LigoLab’s Enhanced Cybersecurity Solutions Give Customers Added Protection and Peace-of-Mind

Editor's Note: This blog post was originally published on June 25, 2024, and has since been updated.

A high-profile ransomware attack has sent shockwaves through the healthcare industry, reinforcing the urgent need for laboratories to strengthen their cybersecurity and risk management strategies to protect against increasingly sophisticated and costly cyber threats. 

UnitedHealth Group, the nation's largest healthcare insurance company, is still reeling from an attack on its subsidiary Change Healthcare on February 21, 2024. The BlackCat ransomware group, also known as ALPHV, claimed responsibility for the attack, alleging the theft of more than six terabytes of data. The attack struck the Change Healthcare network and operations, disrupting hundreds of hospitals, pharmacies, and prescription drug services nationwide for weeks.

In its first-quarter earnings report released in April, parent company UnitedHealth reported $872 million in costs related to the cyberattack. The company now estimates the total financial impact of the breach will reach approximately $1.6 billion for the year. 

In May, former UnitedHealth CEO Andrew Witty confirmed that the company paid a $22 million ransom to restore the Change Healthcare system. During testimony before the U.S. Senate Finance Committee, he explained that hackers infiltrated Change Healthcare through a server that lacked multi-factor authentication. He confirmed that the decision to pay the ransom was his, calling it one of the most difficult decisions he has ever had to make.

Witty expressed deep regret, offering a direct apology to the patients and providers affected by the disruption.

Discover More: Is Your Lab Operation Vulnerable to a Cyber Attack?

A Growing and Disturbing Trend 

Ransomware attacks on healthcare organizations are not a new phenomenon. A study published by JAMA Health Forum in December 2022 found that the annual number of attacks targeting healthcare companies had doubled between 2016 and 2021, and the trend accelerated even further in 2023, according to the Office of the Director of National Intelligence.

In addition to the Change Healthcare attack in February 2024, Ascension, a high-profile health system comprising 140 hospitals in 10 states, was also victimized on May 8, 2024. The breach at Ascension occurred when a worker accidentally downloaded malware that locked providers out of systems that track and coordinate patient care, creating troublesome conditions for medical staff and compromising their ability to conduct routine safety checks.

Discover More: LigoLab Achieves Major Security Milestone with SOC 2, HIPAA, and HITECH Compliance 

Why Clinical Labs and Pathology Practices Are Especially Vulnerable to Ransomware Attacks

Healthcare providers, including clinical labs and pathology practices, are particularly vulnerable to ransomware attacks for several interconnected reasons.

High-Value Data

Medical records contain sensitive and valuable information, including patient identification, medical history, and financial details. This data is highly lucrative, incentivizing attackers to target healthcare organizations.

Critical Nature of Healthcare Operations

Healthcare providers require continuous access to patient records stored in laboratory information system (LIS) software, electronic health record (EHR) systems, and related third-party services to deliver timely and effective care. This makes them more likely to pay a ransom quickly to restore access, making them attractive targets for cybercriminals.

Outdated Laboratory Information Systems

Many healthcare providers use legacy LIS systems and outdated lab organization software that may not receive regular updates or patches. Legacy LIS systems often have known vulnerabilities that attackers can exploit.

Complex IT Infrastructures

Healthcare providers often operate complex IT environments comprising multiple systems and devices, many of which are not uniformly secured. This complexity creates security gaps that make it difficult to maintain consistent protection across the organization.

Insufficient Cybersecurity Investment

Historically, many healthcare organizations have underinvested in cybersecurity. Budget limitations, particularly among smaller practices and laboratories, have often delayed the adoption of comprehensive security technologies and best practices, leaving critical systems more vulnerable to cyberattacks. 

High-Pressure Environment

The fast-paced, high-pressure environment in healthcare can lead to lapses in cybersecurity practices, such as staff failing to recognize phishing emails or neglecting to follow security protocols.

Discover More: Detailing LigoLab’s Laboratory Information System Cloud Readiness Plan

Protection Against Emerging Threats

Cyber threats continue to escalate, with attackers developing new ways to exploit weaknesses in healthcare systems. Independent clinical laboratories and pathology groups must stay proactive by partnering with their progressive lab vendors to implement up-to-date cybersecurity safeguards and continuously monitor their environments. Doing so helps protect against costly financial losses, legal exposure, and long-term reputational harm.

At LigoLab, we recognize the seriousness of these risks and actively support our customers in implementing strong preventive measures designed to mitigate them.

