Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

7/13/2017
10:30 AM
Reza Chapman
Reza Chapman
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

How Security Pros Can Help Protect Patients from Medical Data Theft

The healthcare industry has been slow to address the dangers of hacking, and breaches are on the rise. Security pros must be more proactive in keeping people safe.

John Schoew, Managing Director, North America Health & Public Service Security Lead for Accenture, contributed to this article. 

Imagine discovering that a local hospital's IT system has been hacked and the hackers are threatening to publish patients' names, addresses, and medical records on the Internet. In September 2016, this happened to 6,000 patients in Oklahoma.

As security professionals know, this is just one example of many when it comes to medical data theft. New research from Accenture finds that a startling 26% of U.S. consumers have experienced a healthcare data breach, and 50% of these people subsequently have been victims of medical identity theft.

Most consumers are aware of the risks of online transactions, but far fewer are aware of how susceptible they are to medical identity theft — and the damage it could cause — leaving room for security professionals to help promote stronger anti-theft measures, and allowing hospitals to better manage breaches when and before they occur.

Identity Crisis
Medical data is made up of test results and diagnoses, but it also includes Social Security numbers, dates of birth, contact information, and driver's license numbers. Together, this information creates an online identity. Security professionals are aware of what a hacker could or might do with this level of detail. Mixing identities by selling personal information or falsely obtaining healthcare could lead to dangerously muddled patient records. Hackers might threaten to "dump the data on the Internet" unless the organization pays a ransom, as in the Oklahoma case, or block the organization from accessing this vital information altogether.

Other industries are stepping up their games in terms of data security, so hackers coveting personal data have had to look elsewhere. And, with most health information held electronically and dating back years, the medical sector is a sitting duck. In 2016, there were 377 data breaches in the healthcare/medical industry — 34.5% of all data attacks. In 2017, there had already been 144 breaches by the middle of February. It appears that this trend is accelerating.

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada, July 22-27, 2017. Click for information on the conference schedule and to register.

A logical question is likely to be, "Where are these breaches happening and how can they be prevented?" According to Accenture's research, breaches were most likely to occur in hospitals, followed by urgent-care clinics, pharmacies, physicians' offices, and health insurers. Often, organizations are late to detecting a problem: half of U.S. consumers who experienced a breach discovered it themselves through an error on their credit card statement or benefits explanation. Only a third were alerted to the breach by the organization where it occurred, and just 15% were alerted by a government agency. Security professionals, aware of the potential opportunities for healthcare information breach, are capable of helping hospital systems, and the industry overall, strengthen defenses to help ensure that consumer data is safe.

What Security Pros Can Do
Healthcare organizations have an obligation — and an inherent interest — to protect medical and financial data in their care. When security practices fall short, resulting in a breach and subsequent data theft, Accenture research indicates that many affected consumers will take action. Affected respondents either changed healthcare providers (25%) or insurance plans (21%), or sought legal counsel (19%). Based on recent trends and incidents, the role of security professionals will only become more important in making the protection a reality.

Many consumers understand firsthand the impact that a breach can have on their finances and potentially their health. The average out-of-pocket cost for victims of medical identity theft is $2,500 per incident — and, unlike the subjects of credit card breaches, victims of medical identity theft often have no automatic right to recover their losses. Interestingly, Accenture’s survey finds that retention rates remain high, despite a breach, when healthcare organizations proactively communicate with consumers. For security professionals, this reiterates the importance of preparing in advance to manage a potential attack so that quick action can be taken to help assuage potential consumer fears during or after an incident.

It's time for providers to take data theft more seriously, and for security professionals to recognize an opportunity to build greater trust between patients and healthcare entities. To begin, here are a few simple reminders of measures security professionals can continue reinforcing to help protect consumer data:

  • Urge consumers to monitor medical records and read all statements. If patient records are inaccurate, their data might have been combined with someone else's. Urge patients to pay close attention to records and statements from providers, and to ask them for a summary at least once a year.
  • Remind consumers to check their credit report. Any discrepancies on credit reports could mean that consumers' medical data has been compromised.
  • Discourage oversharing. Consumers should only give out the minimum personal information required — healthcare providers do not need a patient's Social Security number, for example. They should also be alert to phony communications: following the 2015 Anthem breach, victims reported receiving phishing phone calls and emails.
  • Raise the alarm — promptly. If consumers discover anything unusual, they should be encouraged to immediately let providers or insurers know, and should have access to user-friendly channels through which to do so.

Related Content:

Reza Chapman is responsible for developing and driving Accenture's security offerings for providers, health insurers, and business associates. A seasoned executive, Reza brings over two decades of experience advising the information security leaders of Fortune Global 500 ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Zero-Factor Authentication: Owning Our Data
Nick Selby, Chief Security Officer at Paxos Trust Company,  2/19/2020
44% of Security Threats Start in the Cloud
Kelly Sheridan, Staff Editor, Dark Reading,  2/19/2020
Ransomware Damage Hit $11.5B in 2019
Dark Reading Staff 2/20/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-5524
PUBLISHED: 2020-02-21
Aterm series (Aterm WF1200C firmware Ver1.2.1 and earlier, Aterm WG1200CR firmware Ver1.2.1 and earlier, Aterm WG2600HS firmware Ver1.3.2 and earlier) allows an attacker on the same network segment to execute arbitrary OS commands with root privileges via UPnP function.
CVE-2020-5525
PUBLISHED: 2020-02-21
Aterm series (Aterm WF1200C firmware Ver1.2.1 and earlier, Aterm WG1200CR firmware Ver1.2.1 and earlier, Aterm WG2600HS firmware Ver1.3.2 and earlier) allows an authenticated attacker on the same network segment to execute arbitrary OS commands with root privileges via management screen.
CVE-2020-5533
PUBLISHED: 2020-02-21
Cross-site scripting vulnerability in Aterm WG2600HS firmware Ver1.3.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2020-5534
PUBLISHED: 2020-02-21
Aterm WG2600HS firmware Ver1.3.2 and earlier allows an authenticated attacker on the same network segment to execute arbitrary OS commands with root privileges via unspecified vectors.
CVE-2014-7914
PUBLISHED: 2020-02-21
btif/src/btif_dm.c in Android before 5.1 does not properly enforce the temporary nature of a Bluetooth pairing, which allows user-assisted remote attackers to bypass intended access restrictions via crafted Bluetooth packets after the tapping of a crafted NFC tag.