Most dentists think ransomware happens to hospitals and big companies, not to a small practice. The criminals know better, and so does Dr. Lorne Lavine.
Lorne was a practicing periodontist for 10 years and has spent 25 years helping dental practices across North America with IT, cybersecurity and HIPAA. In this episode, Naren Arulrajah asks him what is real and what is exaggerated about ransomware, and what practice owners need to do about it.
What they cover:
- Why a patient record is worth more on the black market than almost anything else, and why small practices are easy targets
- The one thing you should never tell a ransomware gang, and what double and triple extortion look like
- Why criminals now go after IT companies to hit hundreds of practices at once
- Why built-in antivirus isn't enough, and how zero-day attacks slip past it
- Application whitelisting: the bouncer at the door that has stopped every attack on Lorne's clients
- How one click on an email link lets ransomware in, and what to do if you're hit
- The HIPAA breach notification rule: letters to every patient, the government's 'Wall of Shame' and the local news
- Why practices lose 15 to 20% of their patients after a breach, and take 18 to 24 months to recover
- Staff training, unpatched software and phones on the office Wi-Fi
THE ONE THING FROM THIS EPISODE
Check your backup and your cyber liability insurance this week. If you were hit with ransomware tomorrow, a clean backup is what lets you restore without paying, and insurance is what covers the lawsuits, fines and patient letters.
WORK WITH US
Marketing: book a strategy meeting with Naren's team at ekwa.com/wired
Technology: schedule a call with Lorne at thedigitaldentist.com/call
Subscribe at wireddentistry.com/subscribe for the episode, plus the one thing from it worth doing, written down.
Chapters
00:00:00 – Introduction: Meet Dr. Lorne Lavine
00:02:43 – Why Would Criminals Target a Small Dental Practice?
00:05:11 – Never Tell Them You Have Insurance
00:06:32 – Double and Triple Extortion
00:07:29 – Why Hackers Go After IT Companies
00:08:34 – The Kaseya Attack, and Why Most Practices Never Report
00:10:54 – Why Built-In Antivirus Isn't Enough
00:13:27 – Zero-Day Attacks
00:14:03 – Application Whitelisting: The Bouncer at the Door
00:17:39 – How One Click Lets Ransomware In
00:21:54 – What Happens When You're Hit
00:24:01 – The HIPAA Breach Rule and the Wall of Shame
00:26:47 – Losing 15 to 20% of Your Patients
00:29:03 – How Long It Takes a Practice to Recover
00:30:14 – Staff Training: The Human Factor
00:31:45 – Unpatched Software and Windows 10
00:34:43 – Why Smart People Still Click
00:36:16 – Phones in the Practice
00:37:09 – How to Reach Dr. Lavine