Discover More: Customizing LIS Systems for Specialized Laboratory Needs

LigoLab's Security Stance

As a trusted laboratory information system software provider, LigoLab safeguards all data within its platform and its customers' systems with the highest level of care, while maintaining full HIPAA compliance across its LIS lab solutions.

Backed by core principles of confidentiality, integrity, and availability, LigoLab's information security program secures data at every level. It’s aligned with industry best practices, continually evolves with updated guidance, and features a dedicated security team working closely with lab customers to ensure security policies are properly extended into customer software environments.

What LigoLab's Security Stance and Architecture Document Covers

• Security Overview and Secure Development
• Data Encryption, Storage, and Retention
• Network Security and Checklist
• Audit Services, Endpoint Security, and Access Controls
• Logging, Alerts, and Incident Response
• Backup and Disaster Recovery
• Cybersecurity Training Overview
• Business Continuity Plan Overview
• Threat and Vulnerability Management Overview
• Incident Management Overview

Discover More: LigoLab’s Security Stance and Architecture

"Data security is important to all organizations, and our unique services make it an integral part of everything we do at LigoLab," said Chief Operating Officer Gor Kalantaryan.

Introducing LigoLab's Enhanced Backup Services

In response to the growing cyber threats facing healthcare organizations, LigoLab now offers Enhanced Backup Services, designed to ensure all lab data remains secure, immutable, and easily recoverable.

What Enhanced Backup Services Include

• Automated, regular backups to secure off-site storage
• Rapid restoration capabilities to reduce downtime during cyber incidents, approximately four hours
• Tailored support and consultation to customize backup solutions to each lab's specific needs

The cost to implement these enhanced services starts at $300 per month, with the total cost based on the amount of data. For more information, contact LigoLab’s support team.

"We strongly encourage all customers to strengthen their defenses with these robust backup services," said Kalantaryan. "The recent cyber incidents serve as a stark reminder of the necessity for reliable data protection and recovery solutions, which are crucial for maintaining the continuity and integrity of your operations."

Industry Insights: Why the Future of the Laboratory Information System Must Be Active, Intelligent, and Integrated

LigoLab Partners With Law & Forensics to Offer Audit Services 

Security and regulatory compliance are crucial to ensuring an organization's cybersecurity posture is robust and resilient. In addition to Enhanced Backup Services, LigoLab has also partnered with Law & Forensics, a global legal engineering firm dedicated to helping organizations identify vulnerabilities, mitigate risks, and achieve compliance with industry-specific regulations and standards.

"Law & Forensics is a team of experts that provides a comprehensive suite of cybersecurity audits and assessments tailored to an organization's unique needs and regulatory requirements," said Kalantaryan.

Labs interested in learning more can contact LigoLab’s support team.

Industry Insights: Regulators Are Rewriting HIPAA - Survival Guide for Clinical & Pathology Labs

Best Practices for Ransomware Mitigation

The following best practices are designed to complement LigoLab's backup solutions and enhance a lab's overall security posture.

Core Ransomware Mitigation Practices

Regular Backups: Perform regular immutable backups of critical data, stored offline and encrypted.

Patch Management: Regularly update and patch operating systems, software, and firmware to protect against known vulnerabilities.

Employee Training: Conduct regular cybersecurity awareness training focused on phishing, social engineering, and ransomware threats.

Email Filtering: Implement robust email filtering solutions to detect and block malicious attachments and links.

Endpoint Protection: Use advanced endpoint protection solutions with anti-ransomware capabilities.

Network Segmentation: Segment networks to limit the spread of ransomware and contain breaches.

Incident Response Plan: Create and routinely update a ransomware-specific incident response plan.

Access Control: Implement the principle of least privilege, minimizing user access to only what is necessary for each role.

Minimizing the Number of Records Exposed

Data Retention Policies: Establish and enforce policies ensuring records are kept only as long as necessary for business or regulatory purposes.

Data Minimization: Collect and retain only the minimum data necessary for business operations.

Regular Audits: Conduct regular audits of data storage to identify and securely delete redundant, obsolete, or trivial data.

Data Anonymization: Where possible, anonymize personal data to reduce the risk of exposure.

Access Controls: Limit access to sensitive data to only those employees who need it for their roles.

Encryption: Encrypt data both in transit and at rest to protect against unauthorized access.

Automated Deletion: Use automated processes to remove records in accordance with data retention policies.

Two-Factor Authentication Best Practices

Multi-Method Authentication: Offer multiple authentication options, including SMS, email, mobile apps, hardware tokens, or biometrics, to support diverse user needs.

Strong Authentication Mechanisms: Prioritize phishing-resistant methods such as app-based authenticators and hardware tokens.

User Education: Train users on the importance of two-factor authentication.

