结论
政策制定者应继续鼓励急症护理医院积极投资于降低网络风险的安全控制措施。来自金融服务等其他行业的最佳实践可以为改进提供有用的指南和基准。
Zotero 插件