Over the last 20 years, cyberattacks have undergone a significant transformation. What began largely as nuisance viruses affecting individual computers and IT departments have evolved into extortion and large-scale system outages that can disrupt entire organizations.
Every industry faces these risks, but behavioral health providers have an added concern because of the sensitive nature of the information they manage. A behavioral health record may include diagnoses, trauma histories, substance use information, suicide risk assessments, psychiatric admissions and detailed treatment notes. That combination makes the information especially valuable to a threat actor, meaning a person or group that attempts to access or harm systems, networks, or data.
Our recent webinar, “When Risk Becomes Reality: Cybersecurity, Compliance, & Crisis Response in Behavioral Health,” explored the risks facing behavioral health organizations, the compliance and documentation practices that support preparedness, and the role of incident response and crisis communication. The discussion showed how cybersecurity risks can reach far beyond an organization’s technology.
Why Behavioral Health Data is Not Ordinary Health Information
If a payment card is stolen, the cardholder can cancel it and receive a replacement. The disruption may be frustrating and costly, but it can generally be contained.
The same cannot be said for behavioral health information. If information related to someone’s psychiatric admissions, substance use, or trauma history is published online, the damage may be permanent. Its disclosure can affect a person’s privacy, relationships, employment, and willingness to continue seeking care.
That permanence gives attackers another way to pressure organizations. Instead of simply locking systems and demanding payment to restore them, attackers can threaten to publish sensitive information, sell it or use it to target patients directly.
That is what happened to Vastaamo, a large psychotherapy provider in Finland. After stealing more than 33,000 patient records, an attacker demanded a ransom from the organization. When Vastaamo declined to pay, the attacker reportedly contacted more than 22,000 patients directly and published therapy notes belonging to some who refused individual extortion demands.
Investigators later identified a range of poor security controls, including exposed database access, weak authentication, insufficient firewalling and poor logging. In other words, the attack didn’t depend on advanced methods. Common security gaps were enough to cause lasting patient harm, government sanctions, and the eventual closure of the organization.
Lesson learned? For behavioral health organizations, the health data itself can become the leverage. Vastaamo is a large-scale example, but the weaknesses behind the breach can also put smaller and midsized organizations at risk.
How Do Attackers Commonly Gain Access?
Cyberattacks are often imagined as highly technical operations using complex, previously unknown tools. In healthcare, however, attackers frequently gain access through more familiar weaknesses:
- Systems that haven’t been updated
- Passwords or credentials stolen through phishing attacks
- Weak login protections
- Accounts with more access than needed
- Accounts that remain active after an employee or vendor leaves
Attackers may view smaller and midsized organizations as easier targets because they expect to encounter fewer security barriers. Once inside, they may steal sensitive information, disrupt systems or remain undetected for an extended period.
Many of these risks begin with familiar security gaps, but their effects can extend far beyond an organization’s technology.
How Does a Cyberattack Disrupt Care and Operations?
Ransomware and other attacks can make clinical, billing and operational systems unavailable for days or weeks. The effects can reach across the organization:
- Clinical: Clinicians may have difficulty accessing the information they need, which can delay services, complicate care coordination, and increase the risk of mistakes.
- Billing: Encounters may need to be documented or billed manually, leading to delayed claims, missed reimbursement deadlines and lost revenue.
- Operations: Everyday tools may be unavailable, appointments may be canceled and the organization may face significant recovery work and unexpected costs.
The financial effects can extend beyond restoring systems. Lost revenue, legal and forensic support, patient notification and longer-term effects on referrals or census can all add to the cost.
Together, these effects make cybersecurity more than an IT concern. It’s also an operational and financial priority that can impact patient care. Although no organization can eliminate every risk, fundamental protections can make an attack less likely and help support a faster recovery.
5 Priorities Every Behavioral Health Organization Should Address
Many cybersecurity risks can be reduced through established, accessible protections. The challenge is applying them consistently.
