Third Party Vendors May Put Healthcare Facilities at Risk for Cyberattacks 

Third-party vendors are becoming a possible vector for cyberattacks.

By Jeff Wardon, Jr., Assistant Editor

Cyberattacks and data breaches continue to hammer healthcare facilities. As they do, facility managers are tasked with keeping watch on where sensitive data is being shared on an around-the-clock basis.  

Another avenue for attackers is becoming increasingly clear: third-party vendors. 

According to Cook County Health’s (CCH) press release, Perry Johnson & Associates (PJ&A), Inc., a third-party vendor CCH shared information with for medical transcription services, notified CCH that there was a data breach on PJ&A’s systems that involved some of their patient data. After learning this, CCH cut off its ties to PJ&A.  

Third-party vendors can be a potential vector for cyberattacks, as seen in the large chain of healthcare attacks due to a MOVEit software vulnerability. Since healthcare facilities actively share information with these vendors, a data breach at the vendor’s systems can expose sensitive patient information.  

However, either at the source or the third-party level, this data can be accessed by other individuals if they breach the systems. This is done through cyber bots breaching these organizations’ systems to assess the value of and extract the data from the system, creating what Charlie Regan, chief executive officer at Nerds On Site, calls “data drip.” 

“We can go into a company and find out in 15 minutes you have got data going at 195,000 drips of data every minute,” Regan previously told Healthcare Facilities Today. “You have got some going to Poland, you have got some going to North Korea and you have got some going to South Africa. You have clients, trusted suppliers or trusted stakeholders in any of those arenas. If not, then you know that you are experiencing data drip.” 

Regan also adds that healthcare facilities can take what is known as a zero-trust approach, where any party who wishes to access an organization’s resources is immediately deemed untrustworthy. For these parties to access the resources, they would have to pass a series of checks to verify who they are, such as multifactor authentication (MFA). 

Regan further says that facilities managers must keep an ever-watchful eye on their data drip, even keeping an eye on what third-party vendors that healthcare facilities share their data with.  

Jeff Wardon, Jr. is the assistant editor for the facilities market. 

October 18, 2023

Topic Area: Information Technology , Safety , Security

Recent Posts

Selecting the Right Team for Healthcare Projects

Focusing on key criteria ensure design and construction teams deliver a facility that is safe, functional and tailored to a specific healthcare setting.

How the Ascension Ransomware Attack Happened

An employee mistakenly downloaded a malicious file.

Community Health Network Announces New Central Indiana Campus

The new 425,000-square-foot facility is expected to be completed in mid-2026.

Lighting and Wayfinding: Keys to Senior Independence

Lighting can make wayfinding more manageable in senior living communities.

RUHS and PMB Break Ground on The Wellness Village Project

The 445,000-square-foot integrated health village is slated for completion in 2026.


FREE Newsletter Signup Form

News & Updates | Webcast Alerts
Building Technologies | & More!


All fields are required. This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.


Healthcare Facilities Today membership includes free email newsletters from our facility-industry brands.

Facebook   Twitter   LinkedIn   Posts

Copyright © 2023 TradePress. All rights reserved.