Ponemon Institute and Censinet® Find Third-Party Risk Costs the Healthcare Industry $23.7 Billion a Year
Research Identifies a Third-Party Risk Management Cost Multiplier of 10x Due to Hidden Costs Across an Organization; Cloud Applications and Medical Devices Drive Risks and Contribute to Average Data Breach Cost of $2.9 Million
Boston – July 10, 2019 – The inability to adequately assess and understand the risks that vendors pose is becoming incredibly costly to healthcare providers, according to a new report released today by Censinet and the Ponemon Institute. According to the research, the yearly hidden costs of managing vendor risk is $3.8 million per healthcare provider, far surpassing the $2.9 million that each data breach costs providers. The cost across the healthcare industry is $23.7 billion per year. The research also indicates that 56 percent of healthcare organizations have experienced a data breach introduced by one or more third-party vendors in the last two years.
The report, “The Economic Impact of Third-Party Risk Management in Healthcare,” analyzes the results of a survey of 554 healthcare IT and security professionals who are involved in managing their organizations’ vendor risk management programs (VRMP).
The report found that 72 percent of respondents believe the increasing reliance upon third-party medical devices connected to the internet is risky, and 68 percent say moving to the cloud while connecting medical devices to the internet creates significant cyber risk exposure. Two out of three respondents believe that current manual risk management processes cannot keep pace with cyber threats and vulnerabilities, while 63 percent believe they cannot keep pace with the proliferation of digital applications and devices. Reliance on inefficient third-party vendor risk management processes and the inability to automate risk assessments and remediation has created an environment where third-party breaches are commonplace and expensive.
These inefficiencies and escalating breaches exist despite the number of resources – both known and hidden – that are involved in the vendor risk management process. The report states that the average healthcare provider has 3.21 dedicated full-time employees spending more than 500 hours per month completing vendor risk assessments. However, the research uncovered that there are significant, additional hidden costs – including the involvement of information security and risk staff, supply chain managers, clinicians, and line of business managers – which increase that number by 10x to 5,040 hours per month that healthcare providers spend managing third-party vendor risk. Even with this time and resource commitment, 60 percent of respondents still believe that time spent on vendor risk assessments takes resources away from other important tasks.
“This research confirms that healthcare providers require a better, more cost-effective approach to third-party risk management,” said Ed Gaudet, CEO and founder of Censinet. “The adoption of technology in healthcare is more rapid and complicated than ever before. As an industry, we must help providers safely enable cloud applications and medical devices optimized to deliver the quality of care hospitals and their patients expect.”
Additional findings of the report include the following:
- Healthcare providers have an average of 1,320 vendors under contract, but just 27 percent said that they assess all vendors annually;
- Fifty-nine percent of respondents said that they believe senior executives in their organization can bypass the third-party assessment process in order to secure a lucrative business relationship, creating an enormous loophole for even the most effective vendor risk management programs;
- Eighty percent of healthcare providers believe that prioritization of vendor risks is very important – but only 36 percent believe their ability to do so is very effective;
- Only 40 percent of respondents say that they believe vendor assessments as they exist today are very valuable for the actionable insights they provide to the C-suite and board of directors;
- Only 21 percent of all vendor risk assessments result in a requirement to remediate prior to doing business with the healthcare provider while only 11 percent result in disqualification.
“It’s clear that healthcare providers are in a tough spot. The number of vendors they rely on is increasing at the same time the threats those vendors pose are escalating in frequency and severity, so it’s easy to see how managing these risks has become an overwhelming problem,” said Dr. Ponemon, chairman and founder of the Ponemon Institute. “But it’s not all bad news – we can very clearly see an opportunity with automation for healthcare providers to monitor, measure, and mitigate the scourge of third-party breaches that continues to plague their industry.”
The vast majority of respondents recognize the importance of automation, such as continuously updating changes to third-party risk (78 percent) and standardizing vendor assessment questionnaires (74 percent) – but only 38 percent are able to achieve automation of each capability. In fact, only one-third of respondents said that they are automating most of their vendor assessment programs, which means that the vast majority of healthcare providers continue to rely on manual, inefficient processes to mitigate third-party risk.
For more information or to download the full report please visit: https://go.censinet.com/ponemon-third-party-vendor-risk-management-research
To learn more about the survey data and best practices watch the recorded webinar, presented by Dr. Larry Ponemon and Ed Gaudet: https://censinet.com/webinar-on-demand-the-economic-impact-of-third-party-risk-management-in-healthcare/
About Censinet
Censinet provides the first and only third-party risk management platform built by and for healthcare providers to manage the threats to patient care that exist within an expanding ecosystem of vendors. With its unique Censinet One-click AssessmentTM capabilities and Digital Vendor CatalogTM, the Censinet Platform reduces the time to assess vendor risk from weeks to seconds, while automating inefficient workflows and providing continuous real-time insights into the changing risk profile of each vendor. Censinet is based in Boston, MA and can be found at https://censinet.com/
About the Ponemon Institute
Founded in 2002 by Dr. Larry Ponemon and Susan Jayson, Ponemon Institute conducts independent research on data protection and emerging information technologies. Our goal is to enable organizations in both the private and public sectors to have a clearer understanding of the trends in regulations and the threat landscape that will affect the collection, management and safeguarding of information assets. Ponemon Institute research informs organizations on how to improve upon their data protection initiatives and enhance their brand and reputation as a trusted enterprise.
Ponemon Institute is the parent organization of the Responsible Management (RIM) Council. The RIM Council draws its name for the practice of Responsible Information Management, an ethics-based framework and long-term strategy for managing personal and sensitive employee, customer and business information. Members of the RIM Council represent a cross-section of Fortune 500 companies and are champions of privacy and data protection in their organizations.
Contact:
Dan Gaffney
fama PR for Censinet
(617) 986-5036
censinet@famapr.com
