Risk
2/10/2014
09:05 AM
Kate Borten
Kate Borten
Commentary
Connect Directly
RSS
E-Mail
100%
0%

Healthcare Information Security: Still No Respect

More than a decade after publication of HIPAA's security rule, healthcare information security officers still struggle to be heard.

When I first was introduced to the infosec subculture in the1990s, there seemed to be very few of us in healthcare provider organizations with official security roles. And we were mostly "stuckees" who just fell into the job. (You know, someone in charge pointed at you and said, “You’re now our security person.”) 

You’d think patient privacy, and, thus, security, would be embraced, but it wasn’t so. Doctors and nurses swore they already were privacy sensitive. And, after all, we weren’t banks holding money to be stolen… Who’d want to steal our databases with a few million boring medical records? 

Photo credit:  Flickr
Photo credit: Flickr

We struggled to be heard in our organizations, to implement policies and strengthen passwords. But we were often thwarted and viewed as obstacles, if not threats, to patient care. Where else would you be told that patients might die because you made doctors memorize their own secret, six-character passwords? Or were made to feel audacious asking for staff while nurses were being laid off?

My own IT co-workers openly shared their passwords and laughed at my raised eyebrows. (OK, so I was an easy target with my earnestness and zeal, but still…) When the system administrator of our token authentication server left for another job, he handed in his token with his PIN taped to the back. He didn’t even try to hide the fact that he’d completely undermined the token’s purpose. 

My healthcare infosec colleagues and I did have a smattering of support from sincere leaders who got it. These champions understood the risks and the value of an infosec program to mitigate them, at least theoretically. One of my favorite doctors reported chiding medical residents for failure to log off their exposed hallway computers before walking away, and he routinely logged off any open computer he found. But when it came down to requiring managers to take time to review lists of users, for example, or, most challenging of all, enforcing security policies across the organization, support withered.

We stuckees consoled each other at healthcare security and privacy conferences. We attended sessions where we shared ideas for getting leadership buy-in and for running an infosec program on a tiny budget. But, to rephrase Rodney Dangerfield’s famous line, we lamented, "We don’t get no respect."

So what’s changed in healthcare security since the 90s? HIPAA’s security rule has definitely heightened awareness, and the word "security" pops up a lot more now. Healthcare organizations and their business associates have security policies, they talk about security at workforce training sessions, and they have designated security officials -- all required by HIPAA.

But here we are, more than 10 years after the security rule’s publication, and not nearly enough has changed. Yes, some organizations have recognized that this isn’t simply about regulatory compliance; it’s a business risk issue. And to do the job right, there needs to be a formal infosec program with a visible structure, real security expertise, and support at the top.  

Where are the CISOs?
From what I see, security savvy organizations are in the minority. Too many organizations’ infosec programs are still very immature. The glaring signs are: 1) lack of internal security expertise; and 2) insufficient resources to carry out security functions.

HIPAA requires healthcare organizations and their business associates to designate an information security official or ISO. But time and again I see the ISO is either a maxxed-out CIO with no security background or experience, or else a network administrator stuckee who may have some notion of network security, but no training, and little time for this extra responsibility. 

It continues to be unusual to see a full-time ISO with security credentials, much less staff, in other than the largest healthcare networks. Yet even in smaller organizations, reasonable security programs are by definition complex, require awareness of good security practices, and require people to implement and monitor security processes. Never mind the question of regulatory compliance. It’s just not possible to have such a program without expertise and resources.

Even mature infosec programs can’t eliminate all risk. But too many breaches today -- not only in healthcare but in other sectors -- aren’t due to zero-day attacks exploiting previously undiscovered vulnerabilities. They are avoidable events that are frequently tied to lack of security expertise and resources to implement security controls.

In healthcare, and elsewhere, lost and stolen laptops, hard drives, USB drives, and the like with unencrypted patient information are the biggest sources of breaches. To be sure, with today’s wide use of a variety of tablets and smartphones, mitigation strategies such as encrypting all end-user devices and media can be challenging financially and technologically. But slapdash security will keep us in a breach-a-week muddle.

We need to appoint ISOs with security knowledge and experience, and then give them enough clout and staff to accomplish the processes required by HIPAA and good practice. It’s time for senior leaders to finally recognize the essential business value of infosec and provide the necessary resources to make it happen. We need  R-E-S-P-E-C-T!  

Kate Borten, CISSP, CISM, provides her clients with expertise in security, privacy, and health IT from over 20 years inside the healthcare industry. In the 1990s she led the enterprise-wide security program at Massachusetts General Hospital, and as Chief Information Security ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Page 1 / 2   >   >>
RobPreston
50%
50%
RobPreston,
User Rank: Apprentice
2/10/2014 | 9:16:39 AM
R-E-S-P-E-C-T
I'm sure there's new found respect for information security in the retail industry -- at least I hope there is -- following the recent high-profile breaches at Target and other outlets. Will it take a major breach at a major private sector healthcare provider to wake up that indusry?
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
2/10/2014 | 9:42:39 AM
Re: R-E-S-P-E-C-T
I'm taking a wait-and-see position on whether the recent data breaches at Target etc will trigger an ephiphany in the retail industry. My guess is that security officers in that industry don't get any respect either. And that's with PCI-DSS regs to contend with.

