Few U.S. hospitals secure their email against phishing, Global Cyber Alliance says
Fewer than one-third of the largest 98 public and private hospitals in the United States secure their email against phishing and spamming, according to data released Thursday.
The Global Cyber Alliance said that of the 50 largest public hospitals, only six employed Domain-based Message Authentication, Reporting and Conformance, or DMARC — an email authentication policy and reporting protocol developed a decade ago, originally by PayPal. Of the 48 biggest for-profit hospitals, only 22 used DMARC.
The figures led GCA to describe U.S. health care providers’ email security as being in “critical condition.” The alliance also notes that, according to the latest Verizon Data Breach Investigative Report, 66 percent of malware installed on healthcare providers’ IT networks was delivered via email attachment — something normally done using a spoofed email address.
DMARC helps prevent phishing and other email spoofing attacks, when an email is made to look as if it comes from a company, often a bank or other financial service. When senders fully implement DMARC, email recipients can safely consign to the spam folder unauthenticated messages apparently coming from that sender’s domain.
Only one of the 28 hospitals using DMARC had fully implemented it, according to GCA.
“DMARC helps the healthcare industry prevent the worst type of malicious email from using the most common tactic,” said Jim Routh, Chief Security Officer for Aetna. “DMARC improves the consumer digital experience by eliminating malicious emails from spoofed domains, increasing the level of trust that consumers have in email. The improvement in trust results in better health outcomes for consumers while also offering better protection of their health information.”
The DMARC protocol “has been proven effective, and deployment can reasonably be done by organizations of all sizes, making it an invaluable resource for hospitals who need to protect their patients’ digital health,” said Philip Reitinger, president and CEO of GCA.
