RSI Security

Main Causes of Security Breaches in the Healthcare Industry

RSI Security

A little over ten years ago, in 2008, less than half of healthcare organizations used electronic health records (EHRs). Now, thanks to the passage of the Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH), it’s more surprising when an office-based physician does not have EHRs. While the adoption of electronic health records was necessary for American healthcare to keep up with the rest of the world and the rapidly changing technological landscape, it didn’t come without its downsides.

The number of security breaches has been rising steadily since the HITECH Act instituted harsher penalties for noncompliance with EHRs. In 2010, the number of data breaches in the healthcare industry topped that of the last six years combined. Whereas the healthcare industry chalked that up to the rapid adoption of EHRs, it’s clear now that wasn’t the whole story. With the latest data from 2018, we see that the reported incidents have still been increasing.

With the use of electronics and digital technology from smartphones to computers, cloud technology to metadata, the cybersecurity risks have never been higher. To know if your electronic personal health information (e-PHI) is safe and to learn about the top breaches in healthcare security, read on.

 

The Current Cyber Security Landscape

To those who are currently working in healthcare data security, you know it’s a bit like the Wild West. HIPAA, the sheriff, has put out mandates and penalties for noncompliance; what they say is law. HITECH, the judge, enforces HIPAA compliance and puts its own spin on harsher penalties and regulations. Finally, there’s HITRUST, a security framework that acts as hired guns for an operation (discussed at the end of this article).

Now, over in the saloon sits all the possible cybersecurity threats: IT hackers, data thieves, and the clumsy ones who after a long shift make careless mistakes about how they handle private data.

 Also Read: How Long Does it Take to Get HITRUST Certified?

Metaphor stretching a bit? The thing is, people often forget that even in this technological era where newer, better devices are invented by the month, the internet is still in its infantile stage as a technology. In other words, the infrastructure is there, the means of cybersecurity are available, but what threats are bound to come are hard to predict.

Suddenly the open borders and “lawlessness” of the Wild West seem like an apt metaphor, huh?

 

Assess your cybersecurity

 

Grasping the Data Around Cyber Security

Don’t worry, this isn’t going to turn into a McMurtry western novel. Instead, let’s stick to what we understand best: data. When it comes to the cybersecurity landscape, there is data on the:

Starting with these, we can more fully grasp the problems in current data security and how best to combat them.

Also Read: What Are the Different Types of HITRUST Assessments?

 

Number of Reported Breaches

As of this past year in 2018, the number of data breaches (that resulted in 500 or more exposed records) averaged once per day. This is a staggering finding. Just ten years ago, the average was closer to once or twice a month. Here’s some visual data to understand the sheer number of healthcare breaches:

What can easily be extracted from this is how the adoption of EHRs was handled: poorly, to say the least. HITECH was passed in 2009, and it basically told healthcare organizations and their business associates that they must adopt EHRs or face massive fees. So, organizations compiled without considering the risk of data breaches.

However, in the wake of the jump from 2009 to 2010, what happened since then is unclear. To put it bluntly: Why have healthcare organizations not gotten better at security since the adoption of electronic health records? One would imagine that there would be a sharp rise in the years following HITECH, but then slowly decrease as equipment and data security improved.

This clearly is not the case.

 

Number of Exposed Records

The next question to focus on is how many exposed records there are per year. Sure, the number of incidences has increased, but that doesn’t necessarily mean that security hasn’t improved. For some quick numbers:

What’s difficult to ascertain from this data is whether data security is improving each year or not. Some years fare better than others with 2015 stands as a massive outcast in the sheer volume of exposed records.

 

2015 Gone Phishing: Be Back Soon

Prior to 2015, hackers and IT threats were using the bulk of their resources on gaining credit card information. This meant that the retail industry and the financial sector were their biggest targets. Although something clicked, and social security numbers became the hot ticket item. And what holds a tremendous reservoir of social security information? You got it, healthcare.

Their method of attack: phishing.

Phishing is a social engineering method of drawing out personal information, such as usernames, passwords, and even bank account details. Hackers use fake emails from legitimate-sounding email accounts. One simple example of this involves “corn.” Putting together the letters “r” and “n” look similar on small typeface font to the letter “m.”

Thus, phishing scams involved sending emails from “Name@Company.c-o-r-n” to employees and asking them to look at a document. The employee would click on a link, sending them to a fake page requesting for them to log in to their email again. The employee, tired from a long day or currently juggling multiple projects at once, ignores the red flag and enters his or her username and password. Voila, the hackers have an entryway into the network.

 

 

Email Security Gets an Upgrade

These phishing scams weren’t one-time attempts. Despite most phishing scams being avoided, it only took one misstep, one person to accidentally not notice the warning signs. Or in the case of 2015, it only took two.

Both Anthem and Premera Blue Cross were targets of a phishing scam that helped hackers bypass security systems and expose 89.8 million records of the total 113 million exposed that year.

Once security experts realized the significance of phishing, email security got an upgrade.

