New Tech, New Threats: How AI is Changing Cybersecurity for Behavioral Health Organizations

In September 2024, a misconfigured server from Confidant Health, a Texas-based artificial intelligence (AI) platform specializing in behavioral healthcare, exposed 5.3 TB of sensitive data including mental health assessments, patient medical records and even recordings of therapy sessions (Wired). 

This isn’t an isolated incident. In fact, it underscores a growing problem. With the development of AI, two major threats are emerging in the behavioral health sector: over-reliance on AI systems and the rise of AI-enhanced cyber-attacks. 

Let’s explore these risks and steps your organization can take to stay ahead of the cyber threats caused by fast-paced AI innovation. 

How Much Can We Rely on AI? 

In recent years, AI has become an attractive tool for behavioral healthcare organizations for its value in streamlining operations. With AI, providers can more efficiently analyze patient data, identify patterns, create schedules and more. Some organizations are even turning to AI to create personalized patient wellness plans (Healthcare IT Today). However, as in the Confidant Health case, over-reliance on AI comes with risks: 

1. Compliance Challenges: New technologies are not exempt from HIPPA and other regulations. AI systems must be compliant to handle patient data. Failure to properly secure these systems can result in devastating breaches. 

2. AI Learning from Sensitive Data: AI requires large datasets to function effectively. In behavioral health organizations, patient records are required to train AI systems. Failure to anonymize these records, misconfigurations or insufficient safeguards can result in breaches of classified data. 

3. Bias in AI Algorithms: AI models pick up on the biases in the data they’re trained on. These biases can lead to flawed outcomes, especially in behavioral health, where diagnoses and care plans are not always straightforward. 

AI-Enhanced Cybercrime 

At the same time that AI has become a powerful tool for care providers, it’s become an equally powerful weapon for hackers. Cybercriminals are using AI to enhance their tactics, making their attacks faster, more precise and harder to detect. 

Cybersecurity Threats 

1. Vishing (Voice Phishing): Phishing has existed almost as long as email, but AI has introduced more advanced scams that can be nearly impossible to recognize. AI-generated voices can convincingly mimic real humans, leading to a rise in “vishing,” in which exploitative phone calls seem to come from high-level personnel.

2. AI-Generated Code: Hackers leverage AI to scan infrastructure setups, identifying vulnerabilities faster than humans. This allows ransomware attacks to fire before security teams can respond (CSET). 

3. Data Poisoning: Data poisoning occurs when the information used to train AI models is tampered with, causing them to malfunction or make harmful decisions (IBM Think). Tampered AI systems used in behavioral healthcare have the potential to misdiagnose patients or recommend inappropriate treatments.  

Defending Against AI-Driven Threats 

1. Employ Experts: Ensure your organization employs skilled IT professionals who understand AI systems and their vulnerabilities. Regularly audit and update your AI tools to comply with security standards. 

2. Keep Sensitive Data Under Human Control: Critical decisions and sensitive data management should remain under human oversight to reduce the risk of leaks or compromise. 

3. Stay Ahead of Phishing Schemes: Regularly update staff training to reflect the latest phishing and vishing tactics. Use simulated phishing attacks to test and improve employee readiness. 

4. Boost Your Incident Response Plan: Make sure your team knows what to do in case of a cyberattack and update your strategy as new threats emerge. 

Whether you’re carefully considering integrating AI into your operations, it’s already a part of your daily workflow or you work with computers at all, it’s important to stay informed. By understanding AI’s risks to cybersecurity, you can adopt proactive defense strategies and keep your data, your patients and your organization safe and secure.