Health Data - A Goldmine for Hackers

Health records are increasingly becoming the target of hackers worldwide. This disturbing trend has been observed through multiple incidents in the recent past, including the server breach at the Utah Department of Health two years ago, which impacted 780,000 individuals, and the incident at Montana Health Department last month, when the server was breached, impacting 1.3 million individuals.

The latest incident involved the Vermont Health Connect where a cyber-attack seems to have taken place last December, with hackers accessing health data 15 times. This incident is yet another wake up call for the healthcare sector, and brings to the forefront a primary question – why hackers target healthcare data?. Healthcare data breach incidents are representing a worrying trend that has caught the attention of healthcare security experts worldwide.

The fact is that external attacks on healthcare data are on the rise, and healthcare organizations have to prepare to equip and deal with these threats and defend their organization. They have to adopt means to prevent unauthorized access to records and safeguard data from sophisticated cybercriminals who are looking for critical health information to commit frauds for financial gain.

The Changing Nature of Cyber Attacks

In the past, hacking was often not a planned or targeted activity. Mostly, it was carried out for fun without other serious motives. But today, cyber-attacks are highly sophisticated, where organized criminals attempt to get hold of sensitive information that can be used fraudulently. Hackers look at healthcare information as a goldmine. Stolen social security numbers, for instance are sold in the underground market for 25 cents and credit card numbers can fetch $1 each. Medical records are now being looked upon as a commodity sold on the black internet. A comprehensive medical record that can be used to get free surgery may be sold at $1000.

Healthcare and government sector systems that process health data are increasingly becoming the targets of hackers because these records contain social security numbers and health insurance identification numbers. It has been noted that healthcare-related hacking incidents in 2013 have risen to 28 incidents affecting 1.1 million records, from 23 incidents affecting 879,179 records in 2012.

While these statistics are alarming enough, what is more alarming is the fact that healthcare entities are yet to ramp up security measures in response to these increasing threats. In reality, the healthcare sector has inadequate resources for protecting their information systems. Over half of all healthcare organizations spend less than 3% of their IT budget for protecting data and a greater number of entities do not even have a CISO or information security manager to manage the security of their systems.

Preparing to Detect and Defend

It has been established time and again that healthcare organizations have become a hot target for sophisticated hacking. Hence experts and practitioners recommend a few critical steps to be taken by these organizations, to improve their ability to detect and defend against security attacks.

Working towards prevention – Healthcare entities should be able to prevent security attacks before they take place, rather than detecting an attack and reacting to it. And in order to prevent attacks, healthcare entities should conduct periodic assessments and investigate their systems to identify possible lapses and gaps and determine the effectiveness of their controls. Periodic security assessment is therefore a critical requirement to help prevent security attacks.

Deploying essential security tools – Organizations should design alerts and alarms that can help detect events which may potentially have negative consequences. Statistical and anomaly-detection methods and rule-based detection mechanisms may prove very helpful in this regard.

Defining roles and responsibilities – In addition to adopting tools and technology for detecting threats, healthcare entities should also formally define the roles and responsibilities for incident response. They should document procedures for response teams to follow in case of a security incident, and also test these procedures periodically.

Taking a comprehensive approach – In order to prevent security breaches, organizations should take a comprehensive and definitive approach to defense. They should adopt end-to-end security solutions such as Aegify Security Posture Management or Aegify SecureGRC that can address all the critical aspects of information security in an integrated manner and help manage healthcare information efficiently. Aegify Risk Management makes it simpler to identify these risks to effectively address them proactively.