Search
Close this search box.

Managing Healthcare Risk in a Networked World

Independently conducted by Ponemon Institute LLC  |  Sponsored by Michigan Healthcare Cybersecurity Council

Appendix: Detailed Survey Results

The following tables provide the frequency or percentage frequency of responses to all survey questions contained in this study. All survey responses were captured in September 2021.

Survey Response
Frequency
Percentage
Total sampling frame
6,700
100%
Total returns
255
3.8%
Rejected surveys
36
0.5%
Final sample
219
3.3%

Part 1. Screening questions

SQ1. How familiar are you with your organization’s efforts to reduce its cybersecurity risk?
Percentage
Very familiar
40%
Familiar
38%
Somewhat familiar
22%
Not familiar/No knowledge (stop)
0%
Total
100%
S2. What percentage of your organization is devoted to providing healthcare services to patients in the State of Michigan?
Percentage
Less than 5% (stop)
0%
5% to 25% (stop)
0%
26% to 50% (stop)
0%
51% to 75%
32%
76% to 100%
68%
Total
100%
S3. What percentage of your workweek is devoted to information security strategy or tactical planning and response?
Percentage
0% (stop)
0%
Less than 5% (stop)
0%
5% to 25%
14%
26% to 50%
19%
51% to 75%
29%
76% to 100%
38%
Total
100%
Extrapolated value
61%

Part 2. Environment: leadership, policies, and governance

Q1. What best describes the healthcare organization you work in?
Percentage
Hospital, public (non-VA, non-IHS)
11%
Hospital, private
30%
Health system, public (non-VA, non-IHS)
15%
Health system, private
31%
Veteran’s Administration facility(-ies)
8%
Indian Health Services facility(-ies)
5%
Total
100%
Q2. What best describes the organizational department or function in which you reside?
Percentage
Administration
15%
Information technology (IT)
34%
IT security
15%
Clinical services
12%
Management
14%
Compliance & audit
8%
Other (please specify)
2%
Total
100%
Q3. How many licensed beds are available within your hospital?
Percentage
None (ambulatory care)
40%
Less than 100 beds
13%
100 to 250 beds
21%
251 to 500 beds
13%
501 to 1,000 beds
8%
More than 1,000 beds
5%
Total
100%
Extrapolated value
209
Q4. What security threats is your organization most concerned about? Please select the top four threats.
Percentage
Unsecure medical devices
49%
Cyber extortion (ransomware)
43%
Cyber attackers
41%
Phishing
40%
Third-party misuse of patient data
39%
Insecure mobile apps (eHealth)
30%
Use of public cloud services
28%
System failures
26%
Identity thieves
23%
Employee negligence or error
21%
Mobile device insecurity
19%
Malicious insiders
14%
Employee-owned mobile devices or BYOD
12%
Process failures
12%
Other (please specify)
3%
Total
400%
Q5. How will your organization’s investment in security technologies change in the next 12 months?
Percentage
Significantly increase
30%
Increase
29%
Stay the same
25%
Decrease
11%
Significantly decrease
5%
Don’t know
0%
Total
100%
Q6. How do you believe your organization’s dependency on third parties will change over the next three years?
Percentage
Significantly increase
25%
Increase
33%
Stay the same
23%
Decrease
15%
Significantly decrease
4%
Total
100%
Q7. Who is most accountable for ensuring cybersecurity risks are addressed in a timely manner? Please select only one top choice.
Percentage
CIO/CTO
15%
IT security leader (CISO)
25%
Security leader (CSO)
9%
Chief risk officer (CRO)
7%
Compliance/legal
6%
Business unit leader
20%
Operations leader
8%
No one role has overall accountability
8%
Other (please specify)
0%
Total
98%
Q8. Who is most accountable for ensuring compliance with privacy and security regulations? Please select only one top choice.
Percentage
CIO/CTO
12%
IT security leader (CISO)
17%
Security leader (CSO)
5%
Chief risk officer (CRO)
9%
Chief privacy officer (CPO)
6%
Compliance/legal
20%
Business unit leader
16%
Operations leader
7%
No one role has overall accountability
8%
Other (please specify)
0%
Total
100%
Q9. Who is most accountable for an enterprise-wide strategy for minimizing risks to your organization’s sensitive and confidential data? Please select only one top choice.
Percentage
CIO/CTO
21%
IT security leader (CISO)
12%
Security leader (CSO)
3%
Chief risk officer (CRO)
13%
Chief privacy officer (CPO)
6%
Compliance/legal
12%
Business unit leader
15%
Operations leader
3%
No one role has overall accountability
14%
Other (please specify)
1%
Total
100%
Q10. How often are your cybersecurity policies reviewed and adjusted as needed?
Percentage
Monthly
7%
Quarterly
15%
Bi-annually
11%
Annually
19%
No set time (e.g., ad hoc)
22%
Only when our organization has a cybersecurity incident
24%
Unsure
2%
Total
100%
Q11. Does your organization use any continuous monitoring product or service?
Percentage
Yes
34%
No
60%
Unsure
6%
Total
100%
Q12. Did the level of digital maturity affect the ability of your organization’s workforce to work remotely due to the pandemic?
Percentage
Yes
50%
No
43%
Unsure
7%
Total
100%
Q13. Does your organization have a comprehensive inventory of its critical applications and who has access to them?
Percentage
Yes
34%
No
59%
Unsure
7%
Total
100%
Q14. Does your organization have a comprehensive inventory of its hardware and/or software?
Percentage
Yes
29%
No
71%
Total
100%
Q15. How many network-connected devices do you think your organization has?
Percentage
Less than 1,000
8%
1,000 to 10,000
9%
10,001 to 20,000
20%
20,001 to 50,000
26%
50,001 to 100,000
21%
100.001 to 200,000
9%
200,000
7%
Total
100%
Extrapolated value
55,925

