Electronic Health Reporter

Guest post by Greg Mancusi-Ungaro, CMO, BrandProtect

Since 2009, the personal health information of almost 30 million Americans has been compromised. From Partners Healthcare and Anthem to the UCLA Health System and Children’s National Health System, it’s clear that healthcare organizations are a hot target, especially as medical records include exactly the kind of valuable data cyber criminals want to get their hands on. And, since information like social security numbers and birthdates can’t be “turned off” in the ways that stolen credit card numbers can, once cyber criminals get ahold of such records, they can do significant damage with them like counterfeiting patients’ identities.

It is crucial that the healthcare industry be vigilant when it comes to cyber security. From hospitals and insurers, to medical groups and individual practices, health-related organizations must ensure they are taking all possible measures to keep the personal information of their patients – not to mention their own brand reputation and business – safe. That begs some questions: Why are healthcare organizations such a hot target? How are they (and their patients) being targeted, and, and what can the industry do to stay one step ahead of cybercriminals and mitigate the ensuing risks?

What Makes Healthcare a Prime Target?

Healthcare organizations are a large target for many reasons. First and foremost, they possess extremely valuable assets, including the personal, family and billing information of their patients. It isn’t the blood type or cholesterol reports that make electronic health records the most valuable records on the cybercrime black market; it is the virtually complete personal identity information, including social security numbers, parents, maiden names, addresses, emails, children names and, in some cases, complete information of close friends. They are the holy grail of the identity theft world.

Second, the available attack surface in the healthcare industry is very complex. The healthcare industry contains many different organizations that have, over the past few years, moved to electronic systems, but not to a truly centralized electronic system. The reality of today’s healthcare records infrastructure is that there are many networks, data formats, communications protocols, passwords and access points all patched together. Not only is this amalgamated network challenging to maintain, it creates massive opportunities for compromise. Cybercriminals know this.

Healthcare is in the Cybercrime Crosshairs

Doctors are at the center of the healthcare universe. They interact and interface with patients, insurers, services providers and hospitals. Their office networks and smart devices connect with practically every network that affects their business. But doctors are not information technology or security experts. Less than 40 percent of doctors based in the U.S. feel that their cybersecurity processes are above average. Their lack of technical savvy and security knowledge makes them easy pickings for sophisticated cybercriminals. They need education and protection.

Patients are also prime targets. The Affordable Care Act (ACA) has accelerated the dramatic shift of health insurance and medical services to a digital transaction model. With the emergence of affordable individual policies, not tied to employer offerings, and online markets for health insurance, many more individuals are using online recourses to evaluate insurance options, enroll and manage their healthcare. Patients also go online to update their records, view and manage results and appointments, and make payments. Insurers and hospitals use email to communicate and confirm transactions, or to flag issues with accounts or with payments. This is where cybercriminals see their opportunity. Additionally, the ACA has introduced healthcare options – requiring online healthcare management — to many families who are not as familiar with online risks, so they are easy prey for phishing and other cyberattacks.

Reducing the Risk of a Successful Attack

Almost all cyber events start out the same way, with a successful attack on a single individual (an employee, doctor or patient) or device. This initial incursion, whether through malware, social engineering or another means, can lead to illegal network access and records theft over the course of weeks or months. But if a healthcare organization can successfully reduce the risk of a successful first attack, they make it harder for cyber criminals to gain this access.

Continue Reading