Believe it or not, your medical record has the potential to be sold for thousands of dollars. And due to the digitization of health records, it’s now more prone to theft.
As more patient health records have gone digital over the years, they’ve become vulnerable to hackers—and far more valuable than credit-card data or other forms of confidential data.
Why? Because they contain insurance information that poachers can use for fraudulent billing and illegal prescriptions. These thieves can falsify insurance claims and collect checks and obtain hundreds of thousands of dollars in free care on someone else’s insurance.
The healthcare industry wasn’t prepared for this, and they are trying to play catch up to secure protected health information (PHI):
“The U.S. has a huge shortage of highly qualified cybersecurity people across all industries,” says Rod Piechowski, a senior director at the Healthcare Information & Management Systems Society, or HIMSS, a Chicago-based nonprofit with more than 50,000 members. “Being late to the game, health care just can’t compete.”
Health IT professionals, although they are in great demand, haven’t been able to play a major role in employer’s’ software procurement decisions. This is unlike banking and the financial industry where their option is regularly solicited before a major IT system is implemented. And until recently cybersecurity wasn’t prioritized in healthcare the way it has been in financial services. The result is that IT professionals had no influence when it came to software security standards for medical care, and now they’re having to oversee systems that are difficult to safeguard.
If your PHI is breached, hackers have the information they need to blackmail you for the rest of your life. That’s because your EHR contains information like conditions you suffer from such as depression, anxiety or other psychological conditions, sexually transmitted diseases, or heart conditions. If released to the public, these might be an embarrassment to you or even keep you from obtaining a particular position.
How Bad Is It?
EHRs (electronic health records) are being used by over 96 percent of critical-care facilities, and 83 percent of all hospitals. While the digitization of health records enables easy access to patients’ information, if not properly safeguarded they’re also available to hackers. This poses a real threat to patient privacy.
In the year 2016, there were 450 data breaches where 27 million EHRs were affected. Of these, 120 came from the outside, while 200 (more than 65%) came from the inside.
In 2017, there were 477 healthcare breaches reported to the U.S. Department of Health and Human Services (HHS) or the media, which affected a total of 5.579 million patient records.
With major hospitals and healthcare organizations paying higher fines for lost patient data, the challenges of maintaining EHR security remains a huge concern. And because of this, the benefits of using them must be weighed against the risks of theft and misuse.
Presence Health in Chicago was fined USD475,000 by the U.S. Health and Human Services (HHS) because they didn’t report a 2013 breach in a timely manner. Advocate Health Care had to pay HHS a whopping USD5.5 million for a breach of patient privacy–the most ever by a single entity.
Compounding the issue, now physicians who are frustrated with the bogged down systems try to design their own workarounds to speed up processing of healthcare data. These ad hoc “shadow IT” systems are insecure and rely on unencrypted data and personal emails. It’s only a matter of time before a sophisticated hacker breaks in to steal their data.
How do hackers obtain medical records?
One of the ways they do this is through spoofing where the facility is fooled into thinking that the person accessing the information is legitimate. Plus, Microsoft researchers warn that many types of databases used for electronic medical records are vulnerable to leaking information despite the use of encryption.
Hospitals and healthcare organization use methods like data encryption and the scrambling of PHI (de-identification) to disguise data so hackers can’t read it. However, the hackers simply steal the data and replace the encryption keys with their own to demand ransoms to unlock the data. This is called ransomware, and it’s very effective against healthcare facilities and hospitals that need ready access to patient data for their everyday operations.
Who are these hackers?
They’re not who you think they are. When we think of hackers, in our mind’s eye they are guys in hoodies working on computers in their parents’ basements. What’s hard to believe is that most attacks and data breaches don’t come from external hackers, but from the inside of an organization, where doctors, nurses or accounting personnel are negligent, abuse the system as disgruntled employees, or steal patient data for financial gain. In 2017, employee error affected 785,281 patient records and insider-wrongdoing affected 893,978.
One Promising Solution
Robert Lord, a former analytics systems designer, joined forces with Nick Culbertson, a former Special Forces operator when they were students at the John Hopkins University of Medicine. They created an Artificial Intelligence (AI) system to combat hacking of EHRs. They co-founded a cybersecurity company Protenus, to help the healthcare industry use artificial intelligence to prevent the theft of Protected Health Information and Electronic Health Records.
“Your EHR contains all of your demographic information–names, historical information of where you live, where you worked, the names and ages of your relatives, financial information like credit cards and bank numbers…The medical record is the most comprehensive record about the identity of a person that exists today. We recognize that EHRs are living documents, so we’ve built an AI that is able to monitor how individuals interact with the EHR and associated systems, building a unique profile of every workforce member’s clinical and administrative workflow.”
The folks at Protenus are working on a solution that can tell the difference between routine access to EHRs or possible illegal attempts to retrieve this data. They do this by detecting unusual patterns and anomalies using AI that are then escalated to security officers. Over time, the solutions get “smarter” and learn exponentially as the customer base grows.
We’re Behind the 8 Ball When It Comes to Protecting EHRs.
Health care has lagged far behind banking and other industries when it comes to implementing security protocols. Until EHR records were mandated by Obamacare, many healthcare providers still used paper, faxes and handwritten charts. And once EHRs were finally implemented, the hackers were already a step ahead, and the medical industry is still scrambling to find ways to protect them.
Cybersecurity experts tell us that the seriousness of this can’t be overstated. The frequency of threats has taken off in the past 10 years as EHR data is increasingly networked between healthcare entities. And as we continue to struggle to secure our EHRs, increasingly savvy thieves are finding more ways to steal them.