Part 3. Incident experience and response

Q16. What types of security incidents has your organization experienced in the past 12 months? Please check all that apply.
Percentage
Advanced persistent threats (APT) / targeted attacks
37%
Botnet attacks
34%
Clickjacking
19%
Denial of services (DoS)
44%
Exploit of existing software vulnerability greater than 3 months old
31%
Exploit of existing software vulnerability less than 3 months old
29%
Lost or stolen devices
54%
Ransomware
42%
Rootkits
25%
Spear phishing
43%
SQL injection
21%
Web-borne malware attacks
23%
Zero-day attacks
19%
Total
421%
Q17. How many successful cyberattacks has your organization experienced over the past 12 months?
Percentage
None
19%
1 to 5
21%
6 to 10
20%
11 to 25
15%
26 to 50
11%
51 to 100
8%
More than 100
6%
Total
100%
Extrapolated value
22.24
Q18. How many data breaches has your organization experienced over the past 12 months?
Percentage
None (please skip to Q21)
16%
1 to 2
32%
3 to 4
37%
More than 5
15%
Total
100%
Extrapolated value
2.7
Q19. What percentage of these incidents were successfully mitigated?
Percentage
Less than 10%
11%
11% to 25%
14%
26% to 50%
20%
51% to 75%
23%
76% to 100%
32%
Total
100%
Extrapolated value
53%
Q20. Have any of these incidents involved the loss or exposure of patient information in the past 12 months?
Percentage
Yes
64%
No
30%
Unsure
6%
Total
100%
Q21a. Does your organization have a cybersecurity incident response plan?
Percentage
Yes
63%
No (please skip to Q22)
30%
Unsure (please skip to Q22)
7%
Total
100%
Q21b. If yes, how often does your organization exercise its incident response plan?
Percentage
Monthly
11%
Quarterly
16%
Bi-annually
14%
Annually
23%
No set time (e.g., ad hoc)
20%
Only when our organization has a cybersecurity incident
16%
Total
100%
Q21c. If yes, who is involved in the incident response program? Please check all that apply.
Percentage
Corporate counsel/compliance
52%
Human resources
43%
Information security
65%
Information technology
54%
Lines of business
41%
Privacy office
6%
Risk management
39%
Finance
29%
Internal audit
21%
Other (please specify)
3%
Total
353%