In terms of healthcare, it's a sad commentary that 10 years after HIPAA, hospitals and other organizations talk the talk, but still don't walk the walk. What will it take for business leaders to empower security officers in the post ACA-era? I wish I knew. It certainly seems like it should be an urgent prioritiy to me. 
Drew Conry-Murray
50%
50%
Drew Conry-Murray,
User Rank: Ninja
2/10/2014 | 9:44:50 AM
Re: R-E-S-P-E-C-T
If healthcare is anything like retail, it's going to take a dozen high-profile breaches and significant financial losses for security to be taken seriously.
David F. Carr
50%
50%
David F. Carr,
User Rank: Apprentice
2/10/2014 | 11:13:44 AM
Exceptions to the rule?
Kate,

Frightening that you see this as such a strong pattern, despite all we hear about HIPAA.

You must have seen some exceptions, right? What organization would you hold up as the positive example to follow?

 

 
Laurianne
50%
50%
Laurianne,
User Rank: Apprentice
2/10/2014 | 2:37:52 PM
Funding or structure?
This paints quite a different picture than what I have heard from top hospital CIOs, who say things like "It is part of my job to keep us out of the newspaper." Those CIOs speak of a crushing regulatory burden right now. How are the smaller healthcare organizations keeping up with it, if the lack of expertise is this extreme?
zcobb
50%
50%
zcobb,
User Rank: Apprentice
2/10/2014 | 3:25:56 PM
Breaching misperceptions
Thank you so much for this article. Sheds light on a serious problem. Not enough organizations realize any PII is fair game for cyber crooks, the fact that it might be PHI doesn't enter the equation for many of them. And this is so true: "But too many breaches today -- not only in healthcare but in other sectors -- aren’t due to zero-day attacks exploiting previously undiscovered vulnerabilities. They are avoidable events that are frequently tied to lack of security expertise and resources to implement security controls." Agreed! Stephen Cobb, CISSP
WKash
50%
50%
WKash,
User Rank: Apprentice
2/10/2014 | 6:07:22 PM
50 Reasons Why We Need Better EHR Security
Depending on what report you read, a stolen medical ID number and record currently sells on the black market for $50 (and as much as $100), whereas a stolen credit card number is only worth $1.  The reason: In gaining access to a person's health records, a hacker has – in one fell swoop – acquired almost full reign of a person's identity, and the opportunity for prolonged fraud against the medical establishment. Yet it's clear the medical community is no where close to having the security controls of say, the banking industry, or the federal government.
Kate Borten
50%
50%
Kate Borten,
User Rank: Apprentice
2/11/2014 | 3:17:48 PM
Re: Funding or structure?
It's not inconsistent for CIOs to say their job is to keep the organization out of the papers (and really mean it), and yet not have good infosec programs in place.  They often don't know what a strong program looks like.  This is a big problem since, in my experience, many organizations of all sizes - but especially small - are not compliant.  They don't know what they don't know.  I'm sympathetic to the regulatory burden in healthcare, but good security is good business.  I think the real issue comes down to money.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
2/13/2014 | 3:00:23 PM
Re: Funding or structure?
"People don't know what they don't know." 

Kate, I really think that is true on so many levels. On the medical side, I think doctors' training is to diagnose a condition through medical tests. In many cases, rule out things to discover what a patient doesn't have. Figuring out what you don't know is much much harder... That's true in medicine, InfoSec and most everything we do in life!
Gary Scott
50%
50%
Gary Scott,
User Rank: Apprentice
2/13/2014 | 6:01:55 PM
EPHI Data Breach - One lost laptop or 10,000 recycled computers?
The biggest source of data breaches is not the one or two stolen laptops we hear about in the news but, the 100,000's of PCs and loose hard drives that organizations donate or send out for recycling. 

Small healthcare organizations continue to rely on electronic recycling companies to destroy hard drives and other digital media which may contain 1 million EPHI records each.  These unvetted recycling companies are allowed full access to EPHI - computer hard drives - from the time they leave the healthcare organization until the drives are finally destroyed.  

Organizations should insist that electronic recyclers physically shred hard drives (EPHI) prior to leaving the organizations custody.
Page 1 / 2   >   >>
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Must Reads - September 25, 2014
Dark Reading's new Must Reads is a compendium of our best recent coverage of identity and access management. Learn about access control in the age of HTML5, how to improve authentication, why Active Directory is dead, and more.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-5485
Published: 2014-09-30
registerConfiglet.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via unspecified vectors, related to the admin interface.

CVE-2012-5486
Published: 2014-09-30
ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character.

CVE-2012-5487
Published: 2014-09-30
The sandbox whitelisting function (allowmodule.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain privileges to bypass the Python sandbox restriction and execute arbitrary Python code via vectors related to importing.

CVE-2012-5488
Published: 2014-09-30
python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via a crafted URL, related to createObject.

CVE-2012-5489
Published: 2014-09-30
The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote authenticated users to gain access to restricted attributes via unspecified vectors.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
In our next Dark Reading Radio broadcast, we’ll take a close look at some of the latest research and practices in application security.