Free EMR Newsletter Want to receive the latest news on EMR, Meaningful Use, ARRA and Healthcare IT sent straight to your email? Join thousands of healthcare pros who subscribe to EMR and HIPAA for FREE!!

Number Of Health Data Breaches Grew Steadily Over Last Several Years

Posted on October 5, 2018 I Written By

Anne Zieger is a healthcare journalist who has written about the industry for 30 years. Her work has appeared in all of the leading healthcare industry publications, and she's served as editor in chief of several healthcare B2B sites.

New research has found that while the number of patient records exposed per breach has varied widely, the number of health data breaches reported grew substantially between 2010 and 2017.

The study, which was conducted by researchers with Massachusetts General Hospital, was published in JAMA. Its aim was to look at the changes in data breach patterns as EHRs have come into wider use.

The authors analyzed 2,149 reported breaches over the previous seven years. The number of records breached for incident varied from 500 to almost 79 million patient records.

Researchers behind the study put breaches reported in three categories: those taking place at healthcare provider sites, within health plans, and at business associate locations.

One thing that stuck out from among the data points was that over that seven-year period, the number of breaches increased from 199 the first year to 344 in 2017. During that period, the only year that did not see an increase in incident volume was 2015.

Another notable if unsurprising conclusion drawn by the researchers was that while 70% of all breaches took place within provider organizations, incidents involving health plans accounted for 63% of all breached records.

Overall, the greatest number of patient records breached was due to compromised network servers or email messages. However, the top reasons for breaches have varied from year-to-year, the analysis found.

For example, the most common type of breach reported in 2010 was theft of physical records. The most commonly breached type of media that year was laptop computer data storage, followed by paper and film records.

Meanwhile, by 2017 data hacking or other information technology incidents accounted for the largest number of breaches, followed by unauthorized access to or disclosure of patient data. In addition, a large number of breaches could be attributed to compromised network servers or email messages.

The number of patient records exposed differed depending on what media was breached. For example, while the total of 510 breaches of paper and film records impact about 3.4 million patient records, 410 breaches of network servers affected nearly 140 million records.

Being Honest About Your Reasons For Cybersecurity Decisions

Posted on August 16, 2018 I Written By

Anne Zieger is a healthcare journalist who has written about the industry for 30 years. Her work has appeared in all of the leading healthcare industry publications, and she's served as editor in chief of several healthcare B2B sites.

This week, a team of McAfee researchers released a paper outlining a terrifying exploit. The paper describes, in great technical detail, how a malicious attacker could flip a cardiac rhythm display from 80 beats per minute to zero within less than five seconds.

This might not lead to severe harm or death, but it’s possible that other very negative outcomes could occur, notes Shaun Nordeck, MD, who’s quoted in the report. “Fictitious cardiac rhythms, even intermittent, could lead to extended hospitalization, additional testing, and side effects from medications prescribed to control heart rhythm and/or prevent clots,” he notes.

The paper does point out that if the bedside monitor is working normally, nurses have access to other accurate data, which could diminish the impact of such disruptions to some extent. However, the potential for adverse events is clearly higher than normal if someone scrambles a patient’s vitals.

Unfortunately, this is far from the only attack which wasn’t possible before connected devices became the norm. At various points, we’ve seen that pacemakers, insulin pumps and even MRIs can be hacked externally, particularly if their operating systems aren’t patched as required or haven’t put even basic security protections in place. (Think using “password” as a password.)

But while these vulnerabilities are largely known at this point, some healthcare organizations haven’t begun to tackle them. Solving these problems takes work, and costs money, The best-intentioned CIO might not get the budget to fix these problems if their CEO doesn’t see them as urgent.

Or let’s say the budget is available to begin the counterattack. Even if everyone agrees to tackle connected device vulnerabilities, where do we begin the counterattack? Which of these new connected health vulnerabilities are the most critical?  On the one hand, hacking individual pacemakers doesn’t seem profitable enough to attract many cybercriminals. On the other, if I were a crook I might see the threat of meddling with a hospitals’ worth of patient monitors to be a great source of ransom money.

