Network Security for The Healthcare Industry

Security

The healthcare industry has been and remains one of the most attacked by cyber criminals.

2015 was a particularly bad year. Over 100 million healthcare records were compromised, according to an IBM Cyber Security Intelligence Index, making the industry the most attacked that year. Those records were taken from more than 8,000 devices in 100 countries.

We know cyber criminals are keen to get their hands on protected health information because of its value on the black market.

Whereas a credit card or social security number is worth less than $1 on the black market, electronic medical health records (EHRs) can be worth hundreds or even thousands of dollars. Reason being, an ERH contains more personal data points (date of birth, place of birth, credit card details, social security number, address and emails) and there’s no changing or cancelling it. That information can potentially be used to blackmail individuals for a lifetime. This is why having the right security in place is essential, for people’s personal lives are at risk when their medical history is compromised.

Attacks Increasing in Frequency and Damages

In the last five years, one in thirteen healthcare patients have experienced theft of their personal information. — Accenture

The global cost and size of data breaches in general has been increasing year after year.

A 2018 Cost of Data Breach Study by IBM Security and Ponemon Institute found that the average total cost rose from $3.62 million to $3.86 million, or 6.4%, when compared to its 2017 study. Per record, this was an increase of $141 to $148, or 4.8%.

It also found that the average size of the data breaches increased by 2.2%.

Making the costs even higher for the healthcare industry are HIPAA violation fines, which can be levied against an organization after a breach. This may sound like a bad case of victim blaming, but it’s each organization’s responsibility to enact safeguards to prevent unauthorized parties from accessing information.

What also needs to be considered is continuity of service. When a breach occurs, it can potentially force an organization to cease operation until the matter is resolved. Take the WannaCry ransomware outbreak in 2017, when 16 hospitals in the U.K. were shut down entirely until the threat could be dealt with.

Mitigating Cost

The faster these data breaches are identified and contained, the less damage a company experiences financially.

Companies that identified a breach in less than 100 days saved more than $1 million as compared to those that took more than 100 days, according to the 2018 Cost of Data Breach Study. Similarly, companies that contained a breach in less than 30 days saved over $1 million as compared to those that took more than 30 days.

The most effective means of reducing this exposure time is by having an incident response process in place. Organizations that had an incident response team saved as much as $14 per compromised record, according to the study. And those that used an extension amount of encryption saved an additional $13 per capita.

Securing the Healthcare Network

Deploy security automation

Being high-priority targets, healthcare organizations are obligated to deploy the most advanced security tools to keep their network secure.

Security automation refers to enabling security technologies that augment or replace human intervention in the identification and containment of cyber exploits or breaches. Such technologies depend upon artificial intelligence, machine learning, analytics and orchestration.

Prevent internal threats through encryption

Healthcare data breaches are caused by employee error and misuse more than any other industry.

A whopping 71% of all cybersecurity incidents (regardless of whether data was compromised) in healthcare involve employee actions, and 53% are caused by inadvertent employee actions (e.g. error, physical loss/theft of devices or records, and social attacks/phishing), according to Verizon’s 2018 Data Breach Investigations Report.

It’s, therefore, paramount that protected health information does not leave an organization without the proper encryption and safeguards. Such actions include holding messages for review, encrypting content, applying secure messaging between parties and converting files.