Far too many healthcare organizations are losing data and they don’t even know it.
When you think of the biggest threat to healthcare security, what do you picture? Do you picture hackers? Do you picture malware? Employees?
Yes, those are all important issues, but a common problem I’ve seen recently isn’t just the threat of data breaches, or even the lack of proper security. The biggest problem with healthcare data security and HIPAA is complacency.
See also: A Snapshot of the 2017 SecurityMetrics Guide to HIPAA Compliance: The Status of Healthcare Security
When it comes to the security aspect of HIPAA, many healthcare organizations are complacent, thinking a data breach won’t happen. As a result, far too many organizations are losing data and they don’t even know it.
People love the idea that stealing data is a really technical and complicated process, like an Oceans 11 movie or an episode of Mr. Robot. In reality, stealing data from some organizations is often embarrassingly easy.
Many organizations don’t realize how easy it is for someone to walk in, take something with valuable data on it, and walk out. Social engineers can easily install malware and steal data from healthcare systems due to inadequate employee training and security.
See also: Physical Security: What You Aren’t Thinking About
Don’t believe me? Target’s breach was super technical when they got into the network, but how they got into the network was not technical at all. In any breach, there are a series of items that companies overlooked and ultimately lead to breach(s). The same can be said for Target. Targets HVAC vendor had insecure passwords and remote access into Targets networks. Attackers obtained those weak passwords and essentially “walked” right into the network. That’s when the more complicated and technical attacks began.
See also: SecurityMetrics HIPAA Guide
In most cases, your IT people do care about security. But if the rest of your organization doesn’t care, your security people are going to quickly get frustrated and then eventually stop caring.
Here’s an example: a service provider wants to have IT open up an insecure port/protocol so a doctor can gain access to the network from home. The IT people say no, and then the doctor goes to the higher up and complains. Most organizations wish to keep providers happy, so they make the IT people do it.
Security people can make money anywhere, but having a secure organization is all about culture. If the providers don’t care about security, IT people are often going to go somewhere else.
There’s a lot of talk about financial institutions as the top organizations getting breached. In reality, it’s healthcare. Personal information and healthcare records run for much more on the black market versus card data.
Nearly 90 percent of healthcare organizations have been breached in the past 2 years. These breaches have exposed over 112 million records and cost the healthcare industry $5.6 billion annually. Most, if not all of these breaches could have been prevented if the organization had followed more secure practices.
Basically, if you don’t secure your data, you will get breached.
Many organizations may think that dealing with a breach will be less damaging than having to deal with security. This is patently false. If you are breached no one can bail you out, and you haven’t and won’t be able to protect your patients. If data gets stolen, you’re screwed.
Not only are you putting your patients at risk, but also your reputation. Breached organizations often lose 40% of their clients.
Basically, a data breach will cost you a lot more than you think. There’s the cost of legal fees, HHS fines, and handling patient data loss. Also remember that while a credit card can be easily replaced, a social security number can’t. Essentially, if you’re handling patient data (and not just social security numbers), you have much more to lose.
See also: How Much Does a Data Breach Cost Your Organization?
To put it simply, many higher-ups don’t care. No one understands security and HIPAA, and because they don’t understand it, they push it to the side and hope it goes away or never causes any “real” issues. Because the top people are complacent about security, the rest of the organization generally follows suit.
It’s important for C-suites to be aware of their organization’s security needs and promote a culture of security and HIPAA compliance. They should know where their networks may be vulnerable and what is being done to address those vulnerabilities.
Follow for more data security articles like this
You need to promote the culture of data security and HIPAA in your organization. Employees should be trained in security procedures and handling issues like social engineering. There should be security policies set in place and employees need to follow them.
We need to start treating health data like it’s as valuable as it really is, and we need to start this process today!
It’s also important to maintain your security and compliance. Just because you’re secure today, doesn’t mean tomorrow will be the same.
Have a continuous cycle of security improvement. Here are a few tips to maintain security and HIPAA compliance:
.svg)
