3 Strategies for Healthcare Merger, Acquisition Cybersecurity Due Diligence

Assess The Company’s Resiliency, Data Protection Practices

Powers identified two key components to consider when assessing an organization’s resiliency. First, the buyer should consider how the target organization is protecting its data, especially given the highly sensitive data that healthcare entities interact with.

Second, buyers should evaluate how the target organization is protecting its critical assets and operations.

“Whether that's looking at being able to provide care or to continue to maintain systems that are used to provide care, making sure that you're considering the implications of those types of threats and understanding the risk mitigation that's in place against each of those is really important and can also impact the value of the asset that you're purchasing or acquiring,” Powers noted.

Buyers can gain visibility into an organization’s resiliency by looking at key technical and administrative controls, such as how the company handles identity and access management.

Organizations should assess how the company manages who has access to what data, whether the principle of least privilege is being applied, and how administrative-level access is managed, Powers said. This is also a good time to look into whether an organization has implemented multi-factor authentication (MFA) to further protect data from unauthorized access.

“Another piece that I think is important is understanding how systems are being monitored and how unusual or malicious activity can be detected,” Powers continued.

To do so, M&A cybersecurity due diligence experts may focus on endpoint detection and response (EDR). EDR allows organizations to monitor threats in real-time and maintain visibility into servers, SaaS applications, and workstations across the enterprise. A comprehensive EDR solution is a good sign that an organization knows how to identify cyber threats.

“Another key piece is around backups and understanding how systems and data are being backed up and then how those backups are being protected,” Powers explained.

“A lot of times if we look at something like a ransomware event, the attackers oftentimes try to go after the backups first because they know that that's what you're going to rely on to be able to restore systems and restore operations.”

Maintaining reliable, offline backups is crucial to being able to resume operations quickly in the event of a cyberattack.

In addition to backups, Powers noted the importance of user training and awareness programs and incident response plans. HIPAA requires covered entities to implement these administrative safeguards, but the process for doing so may look different depending on the organization.

Identity and access management, endpoint detection and response, backups, user training and awareness, and incident response are key areas to assess during the M&A cybersecurity due diligence process.

Establish A List of Non-Negotiables

If the target organization does not have comprehensive controls in place for one or more of these areas, further action may be needed to ensure that the organization improves its security posture.

“We've seen more recently that private equity firms or strategic acquirers are looking at a list of non-negotiables that they want to have in place either before the transaction closes and before they integrate two organizations,” Powers noted. 

“And then looking at it from a transaction perspective, there can be levers pulled in the negotiation where potential purchase price could be modified to cover some of the gaps that may be identified as part of diligence.”

Establishing a list of non-negotiables quickly can help both the buyer and the target organization prioritize areas of improvement and ensure that the two organizations are ready to integrate.

It may not be feasible to require the target organization to make widespread changes immediately, especially depending on the timeline of the acquisition. However, it is crucial to get these practices in writing and establish a clear plan for security improvements to ensure the transaction and subsequent integration goes as smoothly as possible, especially in healthcare.

“Having a hospital have their IT systems go down is very different from having a retail business have their systems go down. The significance of an attack in healthcare is so much more impactful than in some other businesses,” Powers suggested.

 “And so it's really important to understand what the fallback measures are if something were to happen.”

Remember That Cybersecurity is a Continuous Process

The due diligence process is a good opportunity to assess key risk areas and know what the company is getting into before acquiring or merging. However, Powers noted, cybersecurity is not a “one-and-done” process.

“Whether it's the hold period, if it's a private equity-backed acquisition, or just throughout the life of the company, it's important to keep considering cybersecurity,” Powers emphasized.

“What worked a couple of years ago isn't what's going to work for you in a few years. You may be growing, divesting parts of the business, et cetera, or using technology in different ways, providing different services.”

As healthcare organizations know, cybersecurity must be a continuous effort rather than a compliance checkbox. The same goes for mergers and acquisitions.

“It is important to understand upfront the overall maturity and risks of the company,” Powers acknowledged.

“But it is also important to consider throughout the lifecycle and make sure that you're staying on top of the latest threats, continuing to evolve what you're doing from a cyber perspective, and then, especially if you are going up for sale, making sure that you're addressing a lot of that beforehand to make yourself a more attractive acquisition target.”