“This data – which includes health records, test results, treatment plans etc. – is extremely valuable, which makes it particularly lucrative for cybercriminals. To ensure the future of telehealth, providers need to invest in sophisticated protective measures, as well as ensure that both practitioners and patients are properly educated around best practices for digital wellness,” says Allan Juma, Cyber Security Engineer at ESET East Africa.

To support remote access, which is the key principles of telehealth, these platforms are often integrated with existing healthcare systems such as Electronic Health Records (EHR), Patient Management Systems, and other hospital infrastructure and third-party vendors. While these integrations improve the accuracy and efficiency of diagnosis and treatments, they also increase the complexity of securing these systems. 

“The interconnected nature of the telehealth setup means that a security vulnerability in one system can be exploited, leading to broader breaches that potentially compromise the entire healthcare ecosystem. For example, patients or healthcare workers using insecure connections or compromised devices, can expose the network to cybercriminals. A proactive zero-trust approach can significantly reduce the potential of data breaches,” says Juma.  

Zero trust operates on the principle of “never trust, always verify.” This means that no user or device, whether inside or outside an organisation’s network, is automatically trusted. Instead, safety measures like multi-factor authentication and role-based access control are mandatory for all users. In the context of telehealth, this includes healthcare providers, administrators, and patients. 

“Essentially, the idea is to divide the network into very small segments – each with its own tight access control – and ensure that users only have access to the data they need to perform their duties. This limits the ‘blast radius’ of any potential breach. So, if one segment is breached, the attacker cannot easily move to other parts of the network,” says Juma.  

However, while implementing a zero-trust architecture can help to reduce the likelihood of basic security errors, it can’t eliminate all human error. Healthcare providers and patients may be more susceptible to phishing attacks or social engineering tactics, due to the urgency and trust-based nature of medical interactions. 

“Cybercriminals often exploit the trust in healthcare professionals or use fraudulent communication methods to trick individuals into divulging sensitive information or clicking malicious links. The resulting risks range from ransomware threats to interruptions of real-time communication, which can be especially dangerous in critical care situations. This is why cybersecurity training is so crucial for both staff and patients,” says Juma. 

Telehealth initiatives help an increasing number of people to access basic healthcare every year. By building in cyber protection and driving education among users, telehealth providers can ensure patient data remains secure and enable healthcare practitioners to focus on the real work: providing lifesaving care to the people of Africa.

Distributed by African Media Agency (AMA) on behalf of ESET