And this brings us to some tough ethical questions. Should we evaluate these threats by how many patients would be affected, or how many of the sickest patients?  How do we calculate the clinical impact of vital signs hacking vs. generating inaccurate MRI results? To what extent should the administrative impact of these attacks be a factor in deciding how to defeat these challenges, if at all?

I know you’re going to tell me that this isn’t an all or nothing proposition, and that to some extent standard network intrusion detection techniques and tools will work. I’m not disputing this. However, I think we need to admit out loud that these kinds of attacks threaten individual lives in a way that traditional cyberattacks do not. For that reason, we need to get honest about who we need to protect — and why.

More Than 3 Million Patient Records Breached During Q2 2018

Posted on August 15, 2018 I Written By

Anne Zieger is a healthcare journalist who has written about the industry for 30 years. Her work has appeared in all of the leading healthcare industry publications, and she's served as editor in chief of several healthcare B2B sites.

A new study by data security vendor Protenus has concluded that more than 3 million patient records were breached during the second quarter of 2018, in a sharp swing upward from the previous quarter with no obvious explanation.

The Protenus Breach Barometer study, which drew on both reports to HHS and media disclosures, found that there were 143 data breach incidents between April and June 2018, affecting 3,143,642 million patient records. The number of affected records has almost tripled from Q1 of this year, when 1.13 million records were breached.

During this quarter, roughly 30% of privacy violations were by healthcare organizations that had previously reported a data breach. The report suggests that it is because they might not have identified existing threats or improved security training for employees either. (It could also be because cyberattackers smell blood in the water.)

Protenus concluded that among hospital teams, an investigator monitors around 4,000 EHR users, and that each was responsible for an average of 2.5 hospitals and 25 cases each. The average case took about 11 days to resolve, which sounds reasonable until you consider how much can happen while systems remain exposed.

With investigators being stretched so thin, not only external attackers but also internal threats become harder to manage. The research found that on average, 9.21 per 1,000 healthcare employees breached patient privacy during the second quarter of this year. This is up from 5.08 employee threats found during Q1 of this year, which the study attributes to better detection methods rather than an increase in events.

All told, Protenus said, insiders were responsible for 31% of the total number of reported breaches for this period. Among incidents where details were disclosed, 422,180 records were breached, or 13.4% of total breached patient records during Q2 2018. The top cause of data breaches was hacking, which accounted for 36.62% of disclosed incidents. A total of 16.2% of incidents involved loss or theft of data, with another 16.2% due to unknown causes.

In tackling insider events, the study sorted such incidents into two groups, “insider error” or “insider wrongdoing.” Its definition for insider error included incidents which had no malicious intent or could otherwise be qualified as human error, while it described the theft of information, snooping in patient files and other cases where employees knowingly violated the law as insider wrongdoing.

Protenus found 25 publicly-disclosed incidents of insider error between April and June 2018. The 14 of which for which details were disclosed affected 343,036 patient records.

Meanwhile, the researchers found 18 incidents involving insider wrongdoing, with 13 events for which data was disclosed. The number of patient records breached as a result of insider wrongdoing climbed substantially over the past two quarters, from 4,597 during Q1 to 70,562 during Q2 of 2018.

As in the first quarter, the largest category of insider-related breaches (71.4%) between April and June 2018 was healthcare employees taking a look at family members’ health records. Other insider wrongdoing incidents including phishing attacks, insider credential sharing, downloading records for sale and identity theft.

HIPAA Security Infographic

Posted on August 6, 2018 I Written By

John Lynn is the Founder of the HealthcareScene.com blog network which currently consists of 10 blogs containing over 8000 articles with John having written over 4000 of the articles himself. These EMR and Healthcare IT related articles have been viewed over 16 million times. John also manages Healthcare IT Central and Healthcare IT Today, the leading career Health IT job board and blog. John is co-founder of InfluentialNetworks.com and Physia.com. John is highly involved in social media, and in addition to his blogs can also be found on Twitter: @techguy and @ehrandhit and LinkedIn.

