Cybersecurity best practices for nonprofit healthcare boards

As guardians of your nonprofit healthcare organization’s mission, you’re instrumental in ensuring that quality care reaches those who need it most. Today, we dive into a crucial mission of a different kind – safeguarding your digital realm. You’ll discover why cybersecurity best practices for nonprofit healthcare boards are so critical and why they’re your secret weapon for continuing to be able to serve your community’s healthcare needs in our digital age.

Protecting sensitive patient information, preventing cyberattacks, and safeguarding the organization’s finances are three major reasons why community healthcare and volunteer hospital boards should focus on cybersecurity. It’s not an easy task, considering that cyberattacks and the cybersecurity measures designed to protect against them are continuing to evolve.

According to Insider Intelligence, there were 1,463 cyberattacks per week on healthcare organizations in 2022, up by 86% from the previous year. In addition to downtime, ransoms, and lost data, cyberattacks can cause negative outcomes for vulnerable people. Beyond that, healthcare organizations may suffer from the loss of donations and damage to stakeholder relationships, both of which are vital for nonprofit healthcare organizations.

Cybersecurity best practices: Why they’re critical for healthcare boards

A data breach in the healthcare industry is an expensive matter. The IBM Cost of a Data Breach Report 2023 shows that the average cost of a data breach in the healthcare industry is $10.93 million, which is the most expensive cost of all industries. Since 2020, healthcare data breach costs have increased by an alarming 53.3%.

A brief look at the following statistics will demonstrate the importance of focusing on cybersecurity in the nonprofit healthcare arena:

• The healthcare industry was one of the three most attacked industries in the world in 2022.
• Healthcare organizations each reported an average of 1,410 cyberattacks every week in 2022 (86% higher than in 2021).
• The healthcare industry ranks second in the United States for the most cyberattacks in the country.

In addition to the drain on financial resources, data breaches can cause multiple problems for healthcare organizations, including fraud, identity theft, breach of privacy, delayed treatments, computer network shutdowns, and more.

Cybersecurity best practices are crucial for volunteer boards working in nonprofit healthcare for several reasons:

• Confidentiality: Volunteer boards often deal with sensitive information, such as financial reports, strategic plans, and personal data of members or beneficiaries. Ensuring the confidentiality of this information is essential to maintaining trust and protecting the organization’s interests.
• Data Protection and Privacy: Many countries have data protection laws (GDPR in Europe, HIPAA and the California Consumer Privacy Act in the U.S., Personal Information Protection and Electronic Documents Act in Canada, etc.) that mandate organizations to safeguard personal information. A breach of such data can lead to legal consequences and damage the board’s reputation.
• Preventing Insider Threats: While volunteers generally have good intentions, there is always a risk of insider threats. For example, someone within the board could misuse or leak sensitive information. Securing communications reduces this risk.
• Risk Management: Volunteer boards are responsible for managing the organization’s risks. Implementing secure communication practices is an important aspect of overall risk management.
• Trust and Reputation: A board that takes data security seriously demonstrates its commitment to the organization’s well-being and the trust of its members and stakeholders. In contrast, a data breach can severely damage the board’s reputation and credibility.
• Compliance: In the healthcare sector, some specific regulations or standards require secure practices. Adhering to these rules is essential for legal and regulatory compliance.
• Preventing Financial Fraud: Volunteer boards often handle financial transactions and budgets. Best practices reduce the likelihood of fraud attempts and financial mismanagement.
• Long-Term Sustainability: Ensuring cybersecurity contributes to the long-term sustainability of the organization. Protecting its assets, reputation, and data is vital for its continued success.

Boards can use encrypted communication tools, establish clear cybersecurity protocols, provide cybersecurity training for members, and regularly assess and update their security measures to adapt to evolving threats.

With increased cyberattacks on healthcare organizations, everyone must play in cybersecurity best practices including volunteer board members.

