Medical School Loses Patient Data...Again

An incident at Washington University School of Medicine demonstrates the importance of continual training about cybersecurity to an organization’s employees. In late March, school officials found out that one of the employees fell victim to a phishing attack that resulted in access to email accounts that contained information on 80,270 patients.

The incident occurred in early December of last year, but it was only learned of in late January. Information that was included in the stolen email accounts included names, dates of birth, medical record numbers, diagnoses, treatments, and some social security numbers.

This is not the first time this University’s medical school has been compromised. In early 2013, a surgeon from the school was travelling to Argentina and lost a laptop that contained data on 1,100 of the patients he had been treating. Later that same year, an employee opened an attachment in an email message that contained malware which subsequently took control of the computer. These three instances alone show how important it is to keep training and re-training anyone with access to your network. A study by the security firm Avecto found that 68% of us don’t hesitate before clicking attachments or links in email messages when we think they are from a known sender.

Ensure that each and every employee is trained on phishing continually. One time a year is not sufficient as these Washington University instances show. Include information on identifying phishing attempts and steps to take should someone fall victim. Waiting months to report it is risky so make sure everyone knows what to do if they do. Mistakes happen. But it helps if people know what to do if they make one. Then confirm that the training is working by testing them.

If you don’t have resources to do this in house, there are many companies that provide cybersecurity training materials and services as well, to help keep everyone’s skills in tip top shape.

This is one of the largest healthcare related breaches so far this year. Hackers are specifically targeting healthcare these days. The information contained in these records can be sold on the Dark Web from $50-360 each. Earlier this year, the FBI warned healthcare organizations that hackers were targeting them to get access to this protected information. The Health and Human Services Department (HHS) warned that in 2016, over 13 million people were affected by breaches. Additionally, eHealth, Inc. reported an incident this year and breaches at Campbell County Health and St. John’s Medical Center, both in Wyoming, proved that the size of an organization doesn’t matter to the hackers.