Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

10/18/2012
04:00 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Health Data Breach Response: Culture Change Needed

Seattle Children's Hospital CISO builds incident response team and culture of continuous improvement concerning data breaches.

7 E-Tools To Keep Patients Engaged
7 E-Tools To Keep Patients Engaged
(click image for larger view and for slideshow)
Someone has to be accountable for every part of managing a data breach incident, according to Cris Ewell, chief information security officer at Seattle Children's Hospital.

"It's bigger than privacy and security … it's about involving everyone in the organization at the highest level down to the help desk level [people] who are inputting calls into the system," he said. In a recent webinar hosted by ID Experts, Ewell said that in addition to accountability, there needs to be a shift in organizational culture to combat breaches.

Seattle Children's is a not-for-profit hospital and the academic research center for the University of Washington. It deals mainly with research, genetics and diseases, bioethics, and all avenues of pediatric care.

Ewell said the culture within his organization has changed since he implemented an incident response team. For instance, the employees at Seattle Children's have learned to expect breaches, no matter what they do to prevent them. "It's not a matter of if, but when," he said. The hospital operates under the assumption that "people will get in and there will be issues. You need to have that expectation that it's going to happen no matter what you do."

Ewell advises considering setting up outside help before an incident occurs. A small breach of 4,000 or 5,000 patients, he said, could be handled by the organization itself. But a larger breach might require additional help, such as call center professionals and interpreters. "You can do a lot in-house, but you have to have the ability to ad hoc within a short period of time for a large incident," he said.

Management should not be caught off guard by a breach, and should plan to be flexible enough to spend time rectifying problems, said Ewell. "Sometimes, we lack time and resources, and that's an element we see when you have a big or moderate incident," he said. "I've worked with small to large [breaches], and it's different depending on what resources you need, but you need to plan for that: incident response versus incident management. You want to get management pre-planning ahead of time and not just being active when you have an incident."

[ What about natural disasters? See Health IT Offers Safe Haven In A Storm. ]

Determining whether there is a breach in the first place can be one of the hardest tasks, said Ewell, followed by determining what the risk is to the institution and what patient data might have been compromised. "Part of our process is to determine that motive and intent," he said. Documentation of a breach is key. "With all breaches, tell the story: why did it happen and why did that person want that information."

"It helps me paint a picture and determine what the risks are," Ewell said. In order to meet the requirements of the Health Insurance Portability and Accountability Act, he said, an organization needs to determine if there was significant financial harm or harm of another kind done to the patient. It also needs to have documentation in place to show processes that were undertaken, and why it did or did not notify patients.

At Seattle Children's, Ewell and his team always circle back after an incident to see whether they can improve their processes, he said. "It's a continual loop of reviewing and assessing. That 60-day time limit: once you identify an incident, it gets spun up quickly and you have to make a determination of who to notify; that will keep going until the incident is done."

InformationWeek Healthcare brought together eight top IT execs to discuss BYOD, Meaningful Use, accountable care, and other contentious issues. Also in the new, all-digital CIO Roundtable issue: Why use IT systems to help cut medical costs if physicians ignore the cost of the care they provide? (Free with registration.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
jaysimmons
50%
50%
jaysimmons,
User Rank: Apprentice
10/23/2012 | 12:05:03 AM
re: Health Data Breach Response: Culture Change Needed
Regardless of what measures you put in place, data breeches and unauthorized access will always occur in a large organization with so many people requiring access to data. Seattle ChildrenGs Hospital is handling the situation correctly by fostering a culture that continuously provides feedback of breeches, and improving upon the weaknesses. Treating data breeches as an opportunity to improve current practices, rather than trying to cover them up, will only result in better policies and smaller scale breeches in the future. An organization must always be prepared for a large-scale data breech because of the resources required to stay within the 60 day time limit, regardless of how probable it may be because the possibility is always there and the result can be crippling.

Jay Simmons
Information Week Contributor
HackerOne Drops Mobile Voting App Vendor Voatz
Dark Reading Staff 3/30/2020
Limited-Time Free Offers to Secure the Enterprise Amid COVID-19
Curtis Franklin Jr., Senior Editor at Dark Reading,  3/31/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
State of Cybersecurity Incident Response
State of Cybersecurity Incident Response
Data breaches and regulations have forced organizations to pay closer attention to the security incident response function. However, security leaders may be overestimating their ability to detect and respond to security incidents. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-11547
PUBLISHED: 2020-04-05
PRTG Network Monitor before 20.1.57.1745 allows remote unauthenticated attackers to obtain information about probes running or the server itself (CPU usage, memory, Windows version, and internal statistics) via an HTTP request, as demonstrated by type=probes to login.htm or index.htm.
CVE-2020-11548
PUBLISHED: 2020-04-05
The Search Meter plugin through 2.13.2 for WordPress allows user input introduced in the search bar to be any formula. The attacker could achieve remote code execution via CSV injection if a wp-admin/index.php?page=search-meter Export is performed.
CVE-2020-11542
PUBLISHED: 2020-04-04
3xLOGIC Infinias eIDC32 2.213 devices with Web 1.107 allow Authentication Bypass via CMD.HTM?CMD= because authentication depends on the client side's interpretation of the <KEY>MYKEY</KEY> substring.
CVE-2020-11533
PUBLISHED: 2020-04-04
Ivanti Workspace Control before 10.4.30.0, when SCCM integration is enabled, allows local users to obtain sensitive information (keying material).
CVE-2020-11529
PUBLISHED: 2020-04-04
Common/Grav.php in Grav before 1.6.23 has an Open Redirect.