Backup Access Options: Provide backup codes or alternate 2FA methods in case the primary method becomes unavailable.

Mandatory Enforcement: Require two-factor authentication for all critical systems, including email, remote access, and privileged accounts.

Monitoring and Alerts: Track and alert on suspicious authentication activity, such as repeated failed attempts.

Regular Review: Periodically reassess 2FA methods to ensure they remain secure, effective, and current.

SSO Integration: Integrate 2FA with Single Sign-On (SSO) solutions to streamline authentication while maintaining strong security.

Take the Proper Steps to Protect Your Lab Business

While clinical labs and pathology groups have inherent cyber vulnerabilities, these vulnerabilities can be significantly reduced when the proper steps are taken to strengthen cyber defenses. Being fully aware of the threats and following best practices for mitigation are important first steps.

Strengthen Your Laboratory's Cyber Resilience 

Lab leaders should also strongly consider investing in additional security measures, such as LigoLab's Enhanced Backup Services and the audit services offered through LigoLab's partnership with Law & Forensics.

Act Now: Explore Advanced Protection

Frequently Asked Questions About Healthcare Cybersecurity and LigoLab's Enhanced Security Solutions

What happened in the Change Healthcare cyberattack, and why does it matter for clinical labs?

On February 21, 2024, the BlackCat ransomware group attacked Change Healthcare, a subsidiary of UnitedHealth Group, stealing more than six terabytes of data, including patient names, addresses, Social Security numbers, and healthcare records. The attack disrupted claims processing and laboratory billing operations nationwide for weeks, affecting an estimated 190 million individuals and costing UnitedHealth an estimated $1.6 billion. The incident demonstrates that a single successful attack on healthcare infrastructure can affect hundreds of labs, hospitals, and pharmacies, making cybersecurity a mission-critical concern for every clinical laboratory.

How did attackers gain access to Change Healthcare's systems?

Former UnitedHealth CEO Andrew Witty confirmed in U.S. Senate Finance Committee testimony that attackers accessed Change Healthcare through a server that lacked multi-factor authentication. This single security gap, the absence of a second verification step, enabled ransomware operators to infiltrate the network and ultimately compromise data belonging to approximately 190 million individuals. The lesson is clear: even one unprotected access point can create a catastrophic vulnerability for a healthcare organization.

Why are clinical labs and pathology practices especially attractive targets for ransomware attacks?

Clinical labs are attractive targets because they store high-value data, including patient demographics, medical histories, and financial records, and because their operations depend on continuous system access to deliver timely diagnostic results. This operational dependency makes labs more likely to pay a ransom quickly to restore access. Additional vulnerabilities include legacy laboratory information systems with known security gaps, complex, fragmented IT environments, historical underinvestment in cybersecurity, and a high-pressure workplace culture where staff may overlook security protocols.

What does LigoLab's Enhanced Backup Service include, and how much does it cost?

LigoLab's Enhanced Backup Services include automated regular backups to secure off-site storage, rapid data restoration capabilities that minimize downtime to approximately four hours following a cyber incident, and tailored support and consultation for customized backup solutions. Pricing starts at $300 per month, with the total cost based on data volume. Labs interested in the service can contact LigoLab’s support team for a customized quote.

What cybersecurity audit services does LigoLab offer through its Law & Forensics partnership?

Through its partnership with Law & Forensics, a global legal engineering and cybersecurity firm, LigoLab offers partner labs access to comprehensive security audits tailored to each organization's unique needs, regulatory compliance assessments ensuring industry standards are met, and risk mitigation strategies designed to identify and address specific vulnerabilities. Labs interested in these services can contact LigoLab’s support team for more information.

What are the most important ransomware mitigation steps labs can take immediately?

Implementing multi-factor authentication across all critical systems, including the lab information system, email, and remote access portals, is the single most impactful step labs can take immediately. As the Change Healthcare breach demonstrated, the absence of MFA on a single server was the entry point for one of the most damaging healthcare cyberattacks in history. Combined with immutable off-site backups, regular patching, and employee phishing training, MFA forms the foundation of a robust ransomware defense strategy.

How does LigoLab's platform support cybersecurity compliance for clinical labs?

LigoLab's security framework is built on principles of confidentiality, integrity, and availability, with a comprehensive program covering secure software development, data encryption at rest and in transit, role-based access controls, complete and searchable audit trails, network security, endpoint protection, logging and incident response, and backup and disaster recovery. The platform is fully HIPAA compliant, and LigoLab's dedicated security team partners with each laboratory to help ensure these safeguards are properly implemented and maintained throughout the customer's environment.