Attacks/Breaches

7/13/2017
10:30 AM
Reza Chapman
Reza Chapman
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

How Security Pros Can Help Protect Patients from Medical Data Theft

The healthcare industry has been slow to address the dangers of hacking, and breaches are on the rise. Security pros must be more proactive in keeping people safe.

John Schoew, Managing Director, North America Health & Public Service Security Lead for Accenture, contributed to this article. 

Imagine discovering that a local hospital's IT system has been hacked and the hackers are threatening to publish patients' names, addresses, and medical records on the Internet. In September 2016, this happened to 6,000 patients in Oklahoma.

As security professionals know, this is just one example of many when it comes to medical data theft. New research from Accenture finds that a startling 26% of U.S. consumers have experienced a healthcare data breach, and 50% of these people subsequently have been victims of medical identity theft.

Most consumers are aware of the risks of online transactions, but far fewer are aware of how susceptible they are to medical identity theft — and the damage it could cause — leaving room for security professionals to help promote stronger anti-theft measures, and allowing hospitals to better manage breaches when and before they occur.

Identity Crisis
Medical data is made up of test results and diagnoses, but it also includes Social Security numbers, dates of birth, contact information, and driver's license numbers. Together, this information creates an online identity. Security professionals are aware of what a hacker could or might do with this level of detail. Mixing identities by selling personal information or falsely obtaining healthcare could lead to dangerously muddled patient records. Hackers might threaten to "dump the data on the Internet" unless the organization pays a ransom, as in the Oklahoma case, or block the organization from accessing this vital information altogether.

Other industries are stepping up their games in terms of data security, so hackers coveting personal data have had to look elsewhere. And, with most health information held electronically and dating back years, the medical sector is a sitting duck. In 2016, there were 377 data breaches in the healthcare/medical industry — 34.5% of all data attacks. In 2017, there had already been 144 breaches by the middle of February. It appears that this trend is accelerating.

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada, July 22-27, 2017. Click for information on the conference schedule and to register.

A logical question is likely to be, "Where are these breaches happening and how can they be prevented?" According to Accenture's research, breaches were most likely to occur in hospitals, followed by urgent-care clinics, pharmacies, physicians' offices, and health insurers. Often, organizations are late to detecting a problem: half of U.S. consumers who experienced a breach discovered it themselves through an error on their credit card statement or benefits explanation. Only a third were alerted to the breach by the organization where it occurred, and just 15% were alerted by a government agency. Security professionals, aware of the potential opportunities for healthcare information breach, are capable of helping hospital systems, and the industry overall, strengthen defenses to help ensure that consumer data is safe.

What Security Pros Can Do
Healthcare organizations have an obligation — and an inherent interest — to protect medical and financial data in their care. When security practices fall short, resulting in a breach and subsequent data theft, Accenture research indicates that many affected consumers will take action. Affected respondents either changed healthcare providers (25%) or insurance plans (21%), or sought legal counsel (19%). Based on recent trends and incidents, the role of security professionals will only become more important in making the protection a reality.

Many consumers understand firsthand the impact that a breach can have on their finances and potentially their health. The average out-of-pocket cost for victims of medical identity theft is $2,500 per incident — and, unlike the subjects of credit card breaches, victims of medical identity theft often have no automatic right to recover their losses. Interestingly, Accenture’s survey finds that retention rates remain high, despite a breach, when healthcare organizations proactively communicate with consumers. For security professionals, this reiterates the importance of preparing in advance to manage a potential attack so that quick action can be taken to help assuage potential consumer fears during or after an incident.

It's time for providers to take data theft more seriously, and for security professionals to recognize an opportunity to build greater trust between patients and healthcare entities. To begin, here are a few simple reminders of measures security professionals can continue reinforcing to help protect consumer data:

  • Urge consumers to monitor medical records and read all statements. If patient records are inaccurate, their data might have been combined with someone else's. Urge patients to pay close attention to records and statements from providers, and to ask them for a summary at least once a year.
  • Remind consumers to check their credit report. Any discrepancies on credit reports could mean that consumers' medical data has been compromised.
  • Discourage oversharing. Consumers should only give out the minimum personal information required — healthcare providers do not need a patient's Social Security number, for example. They should also be alert to phony communications: following the 2015 Anthem breach, victims reported receiving phishing phone calls and emails.
  • Raise the alarm — promptly. If consumers discover anything unusual, they should be encouraged to immediately let providers or insurers know, and should have access to user-friendly channels through which to do so.

Related Content:

Reza Chapman is responsible for developing and driving Accenture's security offerings for providers, health insurers, and business associates. A seasoned executive, Reza brings over two decades of experience advising the information security leaders of Fortune Global 500 ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
New Free Tool Scans for Chrome Extension Safety
Dark Reading Staff 2/21/2019
Making the Case for a Cybersecurity Moon Shot
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  2/19/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-9015
PUBLISHED: 2019-02-22
A Path Traversal vulnerability was discovered in MOPCMS through 2018-11-30, leading to deletion of unexpected critical files. The exploitation point is in the "column management" function. The path added to the column is not verified. When a column is deleted by an attacker, the correspond...
CVE-2019-9016
PUBLISHED: 2019-02-22
An XSS vulnerability was discovered in MOPCMS through 2018-11-30. There is persistent XSS that allows remote attackers to inject arbitrary web script or HTML via the form[name] parameter in a mod=column request, as demonstrated by the /mopcms/X0AZgf(index).php?mod=column&ac=list&menuid=28&am...
CVE-2018-20784
PUBLISHED: 2019-02-22
In the Linux kernel before 4.20.2, kernel/sched/fair.c mishandles leaf cfs_rq's, which allows attackers to cause a denial of service (infinite loop in update_blocked_averages) or possibly have unspecified other impact by inducing a high load.
CVE-2019-9003
PUBLISHED: 2019-02-22
In the Linux kernel before 4.20.5, attackers can trigger a drivers/char/ipmi/ipmi_msghandler.c use-after-free and OOPS by arranging for certain simultaneous execution of the code, as demonstrated by a "service ipmievd restart" loop.
CVE-2019-9004
PUBLISHED: 2019-02-22
In Eclipse Wakaama (formerly liblwm2m) 1.0, core/er-coap-13/er-coap-13.c in lwm2mserver in the LWM2M server mishandles invalid options, leading to a memory leak. Processing of a single crafted packet leads to leaking (wasting) 24 bytes of memory. This can lead to termination of the LWM2M server afte...