Application Security // Database Security
3/7/2012
08:35 PM
Connect Directly
RSS
E-Mail
50%
50%

Healthcare Security Pros Need To Speak The Language Of Finance

Experts say PHI protectors can't pay for data protection because they don't know how to make the business case for it

As the number of healthcare data breaches continues to snowball, executives put in charge of safeguarding protected health information (PHI) can't keep up with the risks inherent with increased deployment of electronic health records (EHR) without enough financial backing to get the job done. And the only way these PHI protectors can squeeze that juice from the C-suite is if they make themselves fluent in the language of financial justification, say authors of a new report out this week on healthcare IT security.

A collaboration between the American National Standards Institute (ANSI), via its Identity Theft Prevention and Identity Management Standards Panel (IDSP), in partnership with The Santa Fe Group/Shared Assessments Program Healthcare Working Group and the Internet Security Alliance (ISA), the free report took input from 100 healthcare leaders from 70 organizations. It was the culmination of a yearlong initiative called the PHI Project.

According to Rick Kam, president and co-founder of ID Experts and chair of the PHI Project, the team hopes to establish the document as the go-to resource for security and privacy officers taking a disciplined approach at assessing and mitigating risk of healthcare data breaches. He says the state of the industry is such that those in charge of securing PHI are crying out for guidance.

"Because of the move toward electronic health records and the number of stakeholders that are now involved in handling our sensitive patient information, the PHI protectors are literally being outpaced in terms of their ability to protect our information," Kam says. "The magnitude and the frequency of healthcare breaches has increased rapidly because of the number of stakeholders and the move to electronic health records. These individuals need help."

One of the biggest ways they need help is in simply how to package PHI security issues in a way that makes sense to CEOs and CFOs. Kam and his co-authors found that these healthcare security initiatives are drastically underfunded -- and one of the main reasons is no one knows how to make a case for the cash.

"They basically put the CFO and the CEO to sleep because they're talking compliance, talking costs, and talking about things that are not that interesting to these executives," Kam says. "What we realized is we have to arm that chief privacy officer with the same tools and business case that speaks in investment language to help them enhance their business cases for things that would enhance privacy and security of protected health information."

One of the things Kam and his cohorts attempted to do was offer PHI protectors a way to better quantify the financial impact of healthcare breaches. From that point, these security and privacy professionals could better apply formulas frequently used in the insurance industry to give CEOs and CFOs a more solid way of measuring ROI on dollars spent on IT security and compliance.

"That's how you assess a risk: take the cost of a breach and then turn that into an investment decision on how much you want to spend to transfer that risk or invest in other initiatives that would reduce the probability of a breach occurring," he says, explaining that the document details the process in what he and his co-authors called the PHIve or PHI Value Estimator.

Trailing only the financial industry in the number and severity of data breaches, the healthcare industry during the past several years has been plagued with the problem of information thieves raiding organizational databases. According to a survey out last month by the Ponemon Institute, 91 percent of small healthcare organizations have suffered at least one data breach in the past year. The Ponemon study backed up Kam’s assertion, with three-quarters of respondents reporting that their organizations lacked enough funding to prevent those types of breaches.

Many within the healthcare and security industries believe the new document will prove good guidance -- if those within healthcare organizations are willing to listen.

"This is a reasoned document for reasonable people. I give it very high marks," says Rick Dakin, CEO of security consultancy Coalfire. "So if someone was inclined to become informed and take reasonable action, the ANSI document is the document for them. It will drive considered, justified analysis into decision-making and action."

On the flip side, though, Dakin believes there are those who just aren't that reasonable. As an analogy, he likens the group to those who pick up jewelry for Christmas and find a bag of silica in the box to protect the contents from moisture.

"So you get a reasonably informed consumer, reasonable intellect, getting fairly nice jewelry, and yet they still have to stamp 'Do Not Eat' on the silica bag," Dakin says. "The vast majority of healthcare IT still needs the silica bag with the ‘Do Not Eat’ label stamped on it."

As an example, Dakin mentions hearing from the speakers' podium at the HIMSS healthcare IT conference last month a supposed technology expert claiming that they didn't need to worry about security because their organization relied on Apple products and that was good enough protection.

"You could have heard my jaw hit my computer when I heard that answer come across the microphone," he says. "I’m good because I use Apple.' You could almost put a sign up that says 'Anonymous, please hack me here.'"

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
1990robert
50%
50%
1990robert,
User Rank: Apprentice
3/9/2012 | 7:36:55 PM
re: Healthcare Security Pros Need To Speak The Language Of Finance
An organizations Security and Privacy investment will always be tied to what's the risk?- Will it affect patient care? Will it affect my reputation?- Will it affect revenue? -Will it cost me later, through business disruption or increased liability costs? If so management will listen.--There has to be a clear connection to how the investment will reduce risk to the business.
Sabrina
50%
50%
Sabrina,
User Rank: Apprentice
3/8/2012 | 7:31:26 AM
re: Healthcare Security Pros Need To Speak The Language Of Finance
Lets see what the result of the new document is going to be.-
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0174
Published: 2014-07-11
Cumin (aka MRG Management Console), as used in Red Hat Enterprise MRG 2.5, does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.

CVE-2014-3485
Published: 2014-07-11
The REST API in the ovirt-engine in oVirt, as used in Red Hat Enterprise Virtualization (rhevm) 3.4, allows remote authenticated users to read arbitrary files and have other unspecified impact via unknown vectors, related to an XML External Entity (XXE) issue.

CVE-2014-3499
Published: 2014-07-11
Docker 1.0.0 uses world-readable and world-writable permissions on the management socket, which allows local users to gain privileges via unspecified vectors.

CVE-2014-3503
Published: 2014-07-11
Apache Syncope 1.1.x before 1.1.8 uses weak random values to generate passwords, which makes it easier for remote attackers to guess the password via a brute force attack.

CVE-2014-3991
Published: 2014-07-11
Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.5.3 allow remote attackers to inject arbitrary web script or HTML via the (1) dol_use_jmobile, (2) dol_optimize_smallscreen, (3) dol_no_mouse_hover, (4) dol_hide_topmenu, (5) dol_hide_leftmenu, (6) mainmenu, or (7) leftmenu pa...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Marilyn Cohodas and her guests look at the evolving nature of the relationship between CIO and CSO.