By Robert McDermott, President & CEO / iCoreConnect

This is the first article in a three-part series on cyber crime. Phishing and malware, including ransomware, are of particular concern to your practice, because healthcare is the top target of cybercriminals.

“Healthcare, in general, is and has been the number one critical infrastructure sector to be targeted by cybercriminals…This virtually ensures any new attack will target healthcare organizations first and foremost.”
–Health and Human Services Dept. (HHS) Report, April 12, 20181

Health records are worth much more than credit-card data.

The data sitting on the server at your practice is extremely valuable to those who operate in a shadow economy—far more than stolen credit card data. This is why the healthcare industry is the top target of cybercriminals.

A retail store may runs hundreds of credit cards a day. When its data is stolen, each record sells for around $8–$12 per record. But for every health record stolen from your practice, criminals can get about $50 on the shadow market.2

So the data in your hands is worth roughly quadruple that of straight credit card data.

How Cyber Criminals Attack

Malware and phishing are the most common ways cybercriminals try to break into your sensitive patient data.

  • Malware is software with malicious intent that’s operating on your system.
  • Ransomware is a common type of malware criminals use to hold your data or system hostage until you pay a ransom. If you pay, they may or may not release it.
  • Phishing is criminal use of electronic communications—most commonly email—to get malware into a system. The means of infection could be a malicious link in an attached Word document or in an email from someone posing as, for example, IT staff.

Phishing is by far the most common way ransomware takes hold, because it’s the easiest way. It takes only one person in a practice to be tricked by an email pretending to be from someone or something it’s not. Opening an attachment such a PDF, or clicking on a link in an email can either install the malware, or lead the user to a real-looking site that captures a username and password.

HIPAA-compliant email exchange system iCoreExchange is unable to be phished; is encrypted at the highest levels, and stores its data remotely. It’s available standalone, or as part of iCoreDental, an ONC-certified practice management EHR software.
Learn more about iCoreExchange


1https://www.aha.org/system/files/2018-04/corrected-HCCIC-2018-002W-SamSam-Ransomware-Campaign.pdf
2https://www.dentistryiq.com/articles/2018/04/prevent-medical-identity-theft-empower-dental-health-care-workers.html