# data[].attributes.headline
Electronic Security, Privacy, and Confidentiality 

# data[].attributes.subject
Electronic Security, Privacy, and Confidentiality 

# data[].attributes.body
By Dawn Hannigan  Group #1
Gloria Friar
Candace Duck
Kelly Fogal

# data[].attributes.attachment_link.authors[].name
Office of the National Coordinator for Health IT

# data[].attributes.attachment_link.title
Worried About Using a Mobile Health Device for Work? Here's What To Do!

# data[].attributes.attachment_link.readable_text
Ransomware, external threats, and advanced persistent threats are a few of the key healthcare data security and healthcare IT infrastructure dangers.

Source: Thinkstock

- We've had the chance to discuss all of the amazing new solutions and technologies impacting the healthcare world, as well as healthcare data security.

We know that IoT, telemedicine, and new healthcare services are all affecting the way we deliver care to people all over the world. All these new solutions are great, and they help save lives. But we must also consider potential healthcare data security threats.

These new healthcare services are increasing the amount of data we process through the data center. The latest Cisco Cloud Index report showed that annual global data center IP traffic will reach 20.6 zettabytes (ZB) by the end of 2021, up from 6.8 ZB per year in 2016. And, the global data center IP traffic will grow three-fold over the next five years.

That said, let's switch gears to trust and security in the healthcare world. Despite all of the latest announcements around data breaches and healthcare data security challenges, we as healthcare consumers genuinely want to trust our providers.

In fact, research from Accenture shows that a significant majority of consumers (88 percent) trust their physicians or other healthcare providers to keep digital healthcare data secure. Furthermore, nearly the same percentage of people trusts their pharmacy (85 percent), the hospitals they visit (84 percent), their health insurance company (82 percent) and diagnostic labs (82 percent).

READ MORE: Training Employees to Avoid Healthcare Data Security Threats

Still, having trust in healthcare organizations can sometimes come at a price for both the provider and the consumer. Remember, these organizations are constantly processing digital healthcare data, which may include their Social Security number, contact information, electronic medical record or health insurance ID. And, despite our efforts, this data is still being stolen.

To that extent, it's important to understand some of the biggest security challenges impacting today's infrastructure and data center operations. In the latest AFCOM State of the Data Center report, we found that the top five security and infrastructure threats to respondent are serious concerns across numerous industries. Specifically, these top five threats are:

Ransomware. I'm sure you've heard of a number of healthcare instances where ransomware was a serious issue. To be quite clear, it still is. Web links, and more specifically email, have been huge threat vectors when it comes to ransomware. It's absolutely critical to control user devices, how they connect, and the types of links users are clicking on. When it comes to ransomware, you can employ good security at the border and for user devices. Email security, next-generation firewalls, and even web security gateways can all help with ransomware threats. However, if you find yourself in the ransomware boat, here's a tip: Whatever you do, try your very best NOT to pay the ransom. Try to rebuild the files. Look for an available encryption decoder; many forms of ransomware have been successfully decrypted. Work with security partners to help you mitigate the spread of the attack and possibly help you recover the data.

Outside threats (human). Whether it's malicious or not, people are a threat. These threats come from a doctor who accidentally clicked on a link while using a corporate device. Or, it might be a malicious attack against a healthcare system. Both are dangerous and both can have serious repercussions. Make sure to leverage good technologies which can interrogate devices trying to connect and even work to isolate network connections. Most of all, follow the flow of data. We'll touch on this in a minute.

Advanced Persistent Threats (APTs) - Theft of IT and Corporate Data. Preparing for APTs is like saying "expect the unexpected and be ready for anything." Theft of IT or corporate data can mean everything from a lost physical stolen laptop to someone downloading a sensitive spreadsheet onto a thumb drive and simply walking out. To say that you can cover all of your bases would be foolish. I have yet to find the silver bullet that can overcome some of the most advanced threats out there. However, you can mitigate your risk and even identify theft quickly. Ultimately, good security practices will prevent simple security errors. Lock your sensitive devices down, track them if needed via tools like Bluetooth beacons, and ensure that your endpoints are locked down as well. Prevent anyone from inserting USB keys unless cleared by your IT team. To combat APTs, you'll need to employ a few strategies; ones that revolve around both physical and logical requirements.

