As 2017 is rapidly closing, one this is certain— the healthcare industry remains one of the easy targets for hackers. As many Americans start thinking about their health plans for next year, and as doctors start taking on new clients for the new year, I thought it appropriate to review why as a healthcare business or as a patient, you should be concerned about healthcare IT Security.
Healthcare is plagued with a growing abundance of sensitive information compared to other industries, with little or no infrastructure or policy improvements to keep data safe while enabling users to get their jobs done easier.
Today, one week after our launch of our latest book on healthcare cybersecurity, is perfect time to make sure healthcare businesses are crossing their t’s and dotting all i’s to keep patient and employee data safe.
And what I want to focus on today is why healthcare persists to be such a problematic industry when it comes to cyberattacks.
Here are the 6 biggest reasons your healthcare is NOT safe:
- Your data is worth big bucks!
While we’ve discussed this before, many folks don’t quite understand just how much a simple medical record is worth. Any protected health information (PHI) is worth a lot on the dark web today. Below might help explain why hackers are so interested in your patients’ medical records:
- Credit Card Details: $2 to $90
- iTunes Accounts: $8
- Physical Credit Cards: $190
- Card Cloners: $200-$300
- Medical Record: $1200!
Your medical information is worth a lot more than a credit card number or bank routing number.
And to put the numbers listed above in context, let’s for a second talk about incentivisation. A hacker in a country like China, for instance, has a choice between entering the Chinese work force, where the average salary brings home $2.10 an day versus trying to steal and sell a Social Security Number worth X. And if that hacker simply hacks into a small dentist’s office that may have a thousand records, they have the potential to make a huge payout. One afternoon dedicating to successfully hacking into and stealing medical records from a small medical office has the potential to compensate that hacker well over an annual salary. If you had the skill and means to hack into medical data, if the alternative was to make $2.10, what sounds better?
- Many healthcare offices do not have staff by-in on security policies
One of the biggest reasons why healthcare lags behind other organizations when it comes to security is that their staff were not involved in identifying and creating appropriate security measures for their organizations.
More often than not, healthcare offices simply rely on one security officer to put checks in boxes to ensure that their office is in compliant with HIPAA-HITECH compliance pressures. But the problem with this is that the majority of offices are not understanding where users are having hardships with policies and areas where policies could be improved to make healthcare operations easier.
Most of the time, Healthcare IT Security is viewed as a barrier or hurdle to getting work done. When IT Support services make work harder for healthcare staff, security policies and measures are not being properly implemented.
Your IT Support team should be identifying bottlenecks in IT Support process—specifically aimed at making your office more secure—to stay compliant and secure while keeping users barrier-free. Here is one example of how healthcare IT should operate.
- Hackers use a multi-leveled approach to breaching you network
While phishing scams persist to be a quite economical means to breach your data through user vulnerabilities, hackers are using a combination of ransomware, distributed-denial-of-service (DDoS) tools, botnets, sophisticated malware and other cyber-kinetic elements to breach healthcare networks over the past year.
With a multi-pronged approach to their attacks, many criminals have identified healthcare as the lowest hanging fruit (with the biggest reward) of industries to hack in 2017.
- Password policies are too weak
Many healthcare businesses don’t understand that they are at risk for being hacked. Why take extra preventative precautions that create more work for team members?
The problem with this thinking has led to poor security hygiene when it comes to ensuring your network is air-tight from data breaches.
One of the easiest ways hackers get into your network is from compromised passwords.
- 3rd party vendors are risking healthcare data far too often for comfort
Even when healthcare offices have, themselves, taken appropriate security measures (see above list for example of some of the big hitters), they often overlook all of the vendors and colleagues that have access to their patient information.
In recent history, over 63% of data breaches have, in some way, shape or form, been linked to transmission of data to collaborating offices or from vendor breaches.
Just to understand all of the touch points healthcare offices have with data, take a look at this PHI Roadmap below. On a daily basis, your office is likely transmitting hundreds of data—which left unguarded, could easily get into the wrong hands!
- You haven’t read up on healthcare security
Most CEOs and doctors in healthcare that I’ve spoken to are concerned about keeping their patient data safe. But one of the biggest issues they tell me is that there aren’t resources to help them explicitly understand what they need to do to ensure their IT Security is done right.
Doctors and Healthcare CEOs need digestible information that leads to actionable results! In response to our healthcare users, I’ve written your ultimate guide to HIPAA compliance and cybersecurity. Get a FREE copy of PLAGUED: The CEOs Ultimate Guide to HIPAA Compliance and Cybersecurity TODAY!
So Again, I ask the question: Are you certain your office is taking appropriate security precautions? Is your patient data safe? Contact Us TODAY for a FREE security assessment!
