Cyber resilience must be built into healthcare at the very start

The healthcare industry is an attractive target for cybercriminals as organisations often have to share patient data across providers, applications and cloud environments. While this connectivity has brought improvement in efficiency and ensures continuity of care and better decision-making, it also expands the attack surface and makes protecting information more complex.

Discussing the industry’s vulnerabilities with iTNews Asia, Wai Kit Cheah, CISO for Asia-Pacific at Lumen Technologies, said it is critical patient safety is maintained while safeguarding sensitive data. To do this, healthcare providers must build cyber resilience into their systems and operations, from securing data flows to preparing for ransomware attacks.

Patient records have become valuable targets for cybercriminals, while the growing movement of healthcare data creates additional security challenges. “Protecting patient records remains fundamental, and the risks today have expanded,” Cheah said.

As healthcare systems become more interconnected, organisations need visibility into where data travels, who can access it and how it is processed. This includes understanding the role of third-party providers, cloud platforms and AI-enabled workflows.

Cheah said security must be incorporated when systems are first designed, rather than added after integrations are established. Identity and access controls, visibility, segmentation, governance and incident response should form part of the architecture from the outset.

Connectivity itself is not necessarily a weakness, he said, but inadequate security across an interconnected environment can introduce risks.

Make resilience part of clinical operations

Cybersecurity in healthcare extends beyond protecting IT infrastructure.

If clinicians cannot access patient records, diagnostic systems or laboratory data, treatment can be delayed. Disruptions to pharmacy and scheduling systems can also affect the delivery of care. “The final measure of resilience is not just about availability and uptime,” Cheah said.

He said healthcare organisations should assess whether essential clinical activities can continue during a disruption, including emergency care and access to critical patient information.

This requires technology teams to work with clinical leadership, operations, procurement and governance.

Cyber resilience must be treated as an operational responsibility, with clear ownership of risks and decisions.

- Wai Kit Cheah, CISO for Asia-Pacific at Lumen Technologies

Cheah said organisations should identify their most critical services and the systems supporting them, while mapping dependencies across third-party vendors, cloud platforms, connected devices and data flows.

They should also test their response arrangements under realistic disruption scenarios rather than relying only on tabletop exercises or documented procedures. Clear fallback processes are needed for situations in which digital systems become unavailable.

Accountability is equally important during an incident. “During an incident, people need to know who makes decisions,” Cheah said.

Be prepared for ransomware recovery

Cheah said Lumen has worked with customers on resilience-as-a-service arrangements that include ransomware response planning, incident-response structures and immutable data backups.

These arrangements are designed to help organisations recover following a ransomware attack. While he is unable to cite examples of the customers involved, Cheah said recovery can take minutes rather than days or weeks.

He added that preparation for an attack is essential, and forms part of a broader approach to resilience: organisations need to understand which services are critical, how they depend on interconnected systems and what steps they must take when those systems are disrupted.

How to manage risks in AI-enabled workflows

The use of AI in healthcare adds further considerations for data security and accountability.

Cheah said organisations should map the full workflow around an AI model, including where patient data originates, which applications process it, whether external models or third parties are involved, and where the data is stored.

He recommended controls such as identity and access management, encryption, logging and, where appropriate, data masking to minimise the exposure of personally identifiable information when medical records are used in AI prompts.

Organisations must also consider what happens if an AI model produces an incorrect result, becomes unavailable or is compromised. Traceability is important so that the data supporting an AI-generated conclusion or recommendation can be examined.

“The goal is not to slow down innovation but is to make AI safe so that we can scale with it,” Cheah said.

For healthcare providers, Cheah said building cyber resilience means bringing security architecture, governance, procurement and clinical operations together from the beginning. The ultimate aim, he adds, is to identify critical services, test recovery arrangements and establish clear responsibilities before an incident occurs.