June OCR Cybersecurity Newsletter

In the June OCR Cybersecurity Newsletter, HHS reminds us of just how important the authentication process is.  Multi-Factor Authentication (MFA) is crucial in healthcare environments to protect sensitive information like electronic protected health information (ePHI).

Weak or non-existent authentication processes can leave healthcare organizations vulnerable to cyber intrusions and data breaches. Recent analyses have shown that 86% of attacks targeting internet-facing systems in organizations use stolen or compromised credentials. Implementing MFA serves as a vital defense against malicious intrusions by requiring multiple factors, such as passwords and biometric data, to verify users' identities.

Poor authentication practices have contributed to high-profile cyber-attacks and data breaches. For example, a major food company temporarily shut down plants due to a ransomware attack that exploited an old administrator account protected by a weak password. Similarly, a major fuel pipeline was targeted in a ransomware attack that began with a single stolen password linked to an old user profile. Strengthening authentication processes, particularly through MFA, can impede or prevent such attacks that rely on weak or stolen passwords.

Authentication involves confirming a person's identity before granting access to resources. Multi-factor authentication requires the use of multiple distinct factors, making it harder for attackers to gain unauthorized access. However, not all MFA solutions are equally effective, and organizations should adopt phishing-resistant options that can detect and prevent authentication data disclosures. Several organizations, including NIST, CISA, and HHS, advocate for the use of MFA in healthcare. Compliance with the HIPAA Security Rule, which mandates authentication procedures to safeguard ePHI, is essential. Implementing strong authentication solutions, like MFA, is crucial for protecting healthcare data and mitigating cyber risks.

Note: For a more comprehensive understanding of the importance of MFA in healthcare environments and related best practices, please refer to the HHS newsletter June 2023 OCR Newsletter.