You Can Stop Healthcare Data Breaches

Today, nobody argues that the healthcare industry is a gold mine for the bad guys and theft of protected health information is becoming a regular event. The “Verizon 2015 Protected Health Information Data Breach Report,” indicated that 90 percent of industries in the medical and health care arena have experienced a PHI breach and with all the reports in the media, it is clear to everyone that the situation has reached a critical point.

In 2015, we witnessed numerous health insurers and hospital systems fall victim to data breaches. While Anthem and Premera were just some of the bigger names making regular headlines last year, attacks were seen to reach even physicians’ offices. Just recently Centene Corporation and IU Health Arnett lost hard drives that compromised almost 1,000,000 people.

Every direction we look, there is significant use of electronic medical records, electronic prescribing, and digital imaging by health care providers. Whether it is the physician’s office, hospitals, insurers, medical associations, laboratories, disease registries, or government agencies, everyone is gathering digital pieces of information on the health status, care details, and health care costs of Americans. Along with personally identifiable information (PII) like names, mailing addresses, email aliases and dates of birth, healthcare entities also hold extremely personal and protected health data, such as lab results, reports, prescribed medications and medical conditions. In the event of a breach, unlike a credit card number, none of this information can be easily changed and the lifecycle of such information is very long – in some cases forever.

The Affordable Care Act has created significant incentives for doctors’ offices to embrace EHR systems as a replacement for paper-based medical records systems. So, now data has been integrated in an effort to do away with siloed approaches within provider groups, health plans, or government offices.

While the industry and governance bodies talk compliance, and claim protected health information is safe and secure, this is far from the truth as evidenced by the constant data breaches that are disclosed. With all the time, effort and money spent on traditional security tools used to achieve compliance, thieves bent on theft are still able to gain access to PHI for monetary gain.

The healthcare industry should consider the following steps to remain secure and stop healthcare data breaches:

Realize and accept your risk – Take note that the protected health data you possess is a target of criminals. Simply complying with HIPAA does not equate to properly securing and locking away PHI data from unauthorized use.
Identify where your PHI data is and who has access to it – Most often healthcare entities have false ideas on where sensitive data is stored and who has access to PHI. It often escapes people’s minds that their users copy sensitive data accessed from secure locations by localizing them or moving copies around. The result is security and control being lost and copies floating around on thumb drives, disks, email, laptops, home computers, and paper printouts.
Properly secure your data – Most, if not all, entities dealing with healthcare data secure PHI at rest and in motion while they completely miss a significant threat gap – “data in use”.
- Label or classify data
- Encrypt your data
- Persistently protect data using policy-driven methods
- Track and monitor usage
- Dynamically adjust usage policies and access
Plan for breach response
- Have means to render breached data useless
- Have an Incident Response Plan

You can stop healthcare data breaches by putting in place data-centric, persistent security to avoid finding yourself scrambling around after the damage has been done to you and your patients.

Lock Your Healthcare Data, Stat

Will the healthcare industry finally move towards the use of encryption in hospitals and other healthcare facilities to protect vulnerable patient and hospital data? More and more preventable incidents keep occurring that put patient information at risk.

A 2015 data breach study estimated that breaches cost the healthcare industry about $5.6 billion annually. As healthcare moves toward more connected care, the amount of data exchanged between organizations will only grow. This is exacerbated by more consumers entering the market because of healthcare reform and the frequency with which patients need to exchange information among numerous providers. This area is a rich target for anyone intent on stealing protected health information (PHI) for financial gain. Data breaches are already happening. So what does this mean?

It means that in 2016, we’re going to see a huge movement towards encryption in hospitals and other healthcare facilities. According to a 2014 Healthcare Breach Report, 68 percent of all healthcare data breaches since 2010 are due to device theft or loss. The headlines make it appear that hackers are attacking databases, but the reality is most of the problems are from unstructured content inside documents. And those documents are not encrypted. Encrypting data is vital to protecting patient information. This is no longer an option, but a requirement.

A recent example of the problem occurred at Centene Corporation in St. Louis, MO. On January 25, 2016, Centene announced that it lost or misplaced six hard drives with personal information of about 950,000 people. Information on the hard drives included names, addresses, dates of birth, Social Security numbers, member ID numbers and health information. The company did not specify if the data on the hard drives was encrypted, but I assume it wasn’t or this would not be considered a data breach event.

Another example was a missing storage device from Indiana University Health Arnett in late 2015. This had PHI of about 30,000 people. This is the second data breach by IU Health Arnett in 2 years. The company lost a laptop with patient data in 2013.

If hackers and other criminals have access to this information, it’s easy to conduct phishing attacks that target patient accounts, including committing fraud. It also invites blackmail and access to bank accounts.

Both healthcare organizations said they are reviewing procedures, security and training to ensure these incidents don’t recur. It looks like it isn’t working. No matter how hard we try to educate people, things happen. We make mistakes and data breaches are the result.

The only way to stop this problem is to encrypt the sensitive data as its created. This eliminates the human element. If the data was encrypted in each case, there would be no data breach event. According to HIPAA rules, if PHI is rendered unusable, unreadable, or indecipherable, a data breach notification is not required. According to the rules:

The guidance specifies encryption and destruction as the technologies and methodologies for rendering protected health information unusable, unreadable, or indecipherable to unauthorized individuals.

Security breaches will occur, so it’s best to implement technology that protects you, your patients and employees. Strong encryption with dynamic security policies is the only way to prevent HIPAA violations.

Blog

You Can Stop Healthcare Data Breaches

Lock Your Healthcare Data, Stat