According to the 2018 Protected Health Information Data Breach Report (PHIDBR) from Verizon, cybersecurity in healthcare falls behind other industries in being able to protect personal information.

The report, which included the evaluation of 1,368 cybersecurity incidents from 27 countries, delves into the cybersecurity of healthcare following the Data Breach Investigations Report (DBIR). The PHIDBR includes findings on what cased cybersecurity incidents, what types of incidents are most common, and solutions to improving the privacy and security of patient data.

Findings included:

• 21 percent of cybersecurity incidents occurred because of stolen laptops that contained unencrypted patient data.
• 70 percent of cybersecurity incidents with malicious code were classified as ransomware attacks.
• 58 percent of cybersecurity incidents in healthcare involved insiders. Insiders were found to endanger data for financial gain (48 percent), fun or curiosity in reading personal records (31 percent) and convenience (10 percent).
• 27 percent of security incidents involved patient health information on paper records. Breaches of patient information from paper records are more prevalent in the healthcare sector. The main causes included sensitive data not being delivered correctly (20 percent), thrown away without shredding (15 percent) and lost paper documents (8 percent).

Solutions to improving cybersecurity included:

• Full encryption: These services are effective and low-cost ways of protecting patient data.
• Continuous monitoring of who has access to records: Cybersecurity polices should be required to the monitoring of patient health record access. Training employees and adopting warning banners could reduce incidents causes by internal factors.
• Develop preventative measures: Adopting measures to combat ransomware attacks and malware would prevent devices from being hacked and patient health records from being accessed.

Records containing personal health information (PHI) and personally identifiable information (PII) were found in the recycling at five different hospitals, according to a study published March 20 in JAMA.

In this study, led by Nancy Baxter, MD, PhD, at the University of Toronto, researchers audited five teaching hospital in Toronto form November 2014 to 2016 for the amount of PII and PHI disposed in recycling bins.

Although all five hospitals had policies for paper disposal, researchers found documents containing PII and PHI in the recycling of all hospitals. Of the 2,687 documents with PII and PHI information, 802 were low sensitivity, 843 were medium and 1,042 were high. Most documents were found at physicians’ offices with clinical notes, summaries and medical report being the most frequent type of PII document being discarded.

“A substantial amount of personal information, most of it PHI, was found in the recycling at 5 teaching hospitals in Toronto, Ontario, despite institutional policies in place for protection of personal information. Little is known about the prevalence of privacy breaches in hospitals,” wrote Baxter and colleagues. “Studies have focused primarily on privacy risks related to electronic records; however, migration to the EHR may have heightened risks of other privacy breaches. The frequent presence of PII and PHI in recycling at these institutions indicates potential privacy breaches is not isolated. [It] should be expected in locations where patient information is printed and there is an option for nonconfidential paper disposal.”

Healthcare cybersecurity insurance claims in 2017 measured 17 percent of total claims but was responsible for 28 percent of total breach costs, $65 million of $229 million, according to the 2017 Cyber Claims Study by NetDiligence.

Healthcare cybersecurity insurance claims in 2017 made up 17 percent of total claims—but accounted for 28 percent of costs related to breaches, roughly $65 million of a total $229 million, according to the 2017 Cyber Claims Study by NetDiligence.

The study analyzed 103 cyber liability insurance claims pertaining to healthcare. It aimed to provide risk management professionals with insight into how data insecurity is affecting the industry.

Key findings included:

• The average number of records exposed in a healthcare breach was 1.6 million.
• Healthcare claims comprised 17 percent of claims in the 2017 dataset and 28 percent of total costs.
• Breaches that exposed protected health information (PHI) averaged 386,000 in 2017, while breaches of personally identifiable information (PII) averaged 5.2 million.
• The total average breach cost for PHI was $475,000 in 2017, while average cost for PII was $1.85 million.
• The median per-record cost in healthcare was $28, lower than the $47 in other sectors. However, the amount of large settlements made from very few records increased the average per-record cost for healthcare.
• Costs for average total crisis services were three times higher for healthcare than other sectors.
• Average legal settlement costs were 40 percent of the combined average of all other sectors, $116,00 versus $260,000.
• Criminal acts exposed 80 million PII and 17 million PHI records, leading to healthcare having the highest total notification ($37.1 million) and credit/ID monitoring ($6.6 million) costs.
• Stolen unsecured laptops with unencrypted hard drives averaged $37,000 in costs.

Privacy and security concerns are linked to reduced patient access of health records and trust in health information technology (HIT). Findings were published April 11 in the Journal of Medical Internet Research.

In this study, researchers examined the effectiveness of HIT by looking at information assurance issues such as privacy concerns and trust in health information.

“Today, the healthcare industry primarily relies on HITs such as electronic medical record (EMR) systems, patient health record (PHR) systems, and technical devices to deliver patient care services,” wrote first author Victoria Kisekka, PhD, and colleagues. “Despite the continued diffusion of HITs within the health care sector, there is no theory explaining how HIT success influences perceived patient care quality.”

The study included data from 3,677 cancer patients from a public dataset. Researchers examined the data for correlations between information assurance and attitudes toward health information exchange (HIE), patient access to health records and perceived patient care quality.

Results showed increased privacy concerns of HIT reduced the frequency patients accessed their health records, positive attitudes toward the HIE and perceptions of patient care quality. However, the belief in the effectiveness of security increased patient access to health records and positive attitudes toward HIE. Trust in health information also had a positive correlation with perceptions of HIE and care quality.

