The Impacts of the COVID-19 pandemic on Health IT and Security

Hosted by CynergisTek

COVID-19 has considerably changed healthcare operations from an IT and care delivery perspective. Take this short survey to share how your organization is and will be adjusting IT and managing cybersecurity risk during and post COVID-19.

Question Title

* 1. Type of Organization:

Multi-hospital/health system

Academic Medical Center

Physician Practice

Short-term Acute Care Hospital

Critical Access Hospital

Question Title

* 2. Size (Annual Revenue):

<$50M

$50M - $100M

$100M - $250M

$250M - $500M

$500M - $750M

$750M - $1B

$1B - $2B

>$2B

Question Title

* 3. If you have received relief funds, how will they be applied? (select all that apply)

Keep operations running in light of losses incurred during COVID-19

Buy new equipment to support increased needs around COVID-19 (i.e. PPE, ventilators, etc.)

Buy new equipment to support increased remote patient care

Buy new or expand IT to support remote workers

Investing in cybersecurity

Undecided

Question Title

* 4. Which of the following IT investments are being considered? (Select all that apply)

Delaying or pulling back all IT investments

Move to Cloud

Core infrastructure

Supply chain improvements

IT to support remote workers

IT to support new care delivery models

Enhanced cybersecurity

Question Title

* 5. Which of the following security investments are being considered? (Select all that apply)

Delaying or pulling back all security investments

Monitoring (logs, controls)

Data governance/Data Loss Prevention

Multi-Factor Authentication

Security Orchestration, Automation, Response

Identity Access Management

IR plans/exercises

Privacy/security training and awareness

Other (please specify):

Question Title

* 6. Many organizations expanded the remote workforce drastically as part of COVID-19 response. If you expanded telework, which of the following applied to the expansion?

We had remote work policy and procedure in place and simply expedited the rollout around current policy.

We developed standards, acquired devices in our normal process and deployed through the employees working from home.

We were not prepared, bought devices and told people how to connect.

We told people how to connect using whatever devices they had.

Not applicable

Question Title

* 7. If you had employees or other workforce working remotely for the first time, did you: (Select all that apply)

Provide special training for them.

Increase monitoring on users coming into the organization’s network and resources.

Implement Multi-Factor Authentication for all remote users.

Deploy Virtual Private Networks on devices that remote users were using from home.

Not applicable.

Question Title

* 8. As a result of COVID-19, will your organization continue the utilize remote work environments? (Select all that apply)

No, all non-clinical employees will be brought back on-site after operations return to normal

Yes, we are looking to expand our remote workforce members as we concluded that on-site benefits can be replicated off-site

Yes, we will consider expanding the use of remote workforce as a risk reduction strategy

It is too soon to make a decision

Question Title

* 9. During this period of lockdown of non-essential staff, were any new risks or constraints identified that would impact your ability to respond to a security or privacy incident?

No, we concluded that working remotely would not impact our ability to respond to a security or privacy event

Yes, we concluded that we would have a minor degradation of incident response workflow

Yes, we concluded that we are not prepared to respond to a major intrusion or ransomware

Other priorities have prevented us from reviewing our incident response plans

Question Title

* 10. Have you added to or shifted how you validate technical controls based on changes in IT Delivery?

No, we expanded/shifted services but didn’t address existing controls

No, we will do that after the COVID-19 emergency

Yes, we have re-examined controls as we went remote, opened temporary facilities and added staff

Yes, we have tools that validate technical controls

Question Title

* 11. Did you address/expand new tactics, techniques and procedures (TTP) to detect and respond to new threats as IT delivery models changed?

No, there simply wasn’t time in the middle of crisis response to adjust

No, but we will need to do that as processes and our models stabilize

Yes, we are constantly evolving the threat environment changes

Reduced risk by ensuring all data is tracked on a unified platform of record and engagement

If yes, do you have resources and/or tools to test new TTP against the new threat environment? (Please answer Yes or No)

Thank you for your time.