How to Protect ePHI from Healthcare Data Security Threats
Did you hear about the time McAfee Labs dubbed 2014 “The Year of Shaken Trust”? Back then, a medical record was ten to twenty times more valuable to hackers than a credit card number because it offered copious amounts of sensitive personal data.
It’s been several years since that report was issued, which should mean we’ve come a long way in securing electronic protected health information (ePHI).
Instead, the news is filled with one healthcare data security breach after another. In one incident, an Ohio provider was forced to pay a $75,000 ransom to have its network restored. In another, 20 million patient records were accessed. And this list goes on. (And on.) The number of major HIPAA data breaches for which cyber attackers are responsible has increased 300% in just three years.
With healthcare data at such high risk, it’s shaping up to be a critical time for HIPAA compliance, web form security, and other healthcare IT measures.
What’s Happening with Healthcare Data Security?
To hackers, ePHI is even better than hitting the jackpot. A single medical record offers a bevy of black market opportunities, from insurance fraud and prescription abuse to identity and credit card theft. And because healthcare organizations often lack the sophisticated backup systems that are common in other industries, they’re prime targets for cybercrime.
How Do HIPAA Data Breaches Happen?
Most healthcare data hacks start with an unsuspecting employee doing something as simple as viewing a patient record or opening an email attachment from a legitimate-looking address. In one experiment, IT security consultants infiltrated a computerized medicine dispensary by dropping off malware-containing USB sticks stamped with the hospital’s logo. In another, the same team filled patient portal form fields with malicious code to be triggered when viewed by a doctor or nurse.
Mobile healthcare data is also to blame: A Jama Network survey found that eight in ten Google Play diabetes apps lacked privacy policies. Around the same time, more than 80% of surveyed healthcare employees admitted to being fearful of mobile cyberattacks involving malware, blastware, and ransomware.
What Can You Do to Secure Your Healthcare Data?
For starters, choose your vendors wisely. Web forms must be HIPAA compliant, privacy policies should be in place, and digital tools in general should meet high security standards. As one well-regarded security expert put it:
“Every healthcare institution must realize that their patients’ data is their most valuable data, and serious protection means, at the least, the introduction of the same security measures now protecting other sectors.”
Bottom line: It’s up to each healthcare organization to take steps to ensure its ePHI stays safe. Instead of assuming your vendors have a variety of security measures in place to safeguard medical information, be prepared to ask questions such as these:
- How are emails and web traffic encrypted?
- How is “at rest” data protected?
- What steps are you taking to ensure we remain HIPAA compliant?
- What security measures, such as SSL and advanced password protections like 2FA, are available for online forms?
- How is information protected as it flows from one user to another?
With Formstack’s HIPAA-compliant secure forms, healthcare providers can improve the patient experience with the confidence data is being protected by layers of extra security. Visit our patient empowerment page to learn more.
