In reply to Jeff Fawcett.

I agree with you Jeff that regulatory compliance is declining as a motivating factor for improved security across the healthcare industry – even the dreaded OCR audit! OCR will issue perhaps a $1m fine for audit failures. PHI or PII breach is resulting in WAY bigger class action law suites in the multiple billions of dollars in the USA. What will the liability be of providers when patient safety is put at risk as the result of a cyber attack that the entity was not prepared for?

Ransoming of encrypted file systems is just the first pass of the ransom attacks on hospitals and other providers. I don’t believe it will be long before ransomers start to demand not thousands of dollars as they are currently for the encryption keys, but millions or billions of dollars in return for not executing patients when the systems they are attached to in hospitals have been compromised. That’s when things really get scary!