Assess and Manage Risk
Medical providers should have comprehensive knowledge of where their critical information resides, and of all vulnerabilities related to the storage and transmission of the data. To ensure that the medical community recognizes the threat to confidential information, the US Department of Health and Human Service mandated within the HIPAA Security Rule that all covered entities conduct a risk analysis to identify all potential vulnerabilities as well as to determine the probability of a possible security event.
While a risk assessment should be a formal exercise in which all facets of information security are reviewed, the provider should also establish and maintain a strategy for risk management. This involves implementing proper safeguards to secure information as well as educating personnel on the policies and procedures that mitigate risk. By cultivating a culture of compliance, a provider can reduce the chance of exposing a vulnerability that could lead to unauthorized access.
Increase Detection Capabilities
Recent cyber-attacks in the healthcare community have exposed a dangerous trend: Many times, hackers have accessed and begun harvesting data several weeks prior to being detected. It is no longer sufficient for medical providers to consider security safeguards such as firewalls and anti-virus software applications as “set it and forget it” mechanisms. Solutions should be implemented to enable the monitoring and detection of breaches that could trigger proper response processes quickly.
Healthcare organizations should consider investing in Next-Generation Firewalls. These security devices provide more than just network filtering – they typically offer advanced security features such as deep packet inspection (where each specific data part that passes through is examined) as well as intrusion prevention systems that monitor network traffic for malicious activity and block such attempts once detected.
In addition to these technologies, other applications such as Security Information and Event Management Systems (SIEMs) allow for real-time analysis and monitoring of systems. These solutions can be configured to alert the proper personnel in the event of a suspicious activity (e.g., multiple failed system logins) and allows for the organization to establish a proactive stance against unauthorized access to critical systems.
Protect and Secure Mobile Devices
According to the 2014 SANS Health Care Cyber-Security Survey, 52 percent of respondents allow access to health record information via mobile devices. Another 30 percent indicated that sensitive data was being included in instant messaging applications.As mobile device usage grows, it becomes more important for healthcare providers to implement a mobile device management policy to address the threat of these devices causing a security incident.
Specific to the mobile device itself, all providers should ensure that both authentication and encryption are enabled on all devices. Furthermore, public Wi-Fi networks should not be used in situations where health information will be transmitted. Secure, encrypted connections such as SSL VPN should be established when accessing corporate resources remotely. Providers should also implement technologies that can remotely wipe or disable mobile devices that are lost or stolen.
As much as one can try to mitigate risk related to the mobile device itself, the user of the device can still pose a significant liability. In addition to addressing the physical device, organizations should also invest in continuing education for users, as well as maintaining strict policy and procedures related to the use of the device.
Looking Ahead
The SANS report data shows that the healthcare industry is starting to make strides when it comes to protecting data. However, not only are the hackers getting smarter, but their activity and attempts to mine confidential information continues to increase. A 2014 report in United States Cyber Security Magazine indicated that the healthcare industry was the target of more cyber-crime incidents than any other market, and this trend is likely to continue as hackers start to realize the value of medical information.
Healthcare organizations will need to continue to examine the ways in which they are protecting themselves from attack. Analysis will need to be conducted internally and externally, as associated organizations such as payers, insurers, and other entities within community healthcare networks will be responsible to each other for protection of medical information. By managing risk and building a risk framework that addresses all areas of critical data, medical providers can take significant steps towards minimizing the likelihood of a cyber-security attack.
Nic Cofield is a consultant with Jackson Thornton Technologies.