There are a lot of nuances to HIPAA. Hopefully, you’ve addressed them as part of your security risk analysis and any mitigation work that’s required as part of that analysis. Unfortunately, even an organization that does a solid HIPAA security risk analysis often doesn’t communicate what was done in that analysis to the rest of the organization.

With this in mind, I found this HIPAA security infographic by eFax to be valuable for those that aren’t deep in the nuances of HIPAA, but that want a quick overview of some common HIPAA issues that they should know about.

Healthcare Security Humor – Fun Friday

Posted on August 3, 2018 I Written By

John Lynn is the Founder of the HealthcareScene.com blog network which currently consists of 10 blogs containing over 8000 articles with John having written over 4000 of the articles himself. These EMR and Healthcare IT related articles have been viewed over 16 million times. John also manages Healthcare IT Central and Healthcare IT Today, the leading career Health IT job board and blog. John is co-founder of InfluentialNetworks.com and Physia.com. John is highly involved in social media, and in addition to his blogs can also be found on Twitter: @techguy and @ehrandhit and LinkedIn.

After Mike Semel’s recent post on embarrassment, career suicide, or jail, it may seem a bit ironic to offer some healthcare security humor. That’s exactly why we think it’s good to share some healthcare security humor. We love irony and we often have to remember that what we do is extremely serious, but we shouldn’t take ourselves too seriously. Plus, humor can often get a point across in a way that is extremely memorable. That’s how I felt when I saw the healthcare security cartoon below:

This cartoon reminds me of the hospital CIO who told me “I’m most concerned with the 21,000 security vulnerabilities that existed in my organization. I’m talking about the 21,000 employees.” This is a real problem and one that many people don’t take serious enough in healthcare. It’s not something you can just put as a line item on a budget. It takes shaping the culture of your organization and that’s hard, but essential.

Healthcare CIOs Focused On Patient Experience And Innovation

Posted on August 2, 2018 I Written By

Anne Zieger is a healthcare journalist who has written about the industry for 30 years. Her work has appeared in all of the leading healthcare industry publications, and she's served as editor in chief of several healthcare B2B sites.

Not long ago, 22 healthcare CIOs had a sit-down to discuss their CEOs’ top IT-related priorities. At the meeting, which took place during the 2018 Scottsdale Institute Annual Conference, the participants found that they were largely on the same page, according to researchers that followed the conversation.

Impact Advisors, which co-sponsored the research, found that improving patient experiences was priority number one. More than 80% of CIOs said patient engagement and better patient experiences were critical, and that deploying digital health strategies could get the job done.

The technologies they cited included patient-facing options like wearables, mobile apps and self-service tools. They also said they were looking at a number of provider-facing solutions which could streamline transitions of care and improve patient flow, including care coordination apps and tools and next-generation decision support technologies such as predictive analytics.

Another issue near the top of the list was controlling IT costs and/or increasing IT value, which was cited by more than 60% of CIOs at the meeting. They noted that in the past, their organizations had invested large amounts of money to purchase, implement and upgrade enterprise EHRs, in an effort to capture Meaningful Use incentive payments, but that things were different now.

Specifically, as their organizations are still recovering from such investments, CIOs said they now need to stretch their IT budgets, They also said that they were being asked to prove that their organization’s existing infrastructure investments, especially their enterprise EHR, continue to demonstrate value. Many said that they are under pressure to prove that IT spending keeps offering a defined return on investment.

Yet another important item on their to-do list was to foster innovation, which was cited by almost 60% of CIOs present. To address this need, some CIOs are launching pilots focused on machine learning and AI, while others are forming partnerships with large employers and influential tech firms. Others are looking into establishing dedicated innovation centers within their organization. Regardless of their approach, the CIOs said, innovation efforts will only work if innovation efforts are structured and governed in a way that helps them meet their organization’s broad strategic goals.

In addition, almost 60% said that they were expected to support their organization’s growth. The CIOs noted that given the constant changes in the industry, they needed to support initiatives such as expansion of service lines or building out new ones, as well as strategic partnerships and acquisitions.

