The healthcare industry today is challenged by ‘too much data’! Day-to-day patient interactions involve exchange of so much personal data – from biometrics, scanned reports, to personal health apps transferring data to healthcare facilities, and so on. Although most of the healthcare data collection is well-intentioned, most often, it gets out of control. Patients are ready to share their data because largely, they believe it is for their good, and they trust the organization they are giving it to. But do they know where all their data is going to end up?
Even a few years ago, with the growing digitization of patient and clinical data, organizations only saw the tremendous benefits from it and failed to anticipate the problems it would bring along. The healthcare industry has become one of the prime targets for predators and bad actors because there is just so much sensitive data that is unprotected, that is vulnerable to exploitation. Automation in healthcare systems, and increased information transparency are also translating directly into higher chances for data compromise.
Healthcare organizations need to understand that the cost of an attack or a data breach is way more than the cost of keeping data safe. Yes, they do face formidable challenges in healthcare data protection and that is why suitable investments in security technologies, solutions, and processes can make all the difference. There has also been increasing sophistication of cyber threats, and hackers have detailed information about target organizations and know the loopholes that can be leveraged. There is an immediate need for standard policies and practices, mature information governance, clear understanding of the threat landscape, the right technology investments, and timely steps for future-proof cyber resilience.
Managing Healthcare Data Volumes
With the digitalization of healthcare practices, a lot of personal information is electronically shared between patients and medical practitioners. The surge in popularity of IoMT devices (Internet of Medical Things) such as pacemakers and other types of personal medical equipment, is largely because of their easy connectivity to the internet, accessibility of their data, and the suitability of this data for enhanced patient care.
The answer to why do we collect the data is often – because we can. But that is the starting point for trouble. There needs to be clarity on the purpose of data collection, how it is going to be used, for how long, and how it is going to be managed through its life cycle within the organization. If data needs to be used for purposes beyond the original purpose, patient consent needs to be obtained and tracked. Data minimization needs to be adopted, where the focus is on collecting only data that is absolutely required, and nothing more. The simple reason being, we do not need to protect data that we do not collect. Data retention policies need to be in place to control how long data is allowed to stay within the system. There also needs to be clarity on how the data can be used if it is anonymized and pseudonymized. Data security and governance frameworks need to be established to manage all this. But sometimes the different compliance and governance structures for different classifications of data can cause data to fall through the cracks. Hence, a unified approach is quintessential to proper data management.
The Difficulties in Data Protection
Huge volumes of healthcare data increase the complexities in careful handling, management, retention, and disposal. Personally Identifiable Information (PII) in the healthcare industry is unique for each patient, like a fingerprint. A lot of patient information is stored and maintained by the healthcare industry in the hope of enhancing patient care. Since the move into the era of electronic data sharing, data transfers have been happening faster than what the industry is ready for. Hackers continue to target healthcare organizations to get their hands on the PHI – the price tag for which is reportedly 250$ per record, on the dark web.
Although the aim of stringent regulations is to enable organizations to protect their data, healthcare organizations are finding it very hard to keep up. The advice from experts to manage this is to not start from the regulations. The best place to start is to establish best practices within the organization. If the right steps are taken to protect patient data and to earn their trust, then most of the needs of regulatory compliance is automatically taken care of.
Countries around the world are stepping up their regulations. China for instance has 3 laws – Personal Information Privacy Law, Data Security Law, and Cybersecurity law. The U.S. government has set aside $1 Billion to build a data privacy agency to take care of privacy concerns across the country.
To take a step towards creating a more resilient data protection system within the organization, the following challenges must be addressed methodically:
- Lack of visibility into the data maintained across different facilities
- Patchwork of tools and solutions for security
- Failure to identify current threats within the system
- Usage of old legacy systems which create data vulnerability
- Open-source exchange of critical and sensitive patient data
Recommended Data Security Measures
Understanding what data is collected, how it is used, and where it is stored should be the first step towards data protection. This can be accomplished through data discovery, automated or semi-automated privacy impact assessments, and storing the data that has been discovered as structured data. Unstructured data is difficult to trace and handle and is where data breaches or security issues arise. Creating usability and importance structures for data makes implementing data security measures easier.
The hardest thing for an organization is to protect itself from breaches caused by employees and internal bad actors. Knowingly or unknowingly, it is easier for internal resources to expose/exploit sensitive data. So, one of the most important things to be done is to conduct awareness and knowledge sessions for all employees. They need to know what actions are acceptable and what are not, and that every activity is logged and hence any misuse of data can be tracked and they can be penalized for it. Similarly internal phishing campaigns help in letting people understand safe practices better. The right access is key. For ex: Single Sign-Ons (SSOs) are convenient, but inadvertently they could enable access to someone who is not authorized to do so. Enabling digital identity through MFA (Multi-factor Authentication), IDAM (Identity and Access Management) and PAM (Privileged Access Management) solutions to give the right access to the right people at the right time, and to eliminate possibilities of unauthorized access, is critical.
It is important to routinely evaluate the privacy policies, procedures, security, and governance structures in place. Regular risk assessments including environmental threats and challenges help to take a proactive approach to data security. Appointing a dedicated Data Protection Officer (DPO) is another important step for a more focused effort towards protection. On the same note, ongoing vulnerability assessments, penetration testing for critical applications, and upgrading and patching of systems on an ongoing basis play a key role.
Cybersecurity and data protection need to be part of organizational strategy. It is no longer just the responsibility of the IT team. It really has to start at the top, and the senior management needs to be fully involved in putting the right strategies in place. Implementation of data privacy by design is important to ensure the right levels of controls as relevant to organizational needs. Manual modes can no longer keep up given the complexities of infrastructure, healthcare data, and cyber attacks, and hence the focus should be on finding the right-fit tools and solutions for data privacy and protection.
It all comes down to one thing. Organizations need to ask themselves if their safety measures are enough to protect patient data and safeguard their trust. If the answer to that is a clear Yes, then everything else including regulatory compliance falls in place naturally!
For information on how Long 80 can help with your cybersecurity and data protection initiatives please visit https://www.long-80.com.
Back to blogsSHARE