Ensuring your healthcare board is equipped to navigate this evolving landscape is paramount. Our Cyber Risk & Strategy Certification is designed to empower board members and executives to confidently execute their role in providing strategic direction and oversight of cyber risk and emerging technologies. Ready to bolster your board’s cyber resilience? Don’t miss our exclusive discounts for healthcare and other mission-driven organizations.

———————————————————————————————–

Cyber risks affecting healthcare organizations

Data breaches, ransomware attacks, insider threats, social engineering, weak passwords, email attacks, mobile device risks, ensuring compliance, and phishing are just a few of the cyber risks facing nonprofits in the healthcare space. While these are risks associated with all organizations, healthcare boards also face industry-specific risks.

For example, while telehealth appointments offer convenience and flexibility for patients, they pose new risks for healthcare organizations. One study on the privacy and security risk factors related to telehealth services highlights the following risks of telehealth appointments:

• Risks of video visits being hacked
• Security risks due to cellular technology or public Wi-Fi networks
• Risks of miscommunications between patients and providers or inaccurate assessments due to poor quality of video and audio outputs

Additionally, cyber risks for healthcare encompass the following:

• Electronic health record keeping and CRM software
• Appointment booking, telemedicine, and e-prescription software
• Remote medical diagnosis, patient monitoring, and remote medical imaging software
• Health tracking apps and mobile health apps
• Hospital management systems and medical billing software
• Medical research and clinical trial management software

Boards must oversee all the different technology their healthcare organization uses to ensure the platforms are safe from cyberattacks.

10 tips for best practice for cybersecurity for healthcare boards

Here are ten best practices for cybersecurity for healthcare boards to follow. These are things you can implement today in your organization to make it more proactive and resilient against cyberthreats.

1. Establish a cybersecurity committee: This committee should be responsible for identifying cybersecurity risks, assessing them, and reporting to the board.
2. Identify and assess the risks: Evaluate your organization’s risks, including third-party risks, and assess each risk for its potential severity. Monitor them regularly.
3. Review the budget for cybersecurity: Allocate sufficient funds to implement robust cybersecurity measures including technology and training.
4. Ensure data encryption: Data should be encrypted at rest and in transit.
5. Limit access: Implement permission controls to limit who can access patient data or critical information.
6. Monitor systems: Implement continuous monitoring systems to detect threats in real time and respond to them promptly.
7. Develop an incident response plan: Your plan should outline the steps the organization will take if there is a data breach or cyberattack and test it periodically.
8. Conduct audits and penetration testing: This will help identify vulnerabilities and weaknesses within systems and networks.
9. Implement data backup and recovery: Ensure the organization has secure, up-to-date backups that can be used to recover critical data if necessary.
10. Purchase cyber insurance: Cyber insurance can mitigate some of the financial risks arising from data breaches and cyberattacks.

Lastly, establish a plan for regular board training on cybersecurity best practices and emerging cyber threats to ensure your board is continually up to speed as they make decisions.

The role of board management software in cybersecurity mitigation

Healthcare trustees need a central location where they can communicate and collaborate to improve cybersecurity, and a board management solution offers this and more. From unlimited document storage to granular permissions, your board software allows the entire board to work together securely and seamlessly wherever they are.

BoardEffect built its platform with features that meet the unique needs of volunteer boards. These are some of the tools your board gets with BoardEffect:

• Granular permission controls: You control who has access to sensitive data as well as who can download or print certain documents to prevent unauthorized sharing.
• Unlimited document storage:Create a document library where trustees can access the latest information on cyberthreats and vulnerabilities. Trustees can use the keyword search to locate documents quickly.
• Secure meeting tools: Create and securely distribute board meeting materials, handbooks, agendas, meeting minutes, and more.
• Collaboration tools: Communicate securely, share calendars, track tasks, annotate documents, and e-sign documents all within the platform.
• Workrooms: Create private workrooms with permission access for committee work and group discussions.
• Customizable reporting: Gather information and reports related to security planning to create customized informative reports.

With BoardEffect, your trustees have access to the information they need to drive data-driven decisions around security and risks.

To learn more about how a BoardEffect board management system can serve your nonprofit healthcare organization and support your cybersecurity best practices, request a demo today.