Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

7/13/2017
10:30 AM
Reza Chapman
Reza Chapman
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

How Security Pros Can Help Protect Patients from Medical Data Theft

The healthcare industry has been slow to address the dangers of hacking, and breaches are on the rise. Security pros must be more proactive in keeping people safe.

John Schoew, Managing Director, North America Health & Public Service Security Lead for Accenture, contributed to this article. 

Imagine discovering that a local hospital's IT system has been hacked and the hackers are threatening to publish patients' names, addresses, and medical records on the Internet. In September 2016, this happened to 6,000 patients in Oklahoma.

As security professionals know, this is just one example of many when it comes to medical data theft. New research from Accenture finds that a startling 26% of U.S. consumers have experienced a healthcare data breach, and 50% of these people subsequently have been victims of medical identity theft.

Most consumers are aware of the risks of online transactions, but far fewer are aware of how susceptible they are to medical identity theft — and the damage it could cause — leaving room for security professionals to help promote stronger anti-theft measures, and allowing hospitals to better manage breaches when and before they occur.

Identity Crisis
Medical data is made up of test results and diagnoses, but it also includes Social Security numbers, dates of birth, contact information, and driver's license numbers. Together, this information creates an online identity. Security professionals are aware of what a hacker could or might do with this level of detail. Mixing identities by selling personal information or falsely obtaining healthcare could lead to dangerously muddled patient records. Hackers might threaten to "dump the data on the Internet" unless the organization pays a ransom, as in the Oklahoma case, or block the organization from accessing this vital information altogether.

Other industries are stepping up their games in terms of data security, so hackers coveting personal data have had to look elsewhere. And, with most health information held electronically and dating back years, the medical sector is a sitting duck. In 2016, there were 377 data breaches in the healthcare/medical industry — 34.5% of all data attacks. In 2017, there had already been 144 breaches by the middle of February. It appears that this trend is accelerating.

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada, July 22-27, 2017. Click for information on the conference schedule and to register.

A logical question is likely to be, "Where are these breaches happening and how can they be prevented?" According to Accenture's research, breaches were most likely to occur in hospitals, followed by urgent-care clinics, pharmacies, physicians' offices, and health insurers. Often, organizations are late to detecting a problem: half of U.S. consumers who experienced a breach discovered it themselves through an error on their credit card statement or benefits explanation. Only a third were alerted to the breach by the organization where it occurred, and just 15% were alerted by a government agency. Security professionals, aware of the potential opportunities for healthcare information breach, are capable of helping hospital systems, and the industry overall, strengthen defenses to help ensure that consumer data is safe.

What Security Pros Can Do
Healthcare organizations have an obligation — and an inherent interest — to protect medical and financial data in their care. When security practices fall short, resulting in a breach and subsequent data theft, Accenture research indicates that many affected consumers will take action. Affected respondents either changed healthcare providers (25%) or insurance plans (21%), or sought legal counsel (19%). Based on recent trends and incidents, the role of security professionals will only become more important in making the protection a reality.

Many consumers understand firsthand the impact that a breach can have on their finances and potentially their health. The average out-of-pocket cost for victims of medical identity theft is $2,500 per incident — and, unlike the subjects of credit card breaches, victims of medical identity theft often have no automatic right to recover their losses. Interestingly, Accenture’s survey finds that retention rates remain high, despite a breach, when healthcare organizations proactively communicate with consumers. For security professionals, this reiterates the importance of preparing in advance to manage a potential attack so that quick action can be taken to help assuage potential consumer fears during or after an incident.

It's time for providers to take data theft more seriously, and for security professionals to recognize an opportunity to build greater trust between patients and healthcare entities. To begin, here are a few simple reminders of measures security professionals can continue reinforcing to help protect consumer data:

  • Urge consumers to monitor medical records and read all statements. If patient records are inaccurate, their data might have been combined with someone else's. Urge patients to pay close attention to records and statements from providers, and to ask them for a summary at least once a year.
  • Remind consumers to check their credit report. Any discrepancies on credit reports could mean that consumers' medical data has been compromised.
  • Discourage oversharing. Consumers should only give out the minimum personal information required — healthcare providers do not need a patient's Social Security number, for example. They should also be alert to phony communications: following the 2015 Anthem breach, victims reported receiving phishing phone calls and emails.
  • Raise the alarm — promptly. If consumers discover anything unusual, they should be encouraged to immediately let providers or insurers know, and should have access to user-friendly channels through which to do so.

Related Content:

Reza Chapman is responsible for developing and driving Accenture's security offerings for providers, health insurers, and business associates. A seasoned executive, Reza brings over two decades of experience advising the information security leaders of Fortune Global 500 ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Firms Improve Threat Detection but Face Increasingly Disruptive Attacks
Robert Lemos, Contributing Writer,  2/20/2020
Ransomware Damage Hit $11.5B in 2019
Dark Reading Staff 2/20/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-17274
PUBLISHED: 2020-02-26
NetApp FAS 8300/8700 and AFF A400 Baseboard Management Controller (BMC) firmware versions 13.x prior to 13.1P1 were shipped with a default account enabled that could allow unauthorized arbitrary command execution via local access.
CVE-2019-17275
PUBLISHED: 2020-02-26
OnCommand Cloud Manager versions prior to 3.8.0 are susceptible to arbitrary code execution by remote attackers.
CVE-2020-3169
PUBLISHED: 2020-02-26
A vulnerability in the CLI of Cisco FXOS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying Linux operating system with a privilege level of root on an affected device. The vulnerability is due to insufficient validation of arguments passed to a spe...
CVE-2020-3170
PUBLISHED: 2020-02-26
A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause an NX-API system process to unexpectedly restart. The vulnerability is due to incorrect validation of the HTTP header of a request that is sent to the NX-API. An attacker could expl...
CVE-2020-3171
PUBLISHED: 2020-02-26
A vulnerability in the local management (local-mgmt) CLI of Cisco FXOS Software and Cisco UCS Manager Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system (OS) of an affected device. The vulnerability is due to insufficient input vali...