Insiders Are The Cause Of Most Healthcare Breaches

Ransomware and hacking incidents plagued 2016, and this year is no different, with the latest Protenus Breach Barometer midyear report finding that 2017 is on pace to exceed last year’s rate of one breach per day.

So far this year, the healthcare sector has reported 233 breach incidents to the US Department of Health and Human Services, state attorney generals and media. More than 3.16 million patient records have been breached.

The report analyzed 193 of the incidents for which it had data. Breaches have remained steady in the last six months outside of June, which saw a spike with 52 incidents. And March saw the most patients affected, with 1,360,961 records breached.

“The healthcare sector will only stop being so vulnerable when the advances in data collection, sharing and analytics are matched with similar advances in our understanding of how to protect patient data,” said Protenus Cofounder and President Robert Lord.

“Healthcare has invested tens of billions of dollars in deploying systems to leverage data to improve patient outcomes, and appropriately so,” he continued. “But we still have massive problems with the abuse of that data and those systems.”

So what are the biggest threats plaguing healthcare in 2017? Insiders and hackers.

Hacking accounted for 75 breaches this year, with 1,684,904 patient records impacted. Malware and ransomware were specifically mentioned in 29 of these incidents, but the report found there were many additional incidents where malware was reported as hacking or an IT incident.

Officials expect more organisations to report ransomware attacks this year, as HHS updated its ransomware reporting requirements in Aug. 2016. The update places the burden of proof on the provider to demonstrate data remained inaccessible or weren’t exfiltrated.

Insiders are also remaining a constant challenge for healthcare, accounting for 96 incidents or 41 percent of data breaches this year so far. More than 1.17 million patient records were breached by insider error or wrongdoing.

Wrong-doing is rife to cause significant damage, as it’s rarely detected immediately. For example, Anthem reported this week an employee of its Medicare insurance coordination services vendor was stealing and misusing Medicaid member data from as early as July 2016. The breach wasn’t found until April.

Another issue plaguing the healthcare sector is that other types of external attacks have been underreported or unreported. Thousands of databases in all sectors have been wiped or the data were exfiltrated. The report found that only few of these were reported to HHS.

The FBI has also reported that these ‘ransacking’ incidents or targeted databases aren’t being reported.

“Healthcare executives, at a fundamental level, should stop thinking about security and privacy as a cost center and more as a strategic pillar of their organisation,” said Lord. We've continued to see increased awareness and incremental improvements, “but not the needed dramatic leap forward.”

To Lord, the leap will be driven by CISOs and Chief Privacy Officers, “dramatically increasing investment in these areas to match other industries and leveraging the use of advanced analytics to detect inappropriate uses of patient data.”

“A culture of trust, comprised of dual pillars of privacy and security, must come from the highest levels of the organisation.”

Healthcare IT News

You Might Also Read:

8 Major Problems Healthcare CIOs Are Facing:

Is It Really Possible to Protect Your Health Data?:

 

 

 

 

« Protecting Future Cars from Cyber Attacks
Australian Spy Data Helps Business Cyber Threats »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

Landry & Associates

Landry & Associates

Landry & Associates is a multidisciplinary firm specializing in risk management, performance and technology management.

APWG

APWG

APWG is the international coalition unifying the global response to cybercrime across industry, government, law-enforcement and NGO communities.

Korea Internet & Security Agency (KISA)

Korea Internet & Security Agency (KISA)

KISA is committed to improving the competitiveness, reliability and security of Internet information and knowledge in Korea.

Westermo Network Technologies

Westermo Network Technologies

Westermo designs and manufactures robust, resilient and secure data communications products for mission-critical industrial systems.

Protenus

Protenus

Protenus provide a solution to proactively monitor and protect patient privacy in the electronic health record (EHR).

Crossword Cybersecurity

Crossword Cybersecurity

We work with research intensive European university partners to identify promising cyber security intellectual property from research that meets emerging real-world challenges.

Sensible Vision

Sensible Vision

SensibleVision helps organizations transparently protect data and prevent costly security breaches by constantly verifying the identities of people who use computers or mobile devices.

Ceerus

Ceerus

Ceerus was created to simplify the process of deploying and managing security across all the channels in an organisation.

Chronicle

Chronicle

Chronicle products combine intelligence about global threats in the wild, threats inside your network, and unique signals about both.

Secure Blockchain Technologies (SBT)

Secure Blockchain Technologies (SBT)

SBT is a team of Enterprise IT Security Professionals weaving security and Blockchain Technology into our customer’s operational fabric.

Swish Data Corp.

Swish Data Corp.

Swish delivers when the problems are complex, requirements are difficult, and the mission is absolutely critical.

Legit Security

Legit Security

Legit Security's mission is to secure every organization's software factory by protecting the pipelines, infrastructure, code and people for faster and more secure software releases.

Paubox

Paubox

Paubox offers secure, HIPAA compliant email and marketing solutions to fit the needs of modern healthcare organizations of every size.

Focus on Security

Focus on Security

Focus on Security are Cyber Security recruitment specialists. We’re dedicated to connecting you with the top Cyber Security talent across the globe. We focus on partnerships and results.

Hawk AI

Hawk AI

Hawk AI’s mission is to help financial institutions detect financial crime more effectively and efficiently using AI to enhance rules and find anomalies.

Stacklok

Stacklok

Stacklok are an Open Source first security company enabling safe Open Source Software consumption.