Third Party Vendors May Put Healthcare Facilities at Risk for Cyberattacks 

Third-party vendors are becoming a possible vector for cyberattacks.

By Jeff Wardon, Jr., Assistant Editor

Cyberattacks and data breaches continue to hammer healthcare facilities. As they do, facility managers are tasked with keeping watch on where sensitive data is being shared on an around-the-clock basis.  

Another avenue for attackers is becoming increasingly clear: third-party vendors. 

According to Cook County Health’s (CCH) press release, Perry Johnson & Associates (PJ&A), Inc., a third-party vendor CCH shared information with for medical transcription services, notified CCH that there was a data breach on PJ&A’s systems that involved some of their patient data. After learning this, CCH cut off its ties to PJ&A.  

Third-party vendors can be a potential vector for cyberattacks, as seen in the large chain of healthcare attacks due to a MOVEit software vulnerability. Since healthcare facilities actively share information with these vendors, a data breach at the vendor’s systems can expose sensitive patient information.  

However, either at the source or the third-party level, this data can be accessed by other individuals if they breach the systems. This is done through cyber bots breaching these organizations’ systems to assess the value of and extract the data from the system, creating what Charlie Regan, chief executive officer at Nerds On Site, calls “data drip.” 

“We can go into a company and find out in 15 minutes you have got data going at 195,000 drips of data every minute,” Regan previously told Healthcare Facilities Today. “You have got some going to Poland, you have got some going to North Korea and you have got some going to South Africa. You have clients, trusted suppliers or trusted stakeholders in any of those arenas. If not, then you know that you are experiencing data drip.” 

Regan also adds that healthcare facilities can take what is known as a zero-trust approach, where any party who wishes to access an organization’s resources is immediately deemed untrustworthy. For these parties to access the resources, they would have to pass a series of checks to verify who they are, such as multifactor authentication (MFA). 

Regan further says that facilities managers must keep an ever-watchful eye on their data drip, even keeping an eye on what third-party vendors that healthcare facilities share their data with.  

Jeff Wardon, Jr. is the assistant editor for the facilities market. 

October 18, 2023

Topic Area: Information Technology , Safety , Security

Recent Posts

The Advantages of Access Control Technology Over Traditional Formats

Access control manufacturers discuss the technology’s potential benefits.

Preparing for the Hazards of Winter Weather

Winter is here and healthcare facilities must be ready for inclement weather to prevent slips and falls.

The Leapfrog Group Announces 2023 Top Hospital and Top ASC Award Winners

132 hospitals earned the Top Hospital Award, and 27 ambulatory surgery centers earned the Top ASC Award.

Tampa General Hospital Completes Acquisition of Bravera Health

This acquisition will expand TGH’s capabilities and reach.

Protecting Healthcare Facility Workers During Winter Weather

As facility managers brace for colder weather, workplace safety must remain top of mind.


FREE Newsletter Signup Form

News & Updates | Webcast Alerts
Building Technologies | & More!


All fields are required. This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.


Healthcare Facilities Today membership includes free email newsletters from our facility-industry brands.

Facebook   Twitter   LinkedIn   Posts

Copyright © 2023 TradePress. All rights reserved.