The 6th annual “Ponemon Institute Benchmark Study on Privacy & Security of Healthcare Data” reflects the sector’s escalating security issues as a primary target for malicious actors. The study finds that 89% of healthcare institutions and organizations surveyed had a data breach in the past two years, with 79% reporting two or more in 24 months, and nearly half (45%) reporting more than five. Also, a full 60% of 3rd party business associates have also been breached in the last two years. In addition to the potential impacts on privacy and even (in the case of ransomware attacked) quality of care, the financial impact of breaches is major: an estimated $6.2 Billion this last year.
Brad Bussie, Director of Product Management, STEALTHbits Technologies:
“A good tactic that healthcare and third party business associates could adopt is in-sourcing security professionals. Cyber Security is advancing exponentially and organizations can capitalize on this explosive growth. There are firms that specialize in securing healthcare and third business associates with models that cater to capital expenditures or operating expenditures. The excuse that there is lack of budget, people, or expertise to manage data breaches is no longer valid. Security by obscurity is to blame and unfortunately for healthcare, the spotlight has been turned directly towards where they have been hiding.”
Adam Laub, Sr. Vice President, Product Marketing, STEALTHbits Technologies:
Craig Kensek, security expert, Lastline:
“Security is going to take a coordinated effort between health care organizations and every doctor who sends/receives patient records is a potential source of data loss, either where data is stored, or while it’s transit. In effect, this study is another potential call for off-network backups and the encryption of critical data. In some respects, health data/patient records is more valuable than financial data to consumers as well as bad actors. You can always open new accounts, change institutions, and do a variety of things – short of changing your social security number. Your health records are “forever” and can now be used for a variety of fraud purposes, which is why the cost of a stolen health record on the dark web is greater than that for a financial record.
“For both financial institutions and health organizations, this is a call for cooperation in best practices against the bad guys. Institutions need to cooperate – the reliability of their security should not be a marketing tool for competing against each other.
“Institutions must invest in penetrating testing before they are breached, rather than wait until after. It’s time to end the ‘closing the door after the horse is gone’ mindset. Penetration testing is much less expensive to invest in than breach remediation, as are security detection and prevention, and avoid the impacts on actual losses, brand losses, loss of consumer confidence, etc. Rigorous employee training is essential, such as random “attacks” initiated by the institutions themselves.
“BYOD continues to be a weakness. Institutions must enforce policies and ensure that employees adhere to them, regarding the employee’s own devices. Make sure there are ‘phone home’ capabilities and if the device is lost, the institution should be allowed to make it into a brick, rendering the device useless.”
The opinions expressed in this post belongs to the individual contributors and do not necessarily reflect the views of Information Security Buzz.