Electronic Health Reporter

By Ken Lynch, founder and CEO, Reciprocity Labs.

For decades now, hackers have been cashing in on financial data. The routine has been constant. A hacker finds their way into a site, steals financial information belonging to the site’s visitors then uses their personal information to create fake credit cards. These are then used to steal money from unsuspecting individuals. However, this trend hit a snag once financial institutions found ways of stopping such activities. This was frustrating to these intruders considering that most times, their efforts were rendered futile after the cards they made are blocked.

These people then discovered a new cash cow that allows them to reap money from insurance companies. Typically, hackers get as little as $1 for one credit card, which is a meager payment for such a dangerous job. However, healthcare information pays well in that they create counterfeit health insurance cards, then make cash claims in fabricated hospitals. Considering that the demand for this data is high, healthcare data attacks have been on the rise, targeting several hospitals, and they have managed to affect over 11 million people.

How do you keep your data safe from these online breaches?

With such high stakes, each hospital needs to come up with security measures that ensure their data is always safe. Look at some of the possible ways you can secure your information.

Asses the risks

You cannot solve a problem if you are not aware that it even exists in the first place. Check for loopholes that leave your hospital vulnerable to these attacks. For instance, a hospital with few employees leaves specific sectors such as the IT section unmanned, which makes them susceptible to being attacked. You must approach this by looking at the most sensitive areas of a company and find out the consequences that you may face if your data is stolen.

Appraise all agreement with business partners, vendors and client every year

Know the type of information that the people and entities you interact with access. Learn what your contract entails and review the speculations regularly. Long before new laws were formed, third-party companies never had any agreements with any of their partners. Whenever they got a hold of information, it was up to them to know what they wanted to do with such intel. In this era, such loopholes can lead to massive scandals, which is why you need to evaluate every past action and put stringent measures to ensure anyone who encounters sensitive information knows the implications of going against the agreement. Do not give a lot of authority to vendors and ensure that they sign privacy policies that bar them from sharing or using private data.

Give your employees compliance management responsibilities

Get an advocate for InfoSEC. You need someone to prioritize data security. This person should gather information from across the organization to help strengthen the security by always having an ear to the ground. Having a solid understanding of HIPAA will allow them to explain how it applies to the business in plain English.

Create awareness

The best way to create awareness is to hold trainings that will help everyone identify the signs of a potential breach. Remember not to make the talk about the data, but make the employers understand what they risk facing if there is a data breach. Make it more about them. This helps to sink the point home much faster, especially since no one wants to be implicated in matters that regard theft of online information. The training is an eye-opener to people who feel that they cannot be a target of a security breach.

Come up with a security enhancing plan

Security involves putting in place several measures that work coherently to secure your date. These are:

• Policies
• Governance
• Optimization
• Observation and report making
• Engineering and operations

The size of the organization and the amount of data at risk will help guide the security choices you make.  Depending on each threat’s potential effect on the business you can rank them by importance and create controls based on them. To address a number of risks you may adopt a cybersecurity framework like HiTRUST which sets standards and best practices in establishing and maintaining data security while also helping meet HIPAA governance.

By taking a risk-based approach with your employees. You can determine which employees are more likely to be hacker’s targets. These are the ones you provide with robust security training and availabilities to ensure they are well prepared to handle the situation in case it arises.

Ensure that even after the training session, your employers are conscious of the looming threats. This will help them recognize potential breaches; reward employees who are conscious about security. This will enhance a better environment where everyone always strives to be alert.

Staying updated

Finally, you must keep your security software updated regularly. The essence of taking such steps is to ensure that your firewalls are strong enough to hold back any hacking attempts. Imagine trying to treat a disease with already outdated medicine? You would probably succumb to the illness since the disease will not respond to this treatment. This is the same case with online security. Hackers find new ways of maneuvering their way into people’s systems from time to time. Security companies, on the other hand, come up with fresh ideas that help counter such instances. As a healthcare business, it is essential to get modern and up-to-date security measures to ensure that whatever malware that comes your way does not adversely affect operations.