Data Protection Compliance In The MENA Healthcare Sector

As cyber and data risks continue to grow, understanding the exposures and finding ways to put in place preventative measures and compliance programmes are key.

The recent NotPetya/ExPetr cyber-attack caused widespread damage to businesses around the globe. Following an initial 'watering hole' attack on a Ukraine based tax software vendor, M.E.Doc, NotPetya spread to Ukraine's electrical grid, airports and government offices. It reportedly infected a number of multinational companies including FedEx, Merck, Cadbury, Rosneft and AP Moller-Maersk.

NotPetya masquerades as ransomware (i.e. malicious software which blocks access to files temporarily until a ransom is paid). However, it is better categorised as a sabotage attack due to the fact that, as of today's date, there is no viable way to recover the encrypted files. It is unclear whether or not this was intentional or accidental as a result of a lack of sophistication on the part of the attackers.

NotPetya struck while many organisations were still recovering from the impact of the WannaCry virus, which infected the IT systems of over 200,000 businesses in more than 150 countries in April 2017 (see our May 2017 update). In both cases, the impact was particularly acute for organisations holding substantial amounts of information on individuals as the attacks put that data at risk of loss, destruction or theft.

Healthcare Sector Vulnerability

WannaCry brought the operations of 48 UK hospitals to a standstill and the NotPetya attack reportedly infected Heritage Valley Health System, a hospital and healthcare provider in the US.

Arguably, businesses operating in the healthcare sector are at a higher risk of being targeted by cyber criminals due to the fact that they hold high volumes of sensitive and valuable health data. This risk has increased in some jurisdictions because of factors such as public sector funding cuts and increased operating costs , which can mean that projects which require significant investment (such as an enterprise software or IT systems upgrade) are postponed or carried out incrementally to spread the cost.

Also, the sector is increasingly exploring options for more integrated healthcare with the establishment and maintenance of health information exchanges. While this can deliver better and more efficient care to patients, it can also create more vulnerability and risk through the number and types of connected stakeholders and devices.

Consequences of Cyber Breach

A...