Nav: Home

How susceptible are hospital employees to phishing attacks?

March 11, 2019

Cybersecurity threats are a rising problem in society, especially for health care organizations. Successful attacks can jeopardize not only patient data but also patient care, leading to cancellations and disruptions in the critical services that hospitals provide. While many hospitals have taken steps to educate, inform and forewarn their employees about cybersecurity attacks, few studies have quantified how susceptible hospital employees are to phishing attacks. A new study led by investigators from Brigham and Women's Hospital addresses these questions through a multicenter study that aggregated data from six health care institutions that ran phishing simulations over the course of seven years. The team reports a high click rate for simulated phishing but also a reduction in click rates with increasing campaigns, suggesting a potential benefit for raising awareness. The team's findings are published in JAMA Network Open.

"Information security is increasingly important for health care organizations, and cybersecurity attacks are a major risk to a hospital's ability to operate and deliver care," said corresponding author William Gordon, MD, MBI, of the Brigham's Division of General Internal Medicine and Primary Care. "But our study suggests that while the risk is high, there is an opportunity to mitigate it through training."

Phishing attacks via email can lure individuals into disclosing sensitive personal information or clicking on links that download malicious software. Many organizations have made a concerted effort to train their employees to recognize and report these attacks by sending simulated phishing emails, ranging from office- and IT-related to personal-related correspondence, and subsequently training those who inappropriately click or enter their credentials.

Brigham investigators aggregated data from six anonymized U.S. health care institutions representing a broad spectrum of care and geography. In total, they analyzed click rates for more than 2.9 million simulated emails. The team reports that 422,052 of these emails were clicked (14.2 percent) -- roughly one in every seven. However, the odds of clicking on a phishing email decreased with increasing campaigns. After institutions had run 10 or more phishing simulation campaigns, the odds went down by more than one-third.

The authors note that many factors may go into why an individual clicks on an email and that their study, which did not drill down to the level of individual employees, could not take all of these complexities into account. In addition, the study could not answer whether the improvements may be sustainable, and for how long, after a campaign ends.

"The rates that we report here are consistent with findings across other industries, where click rates can range from 13 to 49 percent, depending on the industry, but we know that in health care the stakes are high. Patient data, patient care, patient trust and financial stability may be on the line," said Gordon. "Understanding susceptibility, but also what steps can be taken to mitigate it, are critical as cyberattacks continue to rise."
-end-
This work was conducted with support from Harvard Catalyst/Harvard Clinical and Translational Science Center (National Center for Advancing Translational Sciences, National Institutes of Health award UL1 TR001102) and by financial contributions from Harvard University and its affiliated academic health care centers. A co-author of this work reports being a previous employee of Cofense.

Paper cited: Gordon, W et al. "Assessment of Employee Susceptibility to Phishing Attacks at US Health Care Institutions" JAMA Network Open DOI: 10.1001/jamanetworkopen.2019.0393

Brigham and Women's Hospital

Related Health Care Articles:

Mental health of health care workers in china in hospitals with patients with COVID-19
This survey study of almost 1,300 health care workers in China at 34 hospitals equipped with fever clinics or wards for patients with COVID-19 reports on their mental health outcomes, including symptoms of depression, anxiety, insomnia and distress.
Large federal program aimed at providing better health care underfunds primary care
Despite a mandate to help patients make better-informed health care decisions, a ten-year research program established under the Affordable Care Act has funded a relatively small number of studies that examine primary care, the setting where the majority of patients in the US receive treatment.
International medical graduates care for Medicare patients with greater health care needs
A study by a Massachusetts General Hospital research team indicates that internal medicine physicians who are graduates of medical schools outside the US care for Medicare patients with more complex medical needs than those cared for by graduates of American medical schools.
The Lancet Global Health: Improved access to care not sufficient to improve health, as epidemic of poor quality care revealed
Of the 8.6 million deaths from conditions treatable by health care, poor-quality care is responsible for an estimated 5 million deaths per year -- more than deaths due to insufficient access to care (3.6 million) .
Under Affordable Care Act, Americans have had more preventive care for heart health
By reducing out-of-pocket costs for preventive treatment, the Affordable Care Act appears to have encouraged more people to have health screenings related to their cardiovascular health.
High-deductible health care plans curb both cost and usage, including preventive care
A team of researchers based at IUPUI has conducted the first systematic review of studies examining the relationship between high-deductible health care plans and the use of health care services.
Health insurance changes, access to care by patients' mental health status
A research letter published by JAMA Psychiatry examined access to care before the Patient Protection and Affordable Care Act (ACA) and after the ACA for patients grouped by mental health status using a scale to assess mental illness in epidemiologic studies.
Medical expenditures rise in most categories except primary care physicians and home health care
This article was published in the July/August 2017 issue of Annals of Family Medicine research journal.
Care management program reduced health care costs in Partners Pioneer ACO
Pesearchers at Partners HealthCare published a study showing that Partners Pioneer ACO not only reduces spending growth, but does this by reducing avoidable hospitalizations for patients with elevated but modifiable risks.
Health care leaders predict patients will lose under President Trump's health care plans
According to a newly released NEJM Catalyst Insights Report, health care executives and industry insiders expect patients -- more than any other stakeholder -- to be the big losers of any comprehensive health care plan from the Trump administration.
More Health Care News and Health Care Current Events

Trending Science News

Current Coronavirus (COVID-19) News

Top Science Podcasts

We have hand picked the top science podcasts of 2020.
Now Playing: TED Radio Hour

Climate Mindset
In the past few months, human beings have come together to fight a global threat. This hour, TED speakers explore how our response can be the catalyst to fight another global crisis: climate change. Guests include political strategist Tom Rivett-Carnac, diplomat Christiana Figueres, climate justice activist Xiye Bastida, and writer, illustrator, and artist Oliver Jeffers.
Now Playing: Science for the People

#562 Superbug to Bedside
By now we're all good and scared about antibiotic resistance, one of the many things coming to get us all. But there's good news, sort of. News antibiotics are coming out! How do they get tested? What does that kind of a trial look like and how does it happen? Host Bethany Brookeshire talks with Matt McCarthy, author of "Superbugs: The Race to Stop an Epidemic", about the ins and outs of testing a new antibiotic in the hospital.
Now Playing: Radiolab

Speedy Beet
There are few musical moments more well-worn than the first four notes of Beethoven's Fifth Symphony. But in this short, we find out that Beethoven might have made a last-ditch effort to keep his music from ever feeling familiar, to keep pushing his listeners to a kind of psychological limit. Big thanks to our Brooklyn Philharmonic musicians: Deborah Buck and Suzy Perelman on violin, Arash Amini on cello, and Ah Ling Neu on viola. And check out The First Four Notes, Matthew Guerrieri's book on Beethoven's Fifth. Support Radiolab today at Radiolab.org/donate.