Part 4. Data loss prevention

Q22. Does your organization have an enterprise-wide data management strategy?
Percentage
Yes
54%
No (please skip to Q24)
37%
Unsure (please skip to Q24)
9%
Total
100%
Q23. Which of the following risks does your organization’s data management strategy address? Please select all that apply.
Percentage
Privileged user access management
33%
Third-party vendors
54%
Malicious insiders
38%
Negligent insiders
40%
Cyber criminals
47%
Unplanned downtime
56%
Data breaches
39%
Total
307%
Q24. What types of data is your organization most concerned about protecting? Please select all that apply
Percentage
Accounting and financial information
17%
Administrative and scheduling information
23%
Clinical trial and other research information
15%
Email content and attachments
36%
Employee information, including payroll data
42%
Login credentials
54%
Passwords and other authentication credentials
62%
Patient billing information
49%
Patient medical records
80%
Productivity applications
40%
Total
418%
Q25a. How would you rate your confidence that data loss prevention technologies and processes used in your organization have reduced the loss or leakage of sensitive information? Please use the 10-point scale provided below.
Percentage
1 or 2
21%
3 or 4
29%
5 or 6
14%
7 or 8
20%
9 or 10
16%
Total
100%
Extrapolated value
5.12
Q25b. If confident (7+ responses) why? Please select all that apply
Percentage
Sufficient budget (money)
29%
Sufficient staffing
53%
Effective technologies
47%
In-house expertise
40%
Clear leadership
56%
Understanding how to protect against cyberattacks
41%
Management sees cyberattacks as a significant risk
39%
Considered a top priority
30%
Other (please specify)
3%
Total
338%
Q26. Does your organization have mandatory cybersecurity training for its workforce?
Percentage
Yes
48%
No (please skip to Q31)
52%
Total
100%
Q27. Which function is most accountable for ensuring mandatory cybersecurity training is conducted by your organization? Please provide your top two choices.
Percentage
Corporate counsel/compliance
35%
Human resources
31%
Information security
28%
Information technology
28%
Lines of business
42%
Privacy office
5%
Risk management
7%
Finance
6%
Internal audit
7%
No one function is most accountable
10%
Total
200%
Q28. When are employees required to take cybersecurity training? Please select all that apply.
Percentage
Only upon joining the organization
40%
Every six months
15%
Once each year
29%
Only after the organization has a cybersecurity incident
35%
No set time (e.g., ad hoc)
40%
Only when the organization has a security incident
32%
Total
191%
Q29. Which of the following threats does your training program cover? Please select all that apply
Percentage
Credential theft
45%
Cyber attackers
37%
Cyber extortion (ransomware)
38%
Employee negligence or error
35%
Employee-owned mobile devices or BYOD
16%
Insecure mobile apps (eHealth)
20%
Malicious insiders
27%
Mobile device insecurity
9%
Phishing
56%
Risks created by geographically separated employees, including overseas locations
12%
Risks created by working remotely
60%
Third-party misuse of patient data
40%
Total
395%
Q30. Does your organization have cybersecurity training for its senior leaders such as tabletop or operational exercises?
Percentage
Yes
39%
No
54%
Unsure
7%
Total
100%
Please rate the following statements using the agreement scale: Strongly Agree and Agree combined
Percentage
Q31. Our organization’s senior leaders take a cross-functional approach to identifying gaps in security and vulnerabilities in order to understand, prioritize, mitigate and communicate risks that exist throughout the organization.
41%
Q32. Our organization’s senior leaders are involved in prioritizing cybersecurity threats, determining the organization’s willingness to accept a certain level of risk and identifying strategies to minimize risk.
39%
Q33. In our organization IT management and senior leaders work closely together to manage cybersecurity risks and to have an effective cybersecurity incident response plan in place.
35%
Q34. The need to improve when, where and how healthcare is delivered (e.g., telemedicine) is the key to a healthier population.
62%
Q35. There is an urgent need for artificial intelligence decision-making tools/technologies and interconnected devices that can seamlessly track patients’ status.
58%
Q36. Our senior leaders make compliance with such regulations as the HIPAA Security Rule, Joint Commission, and state privacy regulations a higher priority than improving the cybersecurity posture of our organization.
34%
Q37. Our organization is proactive in understanding third-party relationships, monitoring and overseeing vendors and updating and monitoring and enforcing contract terms.
37%
Q38. It is critical to have a comprehensive cybersecurity awareness training program that educates all technology users to recognize attack vectors and to reduce, prevent and to respond to cybersecurity incidents.
47%
Q39. Our organization has problems balancing the pursuit of digital innovations with the need to comply with regulations and reduce cybersecurity risks.
59%
Q40. Our senior leaders believe they can pursue opportunities to improve the customer/patient experience, develop new market opportunities and launch innovative business initiatives while concurrently strengthening the protection of sensitive data and IT assets.
40%
D1. How many years of relevant experience in the healthcare industry do you have?
Percentage
Less than 1 year
0%
1 to 5 years
5%
6 to 10 years
16%
11 to 15 years
26%
16 to 20 years
30%
More than 20 years
23%
Total
100%
Extrapolated value
15.7