READ MORE: Prioritizing Data Security Strategies for Health IT Infrastructure

Loss of PII/PHI. Losing patient information in any amount is never a good event. However, it's going to happen. Remember, the value of healthcare data continues to increase. In fact, the value of healthcare data is higher than any other industry. Ponemon Institute recently calculated the average healthcare data breach costs to be $380 per record. While the average global cost per record for all industries is $141, healthcare data breach costs are more than 2.5 times that the global average. Financial services came in second with $336 cost per record. Knowing this, it's absolutely critical to work with solutions which help monitor data loss, help with incident detection, and even help with advanced endpoint security (like endpoint detection and response). Most of all, know where all of your data repositories reside and how they're secured. Oftentimes, loss of data comes from poorly secured systems, machines, and data storage practices. Furthermore, there are always challenges in how you allow employees to store data on their personal devices. Remember, good mobility and BYOD security practices can really help reduce data loss threats.

Distributed Denial of Service (DDoS) Attacks. This made the top five and is actually a legitimate threat. There's a saying when it comes to designing modern service level agreements: "Slow is the new down." So, even if your systems are "up," if they're performing poorly, they're as good as useless. If you're a large healthcare provider, leverage DNS services which can help mitigate and even quickly resolve any kind of DDoS attach. Furthermore, you can place your most critical applications behind web application firewalls (WAFs). This helps secure your apps from various types of threats and even DDoS attacks.

Healthcare organizations are a constant target. As we continue to deliver new types of services, healthcare data will only grow in value. This means that security leaders must always see the big picture when it comes to security and work with good technologies which meet specific needs.

The best piece of advice I can give you is to work with both IT personnel and healthcare providers when creating a security strategy. The last thing you want is a monolithic or rigid security architecture which disenfranchises, potentially, both the doctor and the patient. I've found success in testing systems out with champion groups and focusing on improving healthcare workflow, while still leveraging security solutions.

Whether you're trying to secure an email system or design some kind of secure file storage platform, know that there are good technologies and partners that can make this entire journey easier. At the very least, never be afraid to test and pilot new security solutions as long as they align with your workflow and healthcare delivery services.

# data[].attributes.attachment_link.title
Top 5 Healthcare Data Security, Infrastructure Threats

# data[].attributes.attachment_link.description
Source: Thinkstock - We've had the chance to discuss all of the amazing new solutions and technologies impacting the healthcare world, as well as healthcare data security. We know that IoT, telemedicine, and new healthcare services are all affecting the way we deliver care to people all over the world.

# data[].attributes.body
Do not use personal information.
Change passwords regularly.
Do not use real words.
Create longer passwords.
Modify easy-to-remember phrases.
Use different passwords for different accounts.
DO NOT WRITE THEM DOWN.

# data[].attributes.attachment_link.readable_text
It's a fast-rising problem that could prove to be a further compliance nightmare for already besieged healthcare facilities: Internet of Things-networked medical devices which, if not data-encrypted, could easily be hacked and data-dumped by exploitative cybercriminals. According to a January 2016 Gartner Report, by 2020 there will be 26 billion devices connected to the Internet via the Internet of Things (IoT). A significant portion of those objects will be medical devices, which, further studies revealed, can be easily hacked by seemingly ubiquitous and ruthless hackers determined to make healthcare facilities pay for simply being - so hackable? In fact, hacking hospital devices has gone on for years, and has become so prevalent that it now has acquired its own term: medjacking, a.k.a. medical device hijacking.

According to Security Metrics, there are four main groups of networked medical devices capable of being Internet-connected. These four groups are:

Consumer health monitoring, like FitBit

Stationary devices, like chemotherapy dispensaries

Wearables (e.g. portable insulin pumps)

Embedded devices (e.g. pacemakers)

