Security of Protected Health Information
Contents
Introduction
Medical identity theft is one of the fastest growing crimes in the U.S., costing an estimated $30 billion a year and growing [1]. For the healthcare industry in 2020, ransomware attacks were responsible for $20 billion lost in impacted revenue, lawsuits and ransom paid, impacting over 600 hospitals, clinics and other healthcare organizations. [2] More than 1 in 3 health care organization globally reported being hit by ransomware in 2020 [3]
Motivations for cyberattacks
ePHI is extremely valuable: The price of complete record of a single patient can be sold for 100s of dollars on the dark web [4]
Additional motivations can range from local political, foreign state-sponsored and terrorist: attackers may seek to disrupt critical human services as a form of political retaliation [5]
Cyberattack methods
Threat actors can intercept unencrypted or poorly encrypted data on improperly disposed of electronic media (hard drives, floppy disks, optical media) that contain ePHI. Actors can also plant malicious code onto network machines through email or web downloads[6]
Insider threats can be particularly damaging – employees with administrative access can physically destroy hardware, plant malicious code, intentionally corrupt data, crash systems quickly and surreptitiously [7]
Third party vendors, contractors, temporary employees often have access to valuable data, and they can be exploited or extorted by external parties to leak data. Even housekeepers and maintenance workers may be able to access computer stations left unlocked.[1]
Social media can be used to conduct social engineering attacks – attackers may use information from social media pages to impersonate or trick healthcare providers into performing actions beneficial to the hacker.[5]
The COVID pandemic has also heightened vulnerabilities as telemedicine and remote work added more ways into systems, such as through unsecured virtual private networks and compromised home work stations. It has also resulted in the furloughing of network security staff who can prevent and handle threats [8]
Data breach consequences
Information breaches can incur both response and logistic expenses as well as loss of productivity and revenue. Secondary losses can include the effect on healthcare provider's reputation. Hospitals may have to pay large legal defense fines as well as judgments from legal or regulatory actions from the government. [9]
Cyber attacks can also affect patients: Intermingled records for still in medical identity can lead to dangerous medical outcomes by introducing medical inner inaccuracies.[1]
Security and prevention
Frequent password changes may help in the case of security leaks, yet make it more likely that they will need to call IT for password resets or write down their passwords on paper notes. Static challenge questions no longer provide necessary safeguards and should be switched to multi-factor authentication [1]
A policy that allows providers to “bring your own device” can increase productivity and decrease costs yet create more work due to lack of uniformity [5].
Physical safeguards should also be considered: locked doors, property controls (tags, engraving on equipment), personal controls (ID badges, visitor badges), private security [10]
Hospitals should use carefully audited maintenance log to track equipment and facility repairs that affect physical security [1]. Human resources should screen new employees for potential liabilities, using criminal records, credit check, drug test, and a search for aliases [1]
Notable cyberattacks
- The REvil hacker group performed a ransomware attack on the University Medical Center of Southern Nevada in which patient data was stolen.[11].
References
- ↑ 1.0 1.1 1.2 1.3 1.4 1.5 Phelan, J. (2012). Creating a Trusted Environment: Reducing the Threat of Medical Identity Theft. Healthcare Information and Management System Society, 29. Retrieved from https://risk.lexisnexis.com/cross-industry-fraud-files/docs/healthcare/Creating-Trusted-Environment-Reducing-Threat-Medical-Identify-Theft.pdf
- ↑ https://illinois.touro.edu/news/the-10-biggest-ransomware-attacks-of-2021.php
- ↑ Weiner, S. (2021, July 20). The growing threat of ransomware attacks on hospitals. AAMC.
- ↑ Forensic Readiness. Journal of Medical Systems, 43(1). https://doi.org/10.1007/s10916-018-1123-2
- ↑ 5.0 5.1 5.2 Nieles, M., Dempsey, K., & Pillitteri, V. Y. (2017). An introduction to information security. Gaithersburg, MD. https://doi.org/10.6028/NIST.SP.800-12r1
- ↑ Wilshusen, G. C., & Barkakati, N. (2012). Information security: better implementation of controls for mobile devices should be encouraged : report to congressional committees. Retrieved from http://purl.fdlp.gov/GPO/gpo33062
- ↑ Engineering Institute, S. (2008). Introduction to Information Security. Retrieved from www.isc.org/index.pl
- ↑ Weiner, S. (2021, July 20). The growing threat of ransomware attacks on hospitals. AAMC.
- ↑ Hutton, A., & Jones, J. (2013). Risk Taxonomy (O-RT), Version 2.0.
- ↑ CMS. (2007). Security Physical Safeguards. Retrieved from www.cms.hhs.gov/SecurityStandard/
- ↑ McKeon, J. (2021, July 1). Hospital Ransomware Attack in Las Vegas Exposes PII. Health IT Security.
Submitted by Nikhil Kurapati