Last, but by no means least, more than half of the CIOs said cybersecurity was important. On the one hand, the participants at the roundtable said, it’s important to be proactive in defending their organization. At the same time, they emphasized that defending their organization involves having the right policies, processes, governance structure and culture.

Embarrassment, Career Suicide, or Jail

Posted on July 26, 2018 I Written By

Mike Semel is a noted thought leader, speaker, blogger, and best-selling author of HOW TO AVOID HIPAA HEADACHES . He is the President and Chief Security Officer of Semel Consulting, focused on HIPAA and other compliance requirements; cyber security; and Business Continuity planning. Mike is a Certified Business Continuity Professional through the Disaster Recovery Institute, a Certified HIPAA Professional, Certified Security Compliance Specialist, and Certified Health IT Specialist. He has owned or managed technology companies for over 30 years; served as Chief Information Officer (CIO) for a hospital and a K-12 school district; and managed operations at an online backup company.

What You Can Learn from the Russian Army, the US Navy, and a Suspended Nurse

The General Counsel at one of our clients is a former district attorney who prosecuted identity theft cases. When I told him we work with people who think Identity Theft is a victimless crime, he got very angry, and rattled off a list of cases he had tried that had lasting damage to the victims. Cybercrimes and compliance violations are not victimless.

Identity theft victims have suffered threats of violence, financial ruin, threats of arrest, effects of business interruptions, damaged careers, and emotional and physical stress.  Some considered suicide.

Most data breaches are malicious, but some who committed bad acts did not know they were breaking laws. They thought their actions were just ‘mischief’, or mistakenly thought what they were doing was OK, but found out the hard way that they had committed crimes. Their careers were killed and some faced criminal charges. Some blamed their training, which may have been incomplete, but ignorance of the law is no excuse.

SPEAR-PHISHING by the RUSSIAN ARMY

Twelve members of the GRU, the Russian military intelligence service, were indicted by the United States for meddling with our elections, by using spear-phishing techniques that were remarkably effective. Those who were targeted suffered public shame and career damage.

Phishing is when hackers send out broadly-targeted e-mails, seemingly from banks, fax services, and businesses, trying to sucker many people into clicking on the link and sharing their personal data, or having malicious software silently install on their computer.

Spear-phishing is when a personally-targeted message is sent just to you, seemingly from a colleague or vendor – using names you recognize – asking you to send sensitive information or to click on a link that will install malicious software. These messages can be very tough to spot, because the hackers make you think that this is a personal message from someone you know. One popular method is to send the message from an e-mail address that is one or two letters different from a real address. Your eyes play tricks and you miss the slight difference in the address.

Spear-phishing resulted in the Russians allegedly getting the logins and passwords of Democratic and Republican party officials, which they used to get access to e-mails and other sensitive data.

Another personally targeted attack resulted in a company’s HR staff sending its W-2 tax details, including all employee Social Security Numbers, at the request of their CEO, who actually was a hacker using a very similar e-mail address to the CEO at the targeted company. Employees filed their tax returns, only to find out the hackers had already filed phony tax returns and gotten refunds, using their names and Social Security Numbers. Now these employees are on special lists of victims, delaying their future tax refunds; making it more difficult to get loans and maintain their credit ratings; and creating real stress and anxiety.

Spear-phishing has been used successfully by hackers to get CFO’s to transfer money to a hacker’s bank account, at the supposed request of their company’s CEO. These scams are often discovered way too late, only after a CFO casually says to a CEO that they transferred the $ 500,000 the CEO requested, only to see the look of panic on the CEO’s face.

What You Should Do

  • Individuals: Beware of every e-mail asking you to provide personal information, click on a link, transfer money, or send sensitive information. Call or meet face-to-face with the person requesting the information, to ensure it is legitimate.
  • Employers: Use a phishing training vendor to train your employees to recognize and report phishing and spear-phishing attempts. Use spam filters to block messages from known hackers. Implement policies to slow down the transfer of sensitive data, by requiring a phone or in-person verification any time someone in your organization receives a request for sensitive data, or a money transfer. While inconvenient, a delay is much better than discovering the request was fraudulent.

