Protecting Your Practice from Supply Chain Attacks

We know cyber threats are constantly evolving with attackers seeking new ways to access systems and networks. We’re also aware our security is only as strong as our weakest link. Healthcare supply chain attacks rely on that, and further, rely on vendor software being a blind spot.

As healthcare increasingly relies on technology, and with patient care and practice administration being paramount, many practices rely on the resources provided by software vendors to support everything from RCM and communications to healthcare workflows. With those reliances likely to increase, practices need to understand supply chain attacks and how to reduce their risk.

What is a Supply Chain Attack?

A supply chain attack is a cyberattack that targets an organization’s external vendors or service providers, exploiting security vulnerabilities within the supply chain to gain unauthorized access to the main network.

In a healthcare supply chain attack, rather than attacking a healthcare practice directly, cybercriminals focus on third-party vendors such as software providers, medical device manufacturers, or cloud service platforms, which may have weaker security controls. Once compromised, these trusted partners can serve as a gateway for attackers to infiltrate sensitive systems. Essentially, it can become like a chain of dominoes, toppling one system after another.

For healthcare practices, supply chain attacks pose a significant threat, not only to workflows but also to patient data and HIPAA compliance.

As an example, the Change Healthcare of attack in 2023 highlighted the widespread and devastating impact of an attack on a supply chain. In that case, the consequences have been long-lasting and may continue for years to come. The direct and immediate impact meant that not only could healthcare providers not access records or process payments, but patients were also unable to get necessary prescriptions.

As we saw with the Change Healthcare attack, assaults on the supply chain can even prevent practices from conducting business, processing payments, and ensuring the financial security of their practice or organization.
In short, these attacks may not only lock down systems, but they can also expose EHRs, billing systems, and other critical data to malicious actors, and in some cases, the dark web or other hackers.
Given the complexity of healthcare supply chains and the volume of external services used, the risk of attack is heightened, making it crucial to ensure all partners maintain rigorous security and compliance standards and practices utilize Business Associate Agreements (BAA).

To better protect your organization, it’s important to understand how supply chain attacks happen.

How Do Healthcare Supply Chain Attacks Happen?

One of the most common ways is through software updates. Vendors often push automatic updates to their products, and cybercriminals can compromise these updates to inject malicious code into healthcare systems. If a healthcare provider relies on an affected software platform, the malware gets installed without detection, opening pathways for data theft, ransomware, or system disruption. This is what occurred in a 3CX attack, where a compromised software update allowed attackers to access healthcare communications networks.

Similarly, vulnerabilities in cloud services and medical devices also create entry points for attackers. Many healthcare organizations rely on third-party cloud platforms for storing and managing patient data; and if these platforms have weak security protocols, they become prime targets for cybercriminals.
In the same way, connected medical devices that run on third-party software are vulnerable if they lack adequate encryption, authentication, or regular patching. The Philips Healthcare Devices breach in 2023 highlighted this risk, as attackers exploited vulnerabilities in medical device software to access healthcare networks.

Other vulnerabilities include weak vendor cybersecurity policies, lack of regular security assessments, and insufficient monitoring of third-party access. If a vendor does not adhere to strict security practices, it can expose the healthcare provider to risks like phishing, ransomware, or data breaches.

The Impact of Healthcare Supply Chain Attacks

Particularly in healthcare, supply chain attacks have emerged as a significant cybersecurity risk. With the increasing reliance on interconnected software platforms, medical devices, and cloud-based services, healthcare practices face greater vulnerability to such attacks. The protection of sensitive patient information and maintaining compliance with regulations, including HIPAA, are paramount.

One of the primary concerns in healthcare is the potential exposure of ePHI due to supply chain vulnerabilities. A compromised vendor can give cybercriminals access to the entire healthcare network, jeopardizing data such as patient records, billing information, and even clinical workflow systems. This not only puts the practice at risk of violating HIPAA regulations, which mandate strict data protection standards, but can also lead to hefty fines, legal liabilities, and a loss of patient trust.
As supply chain attacks grow more sophisticated, it’s essential for healthcare organizations to be proactive in managing their third-party relationships, ensuring every vendor adheres to stringent cybersecurity protocols. This is why BAAs are essential, though not a security guarantee. With healthcare already a high-value target for attackers, protecting the extended supply chain is crucial for maintaining security and compliance.

