Best practices for healthcare delivery organizations to manage supply chain cybersecurity risks

The Cloud Security Alliance (CSA) released a paper titled Healthcare Supply Chain Cybersecurity Risk Management. Drafted by the Health Information Management Working Group, the report provides best practices that healthcare delivery organizations (HDOs) can use to manage the cybersecurity risks associated with their supply chains.

HDOs face risks from many different types of supply chain vendors, everything from food suppliers, software providers, medical devices, pharmaceuticals, and day-to-day medical supplies. This complexity and extended interdependency dramatically increases the consequences of a cyber incident, ranging from the leakage of sensitive personal information to the disruption of the actual provision of the supply chain.

“Healthcare delivery organizations spend billions of dollars across thousands of suppliers each year. However, research indicates that current approaches to assessing and managing vendor risks are failing. The move to the cloud and edge computing have expanded HDOs’ electronic perimeters, not only making it harder for them to secure their infrastructure but also making them more attractive targets for cyberattacks.

“Given the importance of the supply chain, it’s critical that HDOs identify, assess, and mitigate supply chain cyber risks to ensure their business resilience,” said Dr. James Angle, the paper’s lead author and co-chair of the Health Information Management Working Group.

Cyberattacks are more costly than ever as HDOs and their suppliers remain high-value targets. Moreover, problems with current approaches to supply chain risk management are creating additional economic burdens as organizations are experiencing an increase in fines and investigations from the Department of Health and Human Services and the Office of Civil Rights.

“Unfortunately, supply chain exploitation is not just a potential risk, it is a reality. An insecure supply chain can significantly impact an HDO’s risk profile and security, not to mention its bottom line,” said Michael Roza, risk, audit, control, and compliance professional, CSA Fellow and a contributor to the paper. “It’s incumbent on HDOs, therefore, to ensure that their supply chain partners comply with data management policies in order to keep their organizations and their users safe.”

When addressing cyber risk and security within the supply chain, it’s recommended that HDOs:

• Inventory all suppliers, then prioritize, and identify those they consider to be strategic suppliers
• Tier suppliers based on risk, using a third-party risk rating service if possible
• Contractually require suppliers to maintain security standards
• Develop a schedule for reevaluating suppliers