STEALING DATA – US NAVY SECRETS, and a SUSPENDED NURSING LICENSE

A former employee of a US Navy contractor was found guilty in federal court of stealing secret information simply by using a company computer to create a personal DropBox account, and transferring thousands of company documents. Jared Dylan Sparks is awaiting sentencing on six convictions that can each bring 10 years in federal prison, after he stole trade secrets from his current employer while seeking employment at another company.

In another case, the New York State Department of Health suspended a FORMER nurse after she took 3,000 patient records from a previous employer to her new job.

According to healthitsecurity.com, “the list included the patients’ names, addresses, dates of birth, and diagnoses. Martha Smith-Lightfoot asked for the list to ensure continuity of care for the patients. However, she did not receive the permission of URMC or the patients to give the information to her new employer.”

Smith-Lightfoot agreed to a one-year suspension, one year stayed suspension, and three years’ probation. She can’t work as a nurse for a year. What do you think her career chances will be, after her suspension, any time someone verifies her license status and sees why she was suspended?

What You Should Do

  • Individuals: Understand the requirements of your license or certification, and the laws that protect data. Licensing requirements for privacy and confidentiality pre-date HIPAA. While your organization may face a HIPAA penalty, you may face a damaged or destroyed career, as well as jail time.
  • Employers: Educate your workforce (EVERYONE, including employees, volunteers, contractors, vendors, etc.) about keeping patient, employment, and sensitive business information secure and confidential. Have everyone sign confidentiality agreements. You must be willing to evenly enforce your policies. Terminating a long-term employee when they break your rules may seem harsh, but necessary if you want to avoid corporate theft, compliance violations, and wrongful termination lawsuits if you fire someone after letting another person get away with a policy violation.

We have worked with clients whose current and workforce members used cloud-sharing services, like DropBox, Google Drive, and Microsoft OneDrive. By the time we discovered that these tools were installed on their network, many times it was too late. Data was already out the door, and no one knew what was taken. Implement Data Loss Prevention (DLP) security software that will automatically block critical data from being transferred to e-mail, cloud services, or portable thumb drives. Those that need to move data can be exempt from blocking, but you should protect your organization against everyone else.

People get hurt by data theft and violating regulations. Protect yourself, your patients, and your organization.

Are You Investing Enough in IT Security?

Posted on July 20, 2018 I Written By

Mike Semel is a noted thought leader, speaker, blogger, and best-selling author of HOW TO AVOID HIPAA HEADACHES . He is the President and Chief Security Officer of Semel Consulting, focused on HIPAA and other compliance requirements; cyber security; and Business Continuity planning. Mike is a Certified Business Continuity Professional through the Disaster Recovery Institute, a Certified HIPAA Professional, Certified Security Compliance Specialist, and Certified Health IT Specialist. He has owned or managed technology companies for over 30 years; served as Chief Information Officer (CIO) for a hospital and a K-12 school district; and managed operations at an online backup company.

Would you put a $ 10 fence around a $ 100 horse?

Does it make sense to put a $ 100 fence around a $ 10 horse?

For the right security, you need to know what your horse is worth.

The same concepts apply to protecting your data. What is your data worth?

Ask Cottage Health , which had two data breaches, totaling 55,000 records., and settled a $ 4.1 million lawsuit with patients, then paid a $ 2 million California penalty. They were sued by their insurer, which wanted the $ 4.1 million settlement money back, after it discovered Cottage Health had not consistently implemented the security controls it claimed on its insurance application. The $ 6.1 million in the settlement and penalty does not include its costs for legal fees, credit monitoring, notifying patients, public relations, or recovering the business lost from patients who moved to another provider.

One of our clients was audited for HIPAA compliance by the venture capital firm that wanted to invest in their company. Another client had us do a compliance assessment on a healthcare company they wanted to purchase. In both cases, HIPAA compliance was worth millions of dollars.

We asked a client how much the financial impact would be on their business if they lost the sensitive personal data they collected about business partners, and had to notify everyone. The owner said they would be out of business, costing millions of dollars.

