Protection of Healthcare Data Should be Part of Overall Cybersecurity Strategy

Ensuring data security is becoming more important for healthcare organizations and not something that should be left solely up to the IT department or the CIO. In fact, because of the type of information that healthcare organizations store and transmit, it is more important than ever to involve the CEO as well as other executives in a comprehensive cybersecurity strategy.

Unfortunately, how best to identify and address risks and prevent data breaches is difficult at best and completely overwhelming to some in the top roles. CIOs are now looking closely at new technology solutions, the limitations of them, and any regulations that may specifically address their own organizations so they can take them to their leadership. However, CIOs are a busy lot and often these items seem to get pushed down the priority list in favor of other seemingly more pressing issues.

The reality is that this behavior needs to change. Threats are getting more sophisticated and aggressive. Technology just can’t keep up at the same pace and no CEO wants to see his or her organization in the news because of a data breach.

The FBI has stated that identity theft has doubled in the past five years. That’s not encouraging news for healthcare-related organizations or for patients, because the information they have is extremely sensitive and very useful to identity thieves.

The key reasons for data breaches include primarily criminal attacks and human error.

Criminal attacks – Healthcare data is very valuable. Estimates put the value of a single record between $50 and $360. One attack can result in a vast number of records that can be used by a criminal directly or sold on the black market. In just the first three-quarters of 2016, the U.S. Department of Health and Human Services (HHS) reported that over 13 million people were affected by a healthcare-related breach.

Human error – Unfortunately, humans are still capable of making mistakes and often these lead to loss of information. Contributing to this is improper device disposal or mishandling of personal health information. These can include honest errors, intentional insider misuse of information, or even misplacement or loss of hardware. In 2016, the HHS was a victim itself when someone lost a hard drive containing healthcare data of five million patients. In 2015, the Boston Baskin Cancer Foundation had some hard drives stolen and also in 2015 a non-profit dealing with health information had several laptops stolen. Those last two incidents included stolen data of over 100,000 people.

One of the more important aspects of ensuring overall security is how to best secure data during transmission. This becomes more significant to an overall strategy as more healthcare records are transitioning from paper to electronic form. Because of this and other reasons, an organization was set up to establish a common security framework. It is called Health Information Trust Alliance or HITRUST. It is being adopted by many organizations, which are also requesting its use by its vendors.

And navigating the various regulations in place for those in healthcare is an ongoing challenge. There are other standards being used to help with this such as the Service Organization Control 2 (SOC 2) framework, the International Organization for Standards (ISO), and the Statement on Standards and Attestation Engagements (SSAE) No. 16. Which are right for any given company is dependent upon each situation, but integrating some or parts of these into security will help to ensure the effectiveness of any processes and procedures that are put into place.

What can CIOs and IT staffs do to ensure all facets are covered?

• Educate executives, particularly at the C-level on the importance of data security and the need to ensure safe transmission and storage of data.
• Update policies and procedures to address data breach prevention. Ensure your incident response plan is comprehensive and includes how to identify risks, prevent breaches, and what to do should one occur. Review and update these at least annually.
• Communicate with others in the industry on what they use, how they structure their security policies, and what works and perhaps doesn’t work for them.
• Consider getting a certification for safe transmission of data. This has far-reaching effects not only for peace of mind within the company, but builds confidence with patients and customers.
• Establish and implement a security awareness program to help everyone understand threats, risks, and how to prevent and address them, should they happen.

While taking these steps will assist in meeting HIPAA and other requirements, cybersecurity should never be thought of as merely checking a box to meet regulatory minimums. It should be part of an organization’s overall operational strategy too.