| A PHI breach is the unauthorized access, use or disclosure of protected health information (PHI) from an electronic health record (EHR). Attacks on health records are often carried out to get information that can be used to conduct Medicare or insurance fraud. Other demonstrated motives for PHI breaches include cyber-extortion, theft of intellectual property and identity theft. As of this writing, medical information is one of the most valuable types of data hackers can get their hands on, according to a report by the Institute for Health Technology Transformation (IHT2). While credit card information can sell for $1 on the black market and personally identifiable information can sell for $10 to $20, patient records can go for $20 to $50 each and a complete patient record - including the patient's driver's license, health insurance information and other sensitive data - can be worth more than $500. That means that if a healthcare organization has a security breach and 1,000 complete patient records are stolen, those records could fetch the hacker half a million dollars. While a bank account could simply be closed in the event of a breach, the information in a healthcare record is intended to follow the patient throughout his or her lifetime and that persistence is what creates value. In the United States, personal health information is protected by the HITECH Act and the Health Insurance Portability and Accountability Act (HIPAA). In 2016, the number of major PHI breaches reported to the United States federal government involved the health data of 15.1 million people, a sharp rise from 2015, when 11.3 million people were affected by reported breaches. In what was probably the most notorious ransomware strike in recent years, cybercriminals shut down the data system of Hollywood Presbyterian Medical Center in Los Angeles in February 2018. The 434-bed hospital was forced to use paper records for two to three days, and ultimately paid $17,000 ransom in the bitcoin digital currency to unlock its network. Healthcare providers, payers and other organizations that handle PHI have started to spend more on cybersecurity and deploy increasingly sophisticated technologies including multifactor authentication, advanced perimeter monitoring, vulnerability testing and identity monitoring. Hospitals, health systems and physician practices have also begun training employees about ransomware and other threats, and have been implementing more comprehensive policies to determine who can access PHI. According to the Institute for Health Technology Transformation, healthcare providers can help prevent or mitigate the negative consequences of an attack on personal healthcare information by: - Moving security controls as close to where data is created as possible.
- Following the principle of least privilege.
- Making security awareness training a priority.
- Tracking where the data is stored.
- Using full disk and file-level encryption.
| 
Posts
No comments:
Post a Comment