Breaches result in lawsuits, with settlements in the millions. If you are a licensed or certified professional, you can lose your license or certification if you are breached.

Federal HIPAA penalties in 2014 – 2015 were $ 14 million. In 2016 – 2017 they tripled to $ 42 million. In 2018, they have already reached $ 7.9 million.

Data is worth more than gold.

Instead of words and images in a computer, think of your data as a pile of gold bars that is worth protecting.

When we work with our clients, we help you identify the types of data you have, where it is located, and how it is protected. We recently worked with a client that came to us for help protecting their patient information. They were shocked when we showed them that they had bigger risks related to the data they stored about workforce members, and job applicants they did not hire, than the people they served.

  • What data do you have that is regulated, that you must protect to comply with laws and other regulations?
  • What fines and lawsuit judgments might you face if your data is breached?
  • Beyond HIPAA that protects patient information, do you know your state data breach laws that apply to employee data?
  • Do you know the regulations that protect credit card data?
  • Do you have enough of the right type of insurance to protect your finances if you are breached?

Everyone has unregulated data that is sensitive or proprietary, that could hurt your business if it is lost, stolen, or accessed by a competitor or someone who wants to hurt you? Salaries, trade secrets, employment records, pricing models, merger and acquisition plans, lawsuit files, have all been stolen.

As part of our assessments, we search the Dark Web (the criminal side of the Internet) to see if our clients have employee passwords for sale by hackers. Over 90% have had at least one employee’s credentials stolen and offered for sale.

Most of our clients start out not knowing the value of their risks. They hadn’t approved IT security purchases, because the costs were high, and they didn’t know if security was worth the investment.

So, how much should you invest in protecting your data?

The recently-released 2018 Cost of a Data Breach report shows, through research of actual breaches, that in 2017 the average cost to a breached organization for a single lost healthcare record was $408. Across all industries the cost was $ 233 per record. Only a third of the cost was for the direct response to the breach – notifying patients, hiring lawyers and IT security experts, and paying for credit monitoring. Two-thirds of the $ 408/record was the financial effect on the healthcare organizations, by losing patients after violating their trust.

Here is a calculation you can use to estimate the value of protecting your patient data.

Number of Patient Records x $ 408 (cost per record of a breach) = $ ________________ in risk.

Example: 25,000 records x $ 408 = $ 10.2 million. (If this number startles you, imagine if your costs were only 25% of the total, which is still $ 2.5 million.)

Other ways to put a dollar value on your risk

  • How much would a breach affect the market value of your business?
  • How much investment capital do you need for expansion?
  • Personally, what will your retirement look like if you had to pay $ 1 million, $ 2 million, or more, to cover the costs of a breach?
  • What would your life be like if you went out of business?

Know the value of your cyber security risk. Do the math.

Ask your IT department, or an outsourced independent IT security consultant, to assess your risks, and recommend what you need to be fully protected. Our assessments calculate your risks based on dollars, and provide ‘under the skin’ data about the current status of your security. Don’t settle for guesses.

Base your security investment on the value of your risks, not just the general idea that your data needs to be protected.

And, if you own a $ 100 horse, upgrade your $ 10 fence.

Exec Tells Congress That New Health Data Threats Are Emerging

Posted on June 20, 2018 I Written By

Anne Zieger is a healthcare journalist who has written about the industry for 30 years. Her work has appeared in all of the leading healthcare industry publications, and she's served as editor in chief of several healthcare B2B sites.

A senior security executive with a major academic health system has told Congress that in addition to attacks by random attackers, healthcare organizations are facing new threats which are changing the health security landscape.

Erik Decker, chief security and privacy officer with the University of Chicago Medicine, testified on behalf of the Association for Executives in Healthcare Information Security in mid-June. He made his comments in support of the reauthorization of the Pandemic and All-Hazards Preparedness Act, whose purpose is to improve the U.S. public health and medical preparedness for emergencies.

In his testimony, Decker laid out how the nature of provider and public health preparedness has changed as digital health technology has become the backbone of the industry.