ALSO READ: How to Boost Your Cyber Security With Email Encryption

 

Causes of Security Breaches

Although in 2015, phishing was the biggest cause of security breaches in healthcare, as this was an unusual year. The five most common causes include:

 

Hacking and IT Incidents

Hacking and IT incidents include everything from phishing to malware infections. The rate of these security breaches in healthcare has risen rapidly since they first started being reported in 2010. To give a cursory glance, here’s the data:

While there’s no speculation on whether the number of incidences has increased, what is subject to deliberation is whether the reported numbers are accurate. The problem is that security systems flawed enough to allow hacking were often not sophisticated enough to know when the hacking incident occurred—thus, many early IT incidents went unreported.

The number of records exposed to hacking and IT incidents in 2018 alone resulted in 9.1M of the total 13M records (roughly 70%).

 

Unauthorized Access and Disclosure

Close behind hacking and IT incidents, unauthorized access and disclosure have similar numbers of reported incidents. Although the amount of exposed records per incident is significantly less. The number of exposed records in 2018 was estimated to about 3M of the total 13M (about 23%).

 

Theft, Loss, and Improper Disposal

The final 7% of exposed records were a result of theft, loss, and the improper disposal of equipment containing personal health information. Examples of these include unencrypted laptops being stolen from vehicles, accessing unencrypted data on public networks, and other errors that can be mitigated by proper security education and enforcement.

Because HITECH outlines proper administrative, physical, and technical controls for the security of data and property that houses data, implementing security frameworks can greatly reduce these incidences. And as a whole, these incidences have been decreasing.

Improper disposal averages around 10 incidents per year (that hasn’t changed). Theft and loss, however, have decreased:

The number of exposed records from theft, loss, and improper disposal combined in 2018 was just over 1M.

 

 

Data Breach by PHI and e-PHI Location

What’s interesting to note is where these data breaches are occurring. Many are quick to point to the usage of smartphones in healthcare as the culprit. But that’s actually misinformed. Overwhelming the locations of PHI and e-PHI data breach occur within:

 

Top 10 Worst Security Breaches in Healthcare History

Now for an understanding of the worst security breaches in healthcare, here are the top ten data fails:

  1. Anthem Inc – 2015 – 78.8M exposed records to a hacking incident
  2. Premera Blue Cross – 2015 – 11M exposed records to a hacking incident
  3. Excellus Health Plan – 2015 – 10M exposed records to a hacking incident
  4. Science Applications Intl Corp – 2011 – 4.9M records were lost
  5. UCLA Health – 2015 – 4.5M exposed records to a hacking incident
  6. Community Health Systems Professional Services Corp – 2014 – 4.5M exposed records to a hacking incident
  7. Advocate Med Group – 2013 – 4M exposed records due to theft
  8. Medical Informatics Engineering – 2015 – 3.9M exposed records to a hacking incident
  9. Banner Health – 2016 – 3.6M exposed records to a hacking incident
  10. Newkirk Products Inc – 2016 – 3.5M exposed records to a hacking incident

It should be noted that none of these are from the last two years, which does indicate that overall, data frameworks and how much can be exposed in a security breach are improving.

 

HIPAA Penalties and Fines

HIPAA, in response to these security breaches, has detailed out four tiers of penalties and fines. Each tier is identified based on willful neglect, and whether or not the effort is put forth to correct issues within the policies.

To avoid these penalties and fees, you need to know how to prevent security breaches in healthcare organizations.

 

How to Prevent Security Breaches in Healthcare

Healthcare organizations and their business associates must be HIPAA compliant within their data security to avoid compliance fees. Organizations are switching to data security frameworks that include HIPAA mandates, such as the one offered by HITRUST. HITRUST community security framework (CSF) offers a certified data security framework that is both secure and HIPAA compliant.

To become HITRUST CSF certified, you can implement the framework with the help of verified HITRUST CSF assessors, like the experts at RSI Security. RSI Security is a full-service security provider that can guarantee HITRUST certification and HIPAA and HITECH compliance.

 

 

Overview of Security Breaches in Healthcare

In this new era of digital communication, electronic health records, and cloud technology, cybersecurity needs to be a pillar of healthcare organizations. Additionally, the business associates of healthcare organizations must now be HIPAA compliant in order to survive audits by the HHS.

To protect sensitive information from hacking, theft, phishing, and other cyber threats, talk to the experts at RSI Security about implementing a data security framework.

 

Speak with a HITRUST expert today!

 

Get A Free Cyber Risk Report

Hackers don’t rest, neither should you. Identify your organization’s cybersecurity weaknesses before hackers do. Upon filling out this brief form you will be contacted by one of our representatives to generate a tailored report.

 

Sources:

Health IT. Office-based Physician Electronic Health Record Adoption. https://dashboard.healthit.gov/quickstats/pages/physician-ehr-adoption-trends.php

HIPAA Journal. Analysis of 2018 Healthcare Data Breaches. https://www.hipaajournal.com/analysis-of-healthcare-data-breaches/

HIPAA Journal. Healthcare Data Breach Statistics. https://www.hipaajournal.com/healthcare-data-breach-statistics/

HIPAA Journal. 2015: The Year of the Healthcare Data Breach. https://www.hipaajournal.com/2015-the-year-of-the-healthcare-data-breach-8239/

HHS. HIPAA for Professionals. https://www.hhs.gov/hipaa/for-professionals/index.html

 

Exit mobile version