“Trust in health information and belief in the effectiveness of information security safeguards increases perceptions of patient care quality,” concluded Kisekka and colleagues. “Privacy concerns reduce patients’ frequency of accessing health records, patients’ positive attitudes toward HIE exchange, and overall perceived patient care quality. Health care organizations are encouraged to implement security safeguards to increase trust, the frequency of health record use, and reduce privacy concerns, consequently increasing patient care quality.”

Social network sites (SNSs) facilitate communication between healthcare professionals, but they are limited in protecting data, according to a study published in the Journal of Medical Internet Research.

SNSs can aid physicians in reaching patients, but research into their benefits and limitations in communication between healthcare professionals is lacking. In this study, researchers evaluated the utilization of SNSs for communication between health professionals in frontline clinical practice, professional networks and education and training.

Researchers evaluated literature published within the past 10 years in different databases. Searches were conduct with terms including social media, social network, Facebook, Twitter, WhatsApp, WeChat, health or health profession. Of the 33 works in this study, the majority were surveys (25) with six interviews.

All of the analyzed studies stated SNSs had improved communication and information sharing between professionals. Benefits for SNSs included network building, collaboration and educational interactions. However, limitation in SNSs included technical knowledge, concerns on data protection, privacy and liability and concerns about professionalism.

“As the growth of SNSs is expected to rise, health professions should have a better understanding of how to attain secure and appropriate use of these platforms,” concluded first author Windy Chan, and colleagues. “Formal training should be provided to health professionals for the safe use of SNSs. Although not much mentioned in the included papers, a practical issue that should be given attention is how the SNS companies manage, analyze, repurpose or even disclose the data and content of communication. Health service institutes and providers must consider carefully in using SNSs for communicating confidential data to avoid jeopardizing patient privacy.”

In a March 8 session at HIMSS 2018 in Las Vegas, Kevin Charest, chief information security officer of the Health Care Service Corporation (HCSC), outlined the five pillars of its cybersecurity program.

In the session, Charest offered insight into improving cybersecurity. Keys included identifying barriers in building a cybersecurity program and accessing an existing cybersecurity program. Professionals also need to determine how to improve an existing programs and measure effectiveness.

Charest stated effective cybersecurity must move at the speed of business and drive digital transformation with continuous evaluation. It also needs to be fully integrated to enable and protect business innovation.

Charest outlined the five pillars of HCSC’s cybersecurity program:

1. Governance, risk and compliance: Set the organization’s security strategy and enable governance functions to manage security risk. Policies needs to evolve to address changing risks in the IT environments. Additionally, specified employees training, including gamification and phishing, is needed to build an organization’s ability to quickly adapt to disruptions while maintaining continuous business operations and safeguarding patients, assets and reputation.
2. Security architecture and engineering: Design and engineer security solutions to protect enterprise from known and potential risks and threats. Build and enhance technical security investments, ensuring expected business value and risk reduction are achieved. This is done by delivering cybersecurity engineering in an agile manner to establish solutions that are resilient, flexible and efficient. Confidentiality and integrity of data needs to be secured through standardization and automation.
3. Information security operations: Manage and operate security solutions to help detect security vulnerabilities and events that pose risks to the enterprise. Use an in-house, out-sourced or hybrid approach. Include platform management, operational process and standards enforcement, threat and vulnerability lifecycle management and operational metrics.
4. Cyber defense operations: Respond, investigate and remediate incidents and potential breaches while enhancing architecture and operations through continuous feedback. Restrict pivots through host-based security tools and system hardening and lateral movement with network segmentation and choke points. Identify activity, correlate malicious activities and identity anomalous or abnormal use of accounts and systems. Quarantine the compromised area of the network, prevent exfiltration of data, eradicate the threat and resume normal business operations.
5. Business engagement: Incorporate cybersecurity into everyday business decisions processes and interactions with the customer. The cycle of engagement includes understanding customer needs, leveraging operational resources and feedback to IT and business groups.

While electronic health records (EHRs) have improved the safety and quality of patient health information, the shift from paper to digital interfaces has introduced a new set of barriers that may contribute to patient harm.

An infographic published by the Pew Charitable Trusts outlines five usability issues that harm patients and two recommendations in making EHR use safer.

Usability issues included:

1. Alert fatigue: Ignoring of alerts, due to the overwhelming number of them, could cause clinicians to overlook important lifesaving alerts.
2. Unintended consequences of customization: Some healthcare systems have implemented a customized version of EHRs to fit workflow, but these customized systems may have missed the proper testing and could harm patients with unnoticed security concerns.
3. Auto refresh mix-up: Sorting patients by last name or bed number gives clinicians a view of the patient’s profile fasters, but auto refreshing can bring back default settings and leave clinicians accidentally making medical decisions for the wrong patient.
4. Unclear default settings: The default settings on medication dosages could lead to clinicians to giving patients the wrong amount of their prescriptions.
5. Incomplete lab results: Lab results in EHRs can be displayed while not all the findings have been sent in, leaving clinicians in the dark about some patient results and making a medical decision without all the facts.

Recommendations for improved EHR usability included:

1. Health information technology safety collaborative: A safety collaboration with stakeholders regarding interoperability and patient data safety could result in solutions for common and complex usability issues.
2. Safety testing during development and after implementation: Continually testing the EHR system, before and after implementation, would ensure a level of safety for developers and clinicians.