Employees Are Biggest Threat to Healthcare Data Security

Healthcare data security is under attack from the inside. While insider threats—due to employee error, carelessness, or malicious intent—are a problem in every industry, they are a particular pox on healthcare data security. Two recent reports illustrate the gravity of the situation. Verizon’s 2018 Protected Health Information Data Breach Report, which examined 1,368 healthcare data security incidents in 27 countries (heavily weighted towards the U.S.), found that: * 58% of protected health information (PHI) security incidents involved internal actors, making healthcare the only industry where internal actors represent the biggest threat to their organizations. * About half of these incidents were due to error or carelessness; the other half were committed with malicious intent. * Financial gain was the biggest driver behind intentional misuse of PHI, accounting for 48% of incidents. Unauthorized snooping into the PHI of acquaintances, family members, or celebrities out of curiosity or for “fun” was second (31%). * Over 80% of the time, insiders who intentionally misused PHI didn’t “hack” anything; they simply used their existing credentials or physical access to hardware (such as access to a laptop containing PHI). * 21% of PHI security incidents involved lost or stolen laptops containing unencrypted data. * In addition to PHI breaches, ransomware continues to plague healthcare data security; 70% of incidents involving malicious code were ransomware attacks. Meanwhile, a separate survey on healthcare data security conducted by Accenture found that nearly one in five healthcare employees would be willing to sell confidential patient data to a third party, and they would do so for as little as $500 to $1,000. Even worse, nearly one-quarter reported knowing “someone in their organization who has sold their credentials or access to an unauthorized outsider.” Combating Insider Threats to Healthcare Data Security Healthcare data security is especially tricky because numerous care providers require immediate and unrestricted access to patient information to do their jobs. Any hiccups along the way could result in a dead or maimed patient. However, there are proactive steps healthcare organizations can take to combat insider threats: * Establish written acceptable use policies clearly outlining who is allowed to access patient health data and when, and the consequences of accessing PHI without a legitimate reason. * Back up these policies with routine monitoring for unusual or unauthorized user behavior; always know who is accessing patient records. * Restrict system access as appropriate, and review user access levels on a regular basis. * Don’t forget to address the physical security of hardware, such as laptops.