Few organizations have all the people, skills and resources needed to manage every aspect of cybersecurity internally. Some responsibilities can be handled in-house, while others may require outside expertise. If your organization cannot address everything at once, these five priorities offer a practical starting point. They address common ways attackers gain access while helping the organization prepare for a faster, more coordinated response.
1Require multifactor authentication everywhere.
Multifactor authentication, or MFA, is one of the easiest steps an organization can take. (MFA requires users to take an additional step beyond entering a password before accessing an account.) MFA should be used for every system, application and user account, including email, remote access, administrative accounts, contractors and service accounts. Regularly check for gaps because anything less than complete coverage creates potential risk.
2Protect and test your backups.
Reliable backups are essential to recovery, but backups must also be protected from ransomware. At least one backup copy should be immutable, meaning it cannot be changed, deleted, or reached. Establish clear processes, procedures and resources for restoration and test whether you can recover information before an incident occurs.
3Patch known vulnerabilities.
Regularly scan systems and applications for known security gaps. Assign responsibility for fixing them, prioritize the most serious risks, and track the work through completion. Attackers do not need advanced techniques when a known vulnerability has been left open.
4Establish critical vendor relationships before an incident.
A serious security event is not the ideal time to begin looking for legal counsel, forensic investigators, or crisis communication support. Identify the specialists your organization may need, keep their contact information current, and consider putting critical partners on retainer. Outside services can also provide capabilities like around-the-clock monitoring, managed backups, or cybersecurity leadership. Outsourcing the work, however, does not outsource accountability.
5Test your incident response processes.
Policies, plans and technology only help if they work when needed. Use tabletop exercises to identify gaps, confirm who will make decisions, and determine how the organization will communicate and involve outside partners. Regularly review system access and confirm it is removed quickly when employees or vendors leave.
Conclusion: Turning Cybersecurity Awareness into Action
October is Cybersecurity Awareness Month, making it a natural time to evaluate whether your security practices reflect the sensitivity of the information you manage. Begin with a few focused questions:
- Is MFA in place across every system and account?
- When did the organization last successfully restore a protected backup?
- Are known vulnerabilities being identified and fixed?
- Are critical response vendors ready to assist?
- Has the incident response plan been tested?
Organizations looking for additional guidance can explore the CISA Cybersecurity Awareness Month resources and toolkit, the HHS Healthcare and Public Health Cybersecurity Performance Goals and the broader collection of healthcare-focused materials available through the HHS Cyber Gateway.
As explored in our webinar, “When Risk Becomes Reality,” behavioral health data may create unique risks, but organizations can reduce those risks through fundamental protections, advance planning, and regularly testing. Cybersecurity awareness is an important first step. Turning that awareness into consistent action is what helps protect sensitive information and support continuity of care.
Frequently Asked Questions
Multifactor authentication, or MFA, is a security measure that requires two or more credentials to verify a user’s identity before granting access to an account or system. It adds protection because even if one credential, such as a password, is compromised, an unauthorized user still has to satisfy another authentication requirement
Ransomware is malicious software designed to block access to data, typically by encrypting it until a ransom is paid. In healthcare, ransomware can disrupt access to systems and information needed to provide care. HHS provides healthcare-specific guidance on preventing, responding to and recovering from ransomware attacks.
An incident response plan is a written document that helps an organization prepare for, respond to and recover from a suspected or confirmed security incident. It should clarify roles and responsibilities and identify key people who may need to be involved during a crisis. CISA recommends routinely reviewing the plan and practicing the response through tabletop exercises.
Yes. Smaller organizations may have fewer internal cybersecurity resources, but guidance is available specifically for their needs. HHS Health Industry Cybersecurity Practices provides recommendations for organizations of different sizes, including small healthcare organizations that may not have dedicated IT staff.
Organizations can also focus their internal resources on established cybersecurity priorities while looking to outside expertise for capabilities they cannot reasonably maintain themselves.
Cantata’s approach combines secure cloud infrastructure, industry-recognized security controls, continuous monitoring, and administrative safeguards. Our security program is designed to protect customer data and help behavioral health and human services organizations support their compliance obligations.