Report Finds Healthcare Topping the List of Data Breaches in 2016

A recent report by Beazley Breach Response Services (BBR) has found that the healthcare industry is leading all industries in data breaches in the first half of 2016. The main cause for this is unintended disclosure of information. That category accounts for 42% of all data breach incidents so far, outpacing hacking and malware (18%), physical loss (13%), insider breaches (11%) and other documented causes (14%).

What is included in “unintended disclosure” are items such as misdirected email messages or faxes or disclosing sensitive information to someone while conversing at the water cooler accidently. This could also include leaving sensitive documents on a desk and walking away, opening up the opportunity for someone to access the information that otherwise should not be allowed to see it.

It’s important to have policies and procedures in place on cyber security and they are followed and enforced. While no amount of this will completely eliminate risk, it will lower it and potentially significantly. Make sure your security policy includes clear instructions and addresses the following:

• Bring Your Own Device (BYOD) - With the abundance of personal and portable devices logging into company networks these days, having concise rules on what is and what is not allowed is crucial.

• Anti-virus/Anti-malware - All devices should have anti-virus/anti-malware installed and kept up-to-date. Don’t forget to include contractors in the policy and make it clear that all smartphones, regardless of operating system must also have an anti-malware app installed and kept updated.

• Training – Put a cyber-security training program together and teach employees, vendors, consultants and anyone else with regular access to the facility on what are the risks and how to prevent and remedy them should they occur. Phishing remains at the top of the list of how hackers get malware into networks so be sure to test everyone on how to identify phishing. Don’t forget to include physical security training as well. That will help address the category of unintended as well as physical losses.

• Risk Assessments – Conduct these tests and address any risks possible that are identified. Don’t just do this one time and assume all is well. Perform these regularly to stay on top of the risks.

• Prevention and Detection Tools – Invest in these and ensure they are properly configured and updated at all times. Prevention should not stop at the firewall. It’s possible for these to be bypassed too. In fact, a serious issue was found with the Juniper Networks firewall earlier this year that allowed access to the source code. Put controls inside the firewall as well.

Make sure that policies and procedures are understood by all and that consequences are concise and consistent. Enforce them too. What good are they if they are not followed and if penalties are not issued when necessary?

According to the BBR report, the driver behind the increase in unintended disclosure breaches is due to the increase in information sharing between healthcare organizations. Unfortunately, this is not likely to go away any time soon as the industry transitions from paper records to electronic ones. There is some hope. Not long ago the financial industry led the way in data breaches. However, largely attributed to training and education that number has been in decline for the past several years.