Baptist Health Insider Steals From Patients

Insider threats are real. This is especially true with the healthcare industry. A recent report from Verizon Enterprise stated that while ransomware attacks account for about 85% of all breaches related to malware that hit healthcare last year, insiders are a big threat to those organizations. Often it is legitimately human error, but in the case of West Kendall Baptist Hospital in Miami, it was a very deliberate insider attack that caused the hospital to send out breach notifications to 1,480 patients recently.

As the story goes, an employee stole credit card information of those patients and used them to make fraudulent purchases. This was discovered in March and was reported to law enforcement. The employee is now a former employee, as one would expect.

Personal healthcare information (PHI) is very valuable on the dark web. In fact, it is now thought to be even more sought after than payment card information. It sells for sometimes triple the price, or even more.

Unfortunately, the risk of healthcare information being accessed by unauthorized parties is increasing. This is because physicians, hospitals, and other organizations related to the healthcare industry are migrating files from paper to electronic records (ePHI). It no longer requires a physical burglary for someone to steal the information. On top of that, the risk of getting caught for electronically accessing records is very low for the cybercriminals doing it.

However, those who visited the hospital and paid with cards between the long period of August 2014 and March 2018 were potentially impacted in this incident. Names, birthdates, and payment card details were taken. At this point, it doesn’t appear the insider was after information to commit healthcare fraud. It is still not only important to monitor payment card charges, but also to take a close look at any insurance statements for potential fraud. If you notice something suspicious on those, contact the medical provider’s office first, in case they made a typographical error. This does happen. If that wasn’t the issue, you should contact your insurer right away.

In this case Baptist Health is offering credit-monitoring services to those affected. Take advantage if this is offered. It will not prevent fraud, but these services will alert you if someone tries to open a credit account with your information. And if you don't need to have anyone access your credit, consider freezing it.

To freeze credit, contact each of the three major credit bureaus (Equifax, Experian, and TransUnion) and ask for a freeze. This will prevent anyone from accessing your credit. This includes you. If you plan to open a credit account, rent a home, or get security clearance, for example, you will need to have that access to your report available. However, you can also freeze and unfreeze as needed. Just make sure to check the terms, conditions, and lead times for each bureau. Also, there may be some charges to do this, depending on where you live.

Whatever you decide to do, just make sure to keep an eye on your credit and health records. While we cannot protect them 100%, just catching suspicious items quickly can save a lot of time, money, and grief.