Healthcare Breaches Up with Each Record Worth $363

It’s probably not much, if any surprise that the healthcare industry is a big target for hackers. In fact, these types of attacks have increased by 125% since 2010, according to the Ponemon Institute. These organizations also report that 91% of them have experienced at least one breach, costing them over $2 million, on average, per organization.

Healthcare records are very valuable on the underground market. Each record can be sold for around $363, which is substantially more than a payment card number. Those go for between $1 and $5 each. So when Anthem was breached a few months ago, some cyber-criminal may have gotten rather wealthy off the 80 million people that were affected. And this is not the only recent breach of healthcare data.

Not all breaches are the result of hackers. Some are purely the result of a mistake, such as the Radiology Regional Center in Florida where paperwork intended for shredding somehow ended up in a field. There is also the Centene case, where a bunch of hard drives were missing, but it still isn’t known what happened to them.

It’s important for organizations in this industry to take charge of their network to prevent this type of activity from occurring. Policies and procedures should be put in place and enforced. What good are these if nothing ever happens to those who don’t follow them?

In addition, strict access controls should be implemented. For a given record, it is possible that over 30 people will have access to the patient data. These include the doctors, specialists, pharmacy employees, office staff, and others. Who sees that data should be controlled as much as possible and if someone doesn’t need to see it, he shouldn’t have access to it.

If it’s on a network-connected system, it should be stored with strong encryption. In addition, a monitoring technology will help investigate any breach incidents should they occur. These may provide real-time alerts for any suspicious activity so that action can be immediately taken.

All policies and processes should be reviewed and updated regularly. For most, that means each year. For some organizations, it could be more often. Whatever you choose, just be sure to stick to it. Don’t forget to update it as people depart the organization.

Finally, all employees, staff, and contractors who have access to patient data should be properly and continuously trained on caring for it. There should be a reporting process so that it is easy, acceptable, and non-political to report issues.

Since 2009, these breaches cost somewhere around $50 billion to the U.S. healthcare system. It’s time to put a stop to it. Small steps make a big difference.