Health Data is a Prime Target: How to Minimize Risk

More than 60 percent of healthcare organizations suffered a data breach in the past 12 months, according to information security researcher Ponemon Institute. In total, over 5 million healthcare records were exposed or stolen among entities studied by Ponemon.

Recent incidents show no abatement in cybercriminals’ attraction to healthcare data. For example, Florida Hospital reported earlier this month that patient information on 12,724 individuals might have been exposed through a malware infection on three of the organization’s websites. Three months earlier, St. Peter’s Surgery & Endoscopy Center in New York disclosed that hackers had potentially gained access to server-based medical records of nearly 135,000 patients.

Healthcare in the Crosshairs

Approximately 7 million patients will have their data compromised by hacks in 2019, estimates consulting firm Accenture, racking up billions of dollars in costs to hospitals and health systems.

What makes the healthcare particularly vulnerable?

A Computerworld report explains that healthcare data, which includes personal identifiers and medical histories, can be sold virtually unchallenged over time on the black market. In contrast, financial data often becomes useless once a breach has been discovered and passcodes changed. Cybercriminals, aware of the premium value of healthcare records, focus their attacks in pursuit of the greatest possible returns.

Other factors contributing to healthcare’s data security liability include:

• increasing access to medical records as entities share information across integrated sites of care;
• legal requirements to store medical records for extended periods of time;
• efforts to connect electronic health record systems, often relying on unsecured patches that can open the door to unauthorized entry; and
• inadequate education of employees about modes of cyberattacks.

On a broader scale, but not to be discounted, foreign governments’ so called “state actors” may attempt to accumulate healthcare data that could help in social engineering of future attacks. Such a tactic might deploy emails to individuals who have a specific medical condition — with malware linked to prompts for more information.

Risk Mitigation

Big data sets in healthcare, despite ever-increasing volume, can be managed through ongoing risk assessments and implementation of preventative security controls, such as continuous monitoring programs. However, those measures come at a cost that must be weighed against the uncertainty of threat protection.

“Each organization needs to evaluate risk and its security needs in the context of its organizational and business requirements to determine where it makes the most sense to invest their people, time and financial resources,” advises Christine Sublett, a member of the Department of Health and Human Services’ Healthcare Industry Cybersecurity Task Force.

NetDirector’s HealthData Exchange platform deserves consideration as healthcare organizations work through their cybersecurity evaluations. The system combines HIPAA-based security and HL7 standard interfacing compliance — with attestations available upon request. Additionally, NetDirector uses a physically secure Peak10 facility for hosting customer data. This approach ensures data integrity without the need for additional IT investment and the associated risk of self-managing connection points among exchange partners.

For more information on HealthData Exchange, please contact us or request a free demo.