By John Trest, Chief Learning Officer, VIPRE Security Group
LinkedIn: John Trest
X: @VIPRESecurity
Healthcare organizations find themselves on the front lines of an ongoing battle to protect sensitive patient information, and emerging information shows that the sector experiences more data breaches than any other industry. Adding to this volatility is that attack vectors are constantly changing, and AI tools like ChatGPT, are making it easier for nefarious groups to create more customized, realistic looking spam emails.
For medical practices, there’s never been a better time to ramp-up their team’s awareness of the various threats lurking in cyberspace. As cyber-attacks rapidly become more sophisticated, old-school security awareness training doesn’t hack (pun intended) it anymore for healthcare organizations.
Recent research shows that 91% of data breaches started with a spear-phishing attack – an email phishing attack that mimics a trusted individual or organization and targets specific individuals in an attempt to convince them to provide information or access to protected data and systems. Hackers are now using AI tools to develop more expertly crafted messages thus improving phishers’ abilities to dupe recipients.
Medical practices can easily set up phishing simulations for their employees that mimic actual attacks with a variety of real-life emails and take steps to secure their email communications. For example, recent VIPRE Security Group research shows organizations that send simulated phishing attempts to their employees at least once a month have a 27% decrease in employees falling victim to phishing attacks. Given the important information that medical practices possess, hackers are likely to focus their effort on these businesses.
Causes of Healthcare Sector Breaches
Health data breaches are not solely the result of malicious hackers. They can be caused by various incidents, including credential-stealing malware, accidental disclosures by employees, or the loss of electronic devices. The primary focus of cybercriminals, however, lies in Personal Health Information (PHI), which is significantly more valuable on the black market than credit card credentials or regular Personally Identifiable Information (PII).
PHI’s high value stems from the fact that it contains immutable data about an individual’s medical history, including illnesses, surgeries, and more. Criminals can exploit this information to commit fraud, create fake insurance claims, or illegally obtain prescription medications. While some argue that credit card data holds its own market value, the prevalence of PHI theft remains a concerning issue.
Regulatory Compliance and the Complex Landscape of Data Protection
Safeguarding patient data goes beyond the traditional boundaries of cybersecurity. Health practices are tasked with protecting sensitive information but also with navigating an increasingly complex landscape of data protection regulations. While the Health Insurance Portability and Accountability Act (HIPAA) remains the cornerstone of patient data protection, it’s just one piece of the regulatory puzzle.
Healthcare organizations also must grapple with a patchwork of state-level laws that add further layers of complexity to data protection. Some states, such as California, have introduced stringent data protection regulations like the California Consumer Privacy Act (CCPA). These state laws require healthcare entities to meet specific standards and respond to data breaches promptly. Non-compliance can result in severe penalties.
Likewise, patient data often transcends borders. For healthcare organizations dealing with international patients or collaborating with global partners, compliance with international data protection standards, such as the European Union’s General Data Protection Regulation (GDPR), becomes essential. GDPR, in particular, places strict requirements on data handling, consent, and notification of data breaches.
Health practices must establish a comprehensive understanding of the regulatory landscape to ensure compliance at all levels. This includes not only understanding the nuances of HIPAA, state laws, and international standards but also staying updated on evolving regulations. Moreover, healthcare entities must implement policies and practices that align with these diverse regulations, ensuring a robust and adaptable approach to data protection.
Preventing data breaches in healthcare starts with robust application security and network security measures. Encryption plays a vital role in safeguarding patient data, whether it’s at rest or in transit. It is essential to ensure that third parties and vendors who have access to healthcare networks or databases also handle patient data with the utmost care. Furthermore, training employees on the proper usage and handling of PHI can significantly reduce data breaches caused by employee error.
Healthcare requires healthy cyber prevention
Health data breach statistics reveal a potentially concerning upward trend. In 2021, there were more reported data breaches than in any previous year. While there was a slight decrease in reported breaches in 2022, it’s too early to determine if this is a long-term trend or a temporary deviation. The statistics are based on data breaches of 500 or more records reported to the U.S. Department of Health and Human Services’ Office for Civil Rights (OCR).
Over the years, the main causes of breaches have evolved. Initially, loss or theft of healthcare records and electronic protected health information dominated the breach reports. However, with the transition to digital record keeping and the adoption of encryption technologies, these types of breaches have decreased significantly.
The primary causes of healthcare data breaches today are hacking and IT incidents, with unauthorized access and disclosure incidents also occurring frequently. The scale and frequency of hacking incidents have been on the rise since 2015, contributing to the growing number of data breaches in the healthcare sector. Furthermore, business associates, a group closely tied to healthcare organizations, suffered more data breaches in 2022 than any other type of HIPAA-regulated entity.
Because of these evolutions and sophistication. Healthcare hacking has gotten more complex and more difficult to manage. This is where simple but effective training and prevention strategies enter the conversation.
Conclusion
As healthcare organizations continue to face the ever-evolving threat of data breaches, it’s clear that safeguarding patient data is a top priority. While HIPAA and other regulations provide frameworks for protection, healthcare providers must continually adapt to the changing landscape of cyber threats. By implementing robust security measures, encryption, and thorough employee training, medical practices can help reduce the risk of data breaches and protect the sensitive information they hold. The upward trend in healthcare data breaches serves as a reminder that vigilance and proactive measures are essential to maintaining patient trust and data security.