Though supply chain attacks are on the rise and an increasing cybersecurity threat, they’re not a new phenomenon. Sadly, Change Healthcare is only one example out of many.

Supply Chain Attacks in 2023: Were You Impacted?

MOVEit

MOVEit is a managed file encryption and transfer software used by many organizations. Cybercriminals exploited a vulnerability in the software to access and steal sensitive data from affected systems. Healthcare organizations relying on MOVEit for secure file transfers were compromised, leading to the exposure of protected health information (PHI) and other confidential data.

United Healthcare

In this supply chain attack, hackers targeted a third-party vendor United Healthcare used for secure file transfers: IBM’s Aspera. Exploiting a vulnerability in Aspera’s software, cybercriminals gained access to sensitive data, including personal health information (PHI) of United Healthcare members.

NextGen

A ransomware attack on a third-party vendor that provided services to NextGen Healthcare, a healthcare technology provider, led to the exposure of sensitive patient data, including protected health information (PHI). This breach potentially affected NextGen’s HIPAA compliance.

Philips Healthcare Devices

This attack involved exploitation of vulnerabilities in software integrated into Philips medical devices. Attackers potentially accessed sensitive healthcare data and disrupted device functionality. As Philips devices are widely used in healthcare settings, the attack raised concerns about the security of Internet of Things (IoT) medical technologies and emphasized the risks posed by third-party software.

Brightline

A vulnerability in the platform of a third-party vendor was exploited, leading to exposure of sensitive patient data in the supply chain attack of Brightlane. Brightlane is a telehealth provider specializing in behavioral healthcare, and relied on this vendor for critical services. The breach compromised the protected health information (PHI) of numerous patients.

3CX

Hackers infiltrated a popular communications software, 3CX, injecting malicious code into the company’s software update mechanism. Healthcare organizations using 3CX for communication services were affected, as the malware provided attackers with access to sensitive information, which potentially included patient data.

Top Strategies to Decrease Your Risk

Protecting your practice from healthcare supply chain attack risks requires a multi-layered approach—addressing technical safeguards and vendor management practices.
Thankfully, there are critical strategies you can use to minimize the risks associated with supply chain attacks. Let’s go through them.

1. Conduct thorough vendor assessments.

• Ensure vendors have up-to-date security certifications (e.g., SOC 2, HITRUST).
• Review third-party vendors’ security policies to ensure HIPAA compliance.
• Evaluate vendors’ incident response procedures and their ability to handle breaches.
• Require vendors to share their history of security breaches and corrective actions taken.
• Develop comprehensive Business Associate Agreements (BAA) to help protect ePHI and data.

2. Establish strong contracts with security clauses.

• Include clauses in vendor contracts that require adherence to your security policies.
• Mandate timely notification in the event of any data breaches or security incidents.
• Specify penalties for non-compliance with HIPAA and other data protection regulations.

3. Implement zero-trust architecture.

• Limit vendor access to your systems based on the principle of least privilege.
• Use network segmentation to minimize the spread of any potential breaches from vendor systems.
• Regularly audit user access and permissions granted to third-party vendors.

4. Enforce regular software updates and patching.

• Require vendors to provide regular updates and security patches.
• Establish a policy for timely internal patch management and system updates.
• Verify that medical devices and other vendor-supplied technology are regularly patched against the latest vulnerabilities.

5. Enhance encryption and data protection standards.

• Use end-to-end encryption for all data transfers between your practice and vendors.
• Require third-party systems to meet advanced encryption standards for sensitive data, especially patient health information.

6. Implement multi-factor authentication (MFA).

• Enforce MFA for any system access involving external vendors, especially those accessing sensitive patient data.
• Regularly review MFA logs and activity for any unusual or suspicious login attempts.

7. Conduct ongoing vendor monitoring.

• Continuously monitor vendor behavior for signs of malicious activity or unusual patterns.
• Conduct periodic security audits and assessments of your vendors’ networks.
• Leverage threat intelligence feeds to stay informed about vendor-specific risks.

8. Develop a vendor-specific incident response plan.

• Create incident response workflows that include steps for addressing vendor-related security incidents.
• Ensure vendors are aware of their role in your practice’s incident response plan.
• Regularly test your plan to ensure it’s effective and all parties know their responsibilities.

Following these strategies can help you significantly reduce the risks associated with a supply chain attack, maintain HIPAA compliance, and safeguard patient data. Additionally, working with software and platform providers that have healthcare expertise can be beneficial.