Hoala Greevy

home

authors

hoala-greevy

A few years ago, 80 million people had their protected health information stolen after hackers obtained access through spear-phishing emails they had sent to a subsidiary of Anthem Inc. One or more of its employees responded to the email, resulting in a 

 from December 2014 through January 2015 in the largest health data breach in U.S. history.

 in settlement fees to the federal government and agreed to take corrective action to abide by HIPAA rules.

And just as Anthem paid the price for failing to have a system in place to detect hackers, healthcare executives who cut corners and fail to follow security procedures are at risk of incurring massive fines and losing public trust.

The need for healthcare organizations to take an active role in protecting PHI has never been greater, as the number of healthcare data breaches continues to rise. Since 2010, hackers have gained access to more than 175 million healthcare records, according to 

Journal of the American Medical Association

What are the best ways for healthcare executives to keep PHI secure? Here are some tips.

It’s not enough to have technology or rules in place if no one follows them. Be sure to audit and train staff members continuously on what to do so they can be aware of security requirements. This ranges from understanding what is acceptable to talk about in public areas to knowing what a phishing email looks like and how to react to it.

Related: Five Ways to Improve Your Health Organization's Cybersecurity

One way to test for the latter is to do random phishing tests, in which you send a 

 email to all employees and see who clicks on it. Then, use that as a training opportunity to make sure staff is consistently staying alert to potential exploits.

Just remember, quality is more important than quantity when it comes to training. Although 88% of healthcare provider and insurance company employees reported that they received 

, 17% admitted they still write down their username and password, and 19% said they would sell confidential data, according to an 

Decide who gets access to PHI at your healthcare organization based on need. For example, make sure all applications and software allow for role-based access, and keep these access protocols updated and enforced as employees are promoted, move to other departments, or leave the organization.

It’s also important to control physical access to any PHI, making sure it stays on the premises whenever possible. If information must leave, be sure any hard drives are encrypted and protected by passwords to prevent a breach if the storage medium is lost or stolen.

 of electronic media and mobile devices, knowing at all times which employees are responsible for these devices.

Many healthcare organizations partner with vendors to deliver services, manage their data, and optimize operations. Make sure your employees have the same dedication to maintaining security over data as you do. One thing to look for in a vendor is whether it has undergone any security certifications, like 

You should also ensure the vendor has signed a business associate agreement. A Florida provider, 

 (ACH), agreed to do business with a medical billing service several years ago but later learned that the person it was dealing with was using the service’s name and website without permission. ACH discovered this when patient information was made public on the service’s website. 

ACH ended up paying $500,000 in settlement fees

 for sharing PHI with an unknown vendor without a business associate agreement.

There’s no avoiding the phone, email, and even fax when healthcare providers are communicating with patients, payers, and others. Therefore, it’s vital that any communications be secure and HIPAA-compliant. That means encrypting all outbound email messages that contain PHI and, after you receive the information, making sure it’s secure.

According to a recent study, more than half of healthcare data breaches are 

 of hospitals, doctors’ offices, and insurance companies. This underscores the need to establish secure communications protocols and regularly train personnel on them.

By following these steps to ensure your patients’ health information is protected, you can avoid falling victim to a security breach that could have been prevented.

, the only HITRUST CSF-certified seamless secure email solution. Hoala also founded Pau Spam, an email-filtering software service.

Articles

What are the best ways for healthcare executives to keep protected health information secure? Here are some tips.

4 Ways You Can Keep PHI Secure

The healthcare industry has been inundated with so much technology so fast that implementing it feels like an uphill battle for most organizations. Securing all of that technology is an even bigger challenge, but doing so effectively is paramount for both security and business growth.

Any cybersecurity strategy is designed to mitigate risks in case of a breach. Its main goal is to defend against attacks, but if one occurs, a good strategy can control the resulting costs. According to the Ponemon Institute, those costs can reach upward of 

, on average. In the case of Anthem, a single breach (which affected nearly 80 million customers) cost the health insurer 

While a good strategy can be a buffer against those costs, an excellent one can actively drive revenue for your organization. Every vulnerability you miss exposes your network to an attack, and each attack chips away at your overhead. Besides the time and costs of repairing the breach, you can also lose the trust of current and potential customers. On the other hand, successfully detecting and sealing up holes in your network boosts your value in the eyes of customers.

These three strategies can help you successfully find those weaknesses and turn your cybersecurity into a profitable asset:

Incentivize employees (and the public, if you choose) to find bugs in your system by paying bounties for each one they detect and report. If you choose to expand the bounty beyond your employees, be sure to choose a trusted group of ethical hackers to ensure you aren’t handing your entire system over to bad actors.

Bug bounties are one of the most popular and effective ways to find vulnerabilities. HackerOne, a vulnerability coordination and bug bounty platform that connects businesses with cybersecurity researchers, has handed out over 

 in bounties and discovered more than 50,000 corporate vulnerabilities. The group predicts that the number could reach 200,000 vulnerabilities within the next couple of years, and those affecting your network could be among them.

Hunting bugs is a good strategy, but not every breach occurs because of one. In addition to the bounties, have a highly skilled employee or ethical hacker test your network by trying to breach it. Penetration tests, or pen tests, are ongoing multi-step processes used to uncover areas where hackers could breach your network and determine what kind of information they could steal.

For example, your expert could scout your network from the outside, collecting IP addresses and personnel credentials to exploit. You could also have your expert obtain administrator access to see what’s vulnerable behind the firewall. Such tests are critical. In a recent Kaspersky Lab report, internal pen tests successfully breached 

tested. In 42% of those cases, testers gained access in only two steps.

Pen tests can help uncover human vulnerabilities and network weaknesses, but you can shore up those vulnerabilities more effectively by routinely hacking your employees. People think they’re smarter than phishing emails until they’re caught. Randomly testing employees will improve the chances of you catching them before hackers do.

The problem is that phishing emails today are hard to differentiate from legit ones. Osterman Research found that compromised internal accounts, or account takeovers, have more than doubled, affecting 

 in the past year. Once an employee’s account is taken over, the hacker can phish indiscriminately from that account. Before that happens, find the employees who need training the most by sending mock phishing emails and seeing who falls for them.

The more technology takes over the healthcare industry, the more vulnerable healthcare and insurance organizations become to network breaches. Along with investing in top-notch cybersecurity, keep your network safe by tracking down its most vulnerable spots before hackers can take advantage of them.

, a provider of HIPAA-compliant email services. Greevy also founded Pau Spam, an email filtering software service.

Find the weaknesses within your system before hackers do.

Author | Hoala Greevy

Articles

4 Ways You Can Keep PHI Secure

Three Ways to Uncover Technology Risks