He described how healthcare information use has evolved, explaining to legislators how the digitization of healthcare has created a “hyper-connected” environment in which systems such as EHRs, revenue cycle platforms, imaging and ERP software are linked to specialty applications, the cloud and connected medical devices.

He also told them about the increasing need for healthcare organizations to share data smoothly, and the impact this has had on the healthcare data infrastructure. “There is increasing reliance on these data being available, and confidential, to support these nuanced clinical workflows,” he said. “With the adoption of this technology, the technical ecosystem has exploded in complexity.”

While the emergence of these complex digital health offers many advantages, it has led to a growth in the number and type of cybersecurity problems providers face, Decker noted. New threats he identified include:

* The development of underground markets and exchanges of sensitive information and services such as Hacking-as-a Service
* The emergence of sophisticated hacking groups deploying ransomware
* New cyberattacks by terrorist organizations
* Efforts by nation states to steal intellectual property to create national economic advantages

This led to the key point of his testimony: “We can no longer think of preparedness relative only to natural disasters or pandemics,” Decker said. “It’s imperative that we acknowledge the criticality of cybersecurity threats levied against the nation’s healthcare system.”

To address such problems, Decker suggests, healthcare organizations will need help from the federal government. For example, he pointed out, HHS efforts made a big difference when it jumped in quickly and worked closely with healthcare leaders responding to WannaCry attacks in mid-2017.

Meanwhile, to encourage the healthcare industry to adopt strong cybersecurity practices, it’s important to offer providers some incentives, including a financial subsidy or safe harbors from enforcement actions, he argued.

Health IT Leaders Fear Insider Security Threats More Than Cyberattacks

Posted on June 8, 2018 I Written By

Anne Zieger is a healthcare journalist who has written about the industry for 30 years. Her work has appeared in all of the leading healthcare industry publications, and she's served as editor in chief of several healthcare B2B sites.

A recently-published survey suggests that while most health IT security leaders feel confident they can handle external attacks, they worry about insider threats.

Cybersecurity vendor Imperva spoke with 102 health IT professionals at the recent HIMSS show to find out what their most pressing security concerns were and how prepared they were to address them.

The survey found that 73% of organizations had a senior information security leader such as a CISO in place. Another 14% were hoping to hire one within the next 12 months. Only 14% said they didn’t have a senior infosec pro in place and weren’t looking to hire.

Given how many organizations have or plan to have a security professional in place, it’s not surprising to read that 93% of respondents were either “very concerned” or “concerned” about a cyberattack affecting their organization. The type of cyberattacks that concerned them most included ransomware (32%), insider threats (25%), comprised applications (19%) and DDoS attacks (13%). (Eleven percent of responses fell into the “other” category.)

Despite their concerns, however, the tech pros felt they were prepared for most of these threats, with 52% that they were “very confident” or had “above average” confidence they could handle any attack, along with 32% stating that their defenses were “adequate.”  Just 9% said that their cybersecurity approach needed work, followed by 6% reporting that their defenses needed to be rebuilt.

Thirty-eight percent of the health IT pros said they’d been hit with a cyberattack during the past year, with another 4% reporting having been attacked more than a year ago.

Given the prevalence of cyberthreats, three-quarters of respondents said they had a cybersecurity incident response plan in place, with another 12% saying they planned to develop one during the next 12 months. Only 14% didn’t have a plan nor was creating one on their radar.

When it came to external threats, on the other hand, respondents seemed to be warier and less prepared. They were most worried about careless users (51%), compromised users (25%) and malicious users (24%).

Their concerns seem to be compounded by a sense that insider threats can be hard to detect. Catching insiders was difficult for a number of reasons, including having a large number of employees, contractors and business partners with access to their network (24%), more company assets on the network or in the cloud than previously (24%), lack of staff to analyze permissions data on employee access (25%) and a lack of tools to monitor insider activities (27%).

The respondents said the most time-consuming tasks involved in investigating/responding to insider threats included collecting information from diverse security tools (32%), followed by tuning security tools (26%), forensics or incident analysis (24%) and managing too many security alerts (17%).