Cyber readiness for health boards: prevention, response, rehearsal

As a former CIO of a billion-dollar healthcare system, I have taken that 2am phone call. The one where clinical systems are down across multiple sites, nobody can yet say whether it's an equipment failure or an attack, and the next several hours will determine whether the organisation has a hard night or a hard year.

As a board member of any size healthcare organisation, it's important to remember that cyber incidents are not an "IT problem". At their core they are patient-safety events with a communications crisis attached, which means the board needs to own them the same way it owns clinical governance.

The good news, and the central argument of this article, is that your organisation already knows how to do readiness. Many of you have run emergency departments, drilled hospital codes and practised infection control protocols on a daily basis. Cyber readiness is the same three readiness disciplines (1. prevention, 2. response protocol, 3. rehearsal/drill) applied to a different kind of "pathogen". So breathe a sigh of relief: you don't need to learn about technology. This article breaks down healthcare cyber readiness into a language you already understand.

Prevention: the "Essential Eight" is your infection control

The Essential Eight is a set of eight preventative controls published by the Australian Signals Directorate (ASD), the Commonwealth's technical authority on cyber security. In healthcare jargon, the "eight" are basic hygiene: control which software can run, patch known weaknesses quickly, limit who holds powerful access, require more than a password to get in, and keep backups an attacker can't reach. Most successful attacks on Australian organisations would have been prevented by these eight controls, competently implemented.

Two things about the Essential Eight matter at board level. First, maturity is measured on a scale from Level Zero (control effectively absent) to Level Three (fully implemented and verified), for each of the eight items. Second, and this is the part most boards have never been told: your overall rating arises from your weakest control, not your average. The ASD scores it that way deliberately, because attackers don't average your defences; they find the one door left open. An organisation with seven excellent controls and one absent control is, for practical purposes, a Level Zero organisation.

As a board member of any size healthcare organisation, the questions are simple:

1. What is our current Essential Eight maturity, control by control?
2. What level have we agreed to reach, and by when?
3. And who, by name, owns closing the gap?

If those three questions can't be answered from existing board papers, it's probably safe to say your Essential Eight maturity level would be Zero, and there are some actionable items your executive team needs to be looking at. (If you want an indicative feel for the maturity assessment, the Essential Eight Pulse on this site takes three minutes.)

Response: the "CIRP" is your protocol for "code-blue" situations

The Cyber Incident Response Plan (CIRP) is your organisation's pre-agreed protocol for the day that prevention tactics have failed. It should detail who does what, in what order, with what authority, when minutes matter and information is incomplete.

As a board member, you should easily be able to access a copy of the CIRP. For medium-sized healthcare organisations, this may be owned by a Corporate Services manager or IT manager; in large organisations it should be owned by the executive in charge of IT.

A CIRP worth having answers five things in plain language:

• Roles and decision rights: who is the incident commander, and who is authorised to take a clinical system offline on suspicion alone (that means decided now, in advance, and not negotiated at 2am when an emergency is occurring).
• Escalation triggers: what severity wakes the CEO and what convenes the board (again, defined in advance, so nobody under-estimates a crisis to avoid the social faux pas of waking the boss up for nothing).
• Communication discipline: how to communicate to your own staff first (so they hear it from you rather than social media); procedures for opening a holding line for the public; how to ensure the board chair is notified and isn't learning about the incident from the news; and clarity to all relevant parties on how patients, media and regulators are communicated to.
• Containment and recovery priorities expressed clinically, not technically: which clinical services must be protected or restored first as soon as it is safe to do so (as opposed to which servers should be turned on first). I have found it is important that clinical staff understand and drill this aspect of the CIRP in particular, since clinical priorities that require using the organisation's system are not safe to pursue while the system is still unsafe. Pressuring IT to turn on unsafe systems because of patient-safety concerns should not be an option.
• Regulatory obligations: Australia's Notifiable Data Breaches scheme imposes a clock that starts ticking at discovery; the CIRP must name who notifies whom, and by when. For example, a ransomware attack that exfiltrates patient records before encryption is highly likely to be notifiable: health information is sensitive information, unauthorised access has occurred, and serious harm to affected individuals is the foreseeable outcome, so notification is required unless an exception applies or effective remedial action removes the likelihood of serious harm. The scheme sets two distinct obligations. Where a breach is only suspected, the organisation must take reasonable steps to complete an assessment within 30 calendar days. Once it has reasonable grounds to believe an eligible data breach has occurred, it must notify the OAIC and affected individuals as soon as practicable.

