Many cyber risks in life sciences stem from the technology infrastructure of the industry.

Threat vectors in life sciences range from malicious cyberattacks to unintentional software errors and network outages. Virtually everything in healthcare is digital, from electronic health records to diagnostic systems. The inability to deliver care, and a lack of manual override capability on digital devices, means any disruption to healthcare equipment and systems will be costly.

Threat actors and ransomware pose serious risks to life sciences organizations. The theft and loss of data in life sciences increases the risk of disruption and the loss of access to data can be even more serious. The theft or exposure of personal health information (PHI) or IP can have costly legal proceedings from third parties and regulatory agencies.

Vendor risk in cyber is becoming a serious problem for all organizations, as cyber incidents involving third parties can quickly turn into first-party losses. An understanding of vendors’ cybersecurity and cyber risk management practices is becoming increasingly important for organizations to protect their operations from disruption.

Clarity on supply chains and operational interdependencies is critical to risk mitigation for life sciences organizations. Many organizations have global supply chains and digital connections within those supply chains that are vulnerable to disruption. Even though healthcare is delivered locally to individual patients, the components that go into and support the delivery of care often are sourced in many places.

Variability in cybersecurity is common across many industries, and even though healthcare and life sciences are highly regulated, organizations differ in their cyber risk management practices. For life sciences companies interested in taking crucial security steps, the HITRUST Cybersecurity Framework, an information protection standards and certifying organization, provides a strong framework that organizations can proactively implement to evidence a commitment to data and cybersecurity postures.

Another essential and challenging task is for organizations to stay apprised of state and federal laws and regulations that relate to healthcare and life sciences. The Healthcare Insurance Portability and Accountability Act (HIPAA) already imposes data privacy requirements and steep penalties for noncompliance, providing an incentive for organizations to protect PHI, and additional cybersecurity regulations are expected in the future. While regulators tend to move at a cautious pace, organizations in life sciences need not wait for mandated requirements to improve their cybersecurity.

Non-compliance with those requirements can invite enforcement actions and potentially private litigation. The litigation environment across the United States is often unfavorable to corporate defendants, due to legal system abuse and jurors’ shifting attitudes about compensating plaintiffs.