Just last week, Bitglass published its latest Healthcare Breach Report that reveals a substantial increase in hacking and IT incidents. This year’s report reveals over 26 million people were affected in healthcare breaches in 2020, a 55.1% increase from the year before. Additionally, on average, healthcare firms took 236 days to recover at a cost of $499 per record breached, tallying a $13.2 billion total expense for organizations.
Each year, Bitglass analyzes data from the U.S. Department of Health and Human Services' "Wall of Shame" database containing information about breaches of protected health information (PHI) that affected 500 or more individuals. The latest report examines breaches that healthcare organizations faced along with the key trends and cybersecurity challenges facing the industry.
We sat down with Kevin Sheu, Bitglass to discuss what the reports findings mean for the industry and healthcare-specific cybersecurity.
Why is healthcare data so valuable to hackers?
Healthcare data is extremely valuable because it typically contains an abundance of personally identifiable information (PII). This data often includes highly sensitive information such as Social Security numbers, addresses, birthdates, medical and employment histories, prescription information, and sometimes financial records. If hackers obtain this highly sensitive information, they can build an entire profile to commit fraud, identity theft, extortion, and more. If online medical systems are compromised or shut down, then it can have catastrophic consequences for patients.
How has COVID impacted healthcare data security practices / what hackers target?
Healthcare organizations have arguably been hit the hardest by COVID. With hospital capacities rising to breaking points and providers scrambling to handle an influx in testing, patient care, and treatment, they’ve been forced to quickly process massive amounts of data. An abundance of data is also now more digitally accessible. This has forced healthcare organizations to bolster online privacy protection practices across the board. Hackers are still continuing to target the same PII, but are now turning their eyes toward COVID vaccination information.
What can healthcare orgs do to better protect their data?
Healthcare organizations must make sure that the proper protocols are well established and that they’re actively protecting their IT ecosystems. Increasing investments in measures like advanced threat protection, data loss prevention, and cloud security posture management will help them bolster security. Education is also imperative, particularly for organizations that may be new to the cloud. Adjusting can be complex and unfamiliar, particularly in the midst of juggling a plethora of new patient data. Taking time to adequately train and educate employees will create a more robust digital defense that works hand-in-hand with the additional security measures protecting the systems.
Where do you see healthcare orgs in the cloud adoption cycle? Will a move to the cloud change their security strategies?
Their sensitive data needs to be handled carefully, and even for those that understand that the cloud is the future, proper precautions must be taken. The pandemic has sped up this process quite dramatically, which has unfortunately led to a significant rise in cyberattacks, with enterprises not adequately prepared for a sudden shift in operations. Now it’s a matter of deploying security measures to ensure these attacks can be properly caught and thwarted. Enterprises need to take a step back, educate themselves on cloud security, bolster defenses, and dedicate a strategic emphasis around a culture of security. The overall goal will remain the same (protect highly sensitive patient information) but the methods will be altered. For comprehensive cloud security measures, organizations typically use a secure access service edge (SASE) platform that ensures consolidated ease of use, cost-effectiveness, and comprehensive security for any interaction between any devices, apps, web destinations, on-premises resources, or infrastructure. This has helped organizations to ensure compliance and appropriate levels of data and threat protection in the midst of sudden digital transformations.
###