Securing Electronic Health Records: What’s at Stake?

While the principle of doctor-patient confidentiality has always been regarded as sacred, the digital age has inevitably led to greater ease of access to all information, including confidential patient health records.

Cybercriminals have aimed their sights at the healthcare industry as this industry holds very sensitive information that’s not limited to just health information. Healthcare organization hold other forms of sensitive information such as a patients billing address, social security number, and credit card information. This leaves patients susceptible to all kinds of fraud and forms of misuse.

Verizon’s recent Protected Health Information Data Breach Report found that 58% of breaches involved insider threats, making healthcare the only industry whose internal actors pose a greater threat to the organization than outsiders. The report also found that ransomware is the top malware of choice by attackers, with 70% of incidents involving malicious code being ransomware infections.

As patients continue to be left defenseless to fraud and theft, it’s imperative that organizations working with patient information understand they are subject to HIPAA compliance and will be held liable for compensation in the event of any breach of confidentiality.

Protecting electronic health records starts by applying security best practices to establish a solid security foundation, such as the CIS Controls. The next step is to ensure that any and all unauthorized changes that occur within your IT environment are recorded, with details on exactly what changed, who made the change, and when the change was made.

By applying NNT’s intelligent Change Control technology, your organization is able to track and analyze changes to the integrity of your systems based on contextual information and associated risk, all while leveraging self-learning whitelisting techniques and threat intelligence to reduce change noise and spot genuinely suspicious activity.

Finally, use dynamic policy and baseline management to constantly adjust your system integrity to the most up to date, secure and compliant state based on checked, approved and authorized changes as they occur.