Modern medical care has made amazing advancements in treatment and prevention protocols, resulting in substantial improvements in patient well-being. To be sure, healthcare has many problems that range from inflated costs to uneven accessibility, but, medically speaking, these are great days for the healthcare community. Even as the industry continues to advance, healthcare remains grounded on its founding principle: first, do no harm.
The Hippocratic Oath serves as the industry’s lodestar, ensuring that patient care is never compromised by institutional ambition or untested advancement.
While that foundational value undoubtedly helps protect patients from undue harm, it’s taking on new meaning in today’s technology-driven medical economy. Along with treating patients, healthcare companies collect copious amounts of sensitive personal information. Moreover, electronic medical records, credited with boosting efficiency while lowering costs and reducing errors, are a ubiquitous component of the healthcare ecosystem, giving patients real-time access to their medical information, and empowering them to make informed, conscientious decisions.
At the same time, healthcare’s rapid digitization has made data security a top concern. According to the 2019 HIMSS Cybersecurity Survey, 82 percent of hospital IT administrators reported a “significant security incident” in the past year, and the number of reported healthcare-related breaches is at an all-time high. In a real way, data security isn’t just a problem for IT administrators. It’s an extension of quality patient care that includes everyone in the organization.
In the digital age, protecting patient data is a tangible extension of the Hippocratic Oath. To put it simply, doing no harm means that data protection has to be a component of patient care.
Not Just a Nice Idea
The Hippocratic Oath serves as a guiding ethos that informs the industry, but it’s not the only standard for protecting patient data.
HIPAA, the longstanding patient privacy regulation, dictates and governs the ways healthcare providers store and secure protected health information (PHI), and failure in this regard is both practically devastating and a PR disaster that negatively impacts patient well-being.
The Ponemon Institute’s annual data breach study found that the average cost of a data loss event approaches $4 million, but the consequences are much higher for healthcare providers. The HIPAA Journal reports that “The highest data breach resolution costs are for healthcare data breaches, which typically cost an average of $408 per record,” double the amount of the second highest industry.
For example, in 2018, Anthem paid $16 million in HIPAA fines after the health insurance provider reported a data breach that compromised the ePHI of nearly 79 million people. While Anthem is the greatest offender to data, they are not alone in this regard. The past three years have seen a steep increase in the frequency of HIPAA penalties with the average HIPAA violation costing the compromised company $2.5 million.
Of course, a data breach has cascading consequences for healthcare companies. Trust is a central component of the industry, and a data loss event inherently violates the confidence that patients have in their healthcare providers.
A 2018 report by the Journal of Healthcare Communications found that trust is one of the most influential components of a quality healthcare experience. With more providers’ compensation tied to patient satisfaction, this is important on many levels.
Regardless of motivation, innovation is necessary. Healthcare companies need to do everything possible to protect their patients’ information, which means that they need a holistic approach to data security that allows for threat identification and robust protection.
The Solution
With so much at stake, healthcare companies need the tools to monitor their technological ecosystem while creating a demonstrable record of compliance. Therefore, endpoint activity monitoring and data loss prevention software is an essential and crucial next step in the right direction for ensuring companies are HIPAA compliant and that accidental or malicious data exfiltration is detected and prevented.
Most importantly, it’s a necessary tool for providing the best patient care in today’s digital-first medical environment.
Since nearly 60 percent of all healthcare-related data breaches are caused by insiders, this tool can make a meaningful difference in the ways healthcare companies protect patient information. More specifically, robust user activity monitoring software protects healthcare providers and their patients in several critical ways:
● administrative and technical safeguards
● automatic security standards
● adequate burden of proof.
For instance, 25 percent of healthcare providers encountered a data breach that resulted from medical information on a mobile device, and half of those data loss events were accidental. Employee monitoring software can prevent patient data from being accessed on these devices, so that changing technological norms don’t compromise patient privacy.
Meanwhile, healthcare companies involve many moving parts, including third-party contractors and outside entities. When it comes to protecting PHI, healthcare providers are responsible for their behavior as well. In 2017, Anthem, already reeling from a massive data breach, discovered that a third-party contractor stole and resold the personal information of 18,000 Medicare members.
Employee monitoring protects all of that information, giving companies the features they need to ensure compliance and excellent patient care.
By automating things like data access and placing movement restrictions on sensitive PHI, healthcare providers can maintain their patients’ trust and confidence by protecting their information from misuse.
Of course, nobody is taking their word for it. Healthcare companies regularly submit to compliance audits, and demonstrating compliance is a critical component to both HIPAA oversight and patient confidence. The comprehensive reports that derive from employee monitoring software solutions supply the information necessary to complete compliance reviews while also maintaining a burden of proof through session recording, access logs, and other oversight components.
Healthcare is undoubtedly becoming more digital, and companies need to innovate their protocols to adequately account for the accompanying risks. The costs associated with regulatory compliance are steep, but losing patient trust can be even more devastating. Endpoint activity monitoring and data loss prevention are an important and crucial step in the right direction to ensure HIPAA and other privacy guidelines are followed and any unintentional or malicious data exfiltration is detected and prevented.
In today’s digital-first environment, protecting patient data is a natural extension of patient care. It ensures that technological innovation doesn’t harm patient care.
Isaac Kohen is the Founder and Chief Technology Officer of Teramind, a leading, global provider of employee monitoring, insider threat detection, and data loss prevention solutions.