One sentence to keep in mind: a CIRP that has never been tested is a document, not a plan. When your insurance company or Australian regulators come knocking, you want evidence-based proof that your board was not negligent in preventing a breach of sensitive healthcare information.

Rehearsal: the annual Cyber Incident Response Team (CIRT) exercise

So far we have looked at how to prevent cyber healthcare incidents by first assessing your organisation against the Essential Eight controls for cyber safety. As a board member, you should understand what cyber-security maturity level your organisation is at, and where it should be.

We then looked at what should be in your organisation's Cyber Incident Response Plan (CIRP), a critical document that details actionable steps when something goes wrong and your healthcare company is actively under attack. As a board member you should be familiar with this document and your role when the CIRP is activated.

If you have come this far, you are probably wondering what else there is for you to do as a board member of a healthcare organisation. Remember earlier when I said there are non-optional notifiable requirements when your company experiences a cyber attack? As a board member, you will want any Australian regulators, insurance personnel or other engaged third parties to have a smooth and controlled experience with your organisation when an incident occurs. That means:

• A dedicated response team clearly in charge of the situation.
• A calm command centre where the situation is clearly under control.
• Easy-to-access evidence that you have, and currently are, doing everything to prevent damage.
• Easy-to-access evidence that you have, and currently are, doing everything to detect and manage the attack.
• Clear communications to the right people at the right time.

The best way to achieve this is like anything else in healthcare: drills and practice runs.

The Cyber Incident Response Team (CIRT) is the group that executes the CIRP. The CIRT is substantially a leadership team, not a technical one. The technicians contain the incident. But the decisions that determine the outcome, such as whether to close the clinic or not, divert the ED or not, isolate the EMR or not, what to tell staff and media, and when to call the minister's office, belong to executives. If your CIRT roster is entirely people from IT, your actual crisis team has not been properly organised.

Just naming the team in the CIRP is not enough. The team will not be a ready team. Nobody learns resuscitation by reading the protocol during cardiac arrest; that's why clinicians drill it until the sequence survives the adrenaline rush of an emergency. The cyber equivalent is a tabletop exercise, run at least annually, with your CIRT. A good exercise will have:

• a realistic scenario;
• the real decision-makers in the room (perhaps with help from other staff or a hired professional like me to play third parties like insurance companies or external IT support contractors and vendors);
• decisions made under time pressure; and
• a frank debrief afterwards, followed by actually fixing any problems the exercise exposed.

The board's role is not to attend every exercise. It is to require that one has happened in the last twelve months. When I am hired to run these exercises for healthcare organisations in Australia, I ask the board to ensure the executive team will be present and participative, and required to read the debrief report I send, as opposed to being allowed to simply send a one-line email assuring the board that all went well. My aim with these exercises is to find the holes in the response plan; in my opinion, an exercise without findings for improvement was inadequate in testing the response in the first place.

The board's one-page test

If you have come this far, thank you for being proactive about making your healthcare organisation safer and ensuring your obligations as a healthcare board member are met. In summary, let me boil this article down into five YES or NO questions you can ask at your next meeting to get started, or to double-check how well your healthcare company is doing with cyber responsiveness and readiness:

None of this requires the board to become technical. It requires the board to apply the governance discipline it already applies to clinical risk: prevention is funded, protocols are current, and people are rehearsed. Your healthcare organisation would never accept a resuscitation protocol nobody had practised. Your cyber incident response deserves the same standard, because on the night it's needed, it protects the same patients.