Stationary medical devices are the most targeted group, and include everything from X-ray scanners to MRI machines to CT scanners to LASIK surgical devices, blood gas analyzer, dialysis machines, and more commonly-used hospital care devices.
Statistics, and The Dark Net Connection
Another important statistic related to the cyber threat to networked medical devices is one reported by the HHS: 78 percent of physician practices involve electronic medical records systems (EMR/EHR). EMR (electronic medical records) systems, in particular, are especially vulnerable to hacking. And, hackers are well aware that patient medical data is worth roughly 20-50 times more than credit card data. Why? Apparently, the patient data is worth big bucks on Dark Net, a Web sub-culture or black market where such data is used by subversives and criminals in an opportunistic, exploitative way.
The Medical Hacking M.O.
We've already seen what motivates hackers to do what they do. But, how do they do it, and with such stealth and ruthlessness, you ask? With medical hijackings, a.k.a. medjackings, well-trained hackers can quickly penetrate the often weak cyber defenses of healthcare facilities, establishing a command and control "hold," which they use as a pivot point to then expropriate medical data institution-wide. Once having hacked inside healthcare networks, the cybercriminal can then set up a backdoor for himself for later access and infect systems so they remain vulnerable to future attacks.
How to Prevent Medjacking
According to a TrapX Security Report, targeted attacks on hospitals and clinics and their medical equipment are expected only to increase in the coming years, with IoT devices to be the favorite targets of hackers, likely. Here are some medjacking prevention tips for medical facilities based on the TrapX security report:

Remediate (reset or encrypt passwords) on existing devices - especially if you've already been targeted by cybercriminals.

Deploy manufacturer-prescribed fixes for both hardware and software

Have a complete HIPAA compliance evaluation and overhaul

Only utilize those medical device makers who value cybersecurity at least as much as they do sales

Employ effective access management, especially via USB ports

Establish secure network zones for medical devices, and isolate them behind dedicated internal firewalls and IP address-specific services

Securely wipe retired devices of patient data before hardware upgrades

And remember, if your medical devices aren't protected from hijacking and exploitation, that means your organization isn't safe from HIPAA compliance violations, either. A complete IT network review and overhaul by professionals is also a good way to stay in compliance and safe from medjacking.

# data[].attributes.attachment_link.title
Internet of Things-Networked Medical Devices a Looming Compliance Liability

# data[].attributes.attachment_link.description
It's a fast-rising problem that could prove to be a further compliance nightmare for already besieged healthcare facilities: Internet of Things-networked medical devices which, if not data-encrypted, could easily be hacked and data-dumped by exploitative cybercriminals. According to a January 2016 Gartner Report, by 2020 there will be 26 billion devices connected to the Internet [...]

# data[].attributes.attachment_link.title
Electronic Health Records: Privacy and Security

# data[].attributes.headline
We as nurses are a key part in protecting our patient’s confidential information!         

# data[].attributes.subject
We as nurses are a key part in protecting our patient’s confidential information!         

# data[].attributes.body
Situational awareness, handling documents, managing our own access to electronic systems and working as a team are so important in maintaining HIPAA privacy rules.

# data[].attributes.attachment_link.title
The Role of Nurses in HIPAA Compliance, Healthcare Security

# data[].attributes.attachment_link.description
Nurses deal with private information all day every day, from nursing stations and offices to exam rooms to patient bedsides to operating rooms. However, due to their focus on a patient's health and their constant contact with patient data, many may become desensitized to the importance of HIPAA compliance and protecting the digital and physical paper trail.

# data[].attributes.headline
"Password strength requirements, single sign-on controls, and locking accounts after too many failed login attempts are the three primary risks around user authentication. These include generic password use, physically posting passwords on a workspace, and or unencrypted emailing of credentials over external networks, among others."

# data[].attributes.subject
"Password strength requirements, single sign-on controls, and locking accounts after too many failed login attempts are the three primary risks around user authentication. These include generic password use, physically posting passwords on a workspace, and or unencrypted emailing of credentials over external networks, among others."

# data[].attributes.body
USER AUTHENTICATION MOST COMMON CYBER RISK FOR HOSPITALS, HEALTH SYSTEMS

According to Clearwater Cyberintelligence Institute, the most common cyber risks that healthcare systems are facing are user authentication deficiencies, excessive user permission, and endpoint leakage. User authentication and the various levels of access to a network topped the list for vulnerabilities; single sign-on accounts, passwords strength requirements, and locking accounts after too many attempts to login are the three primary risks in this category. These risks means the organization is at a greater risks for flaws within the organizations

# data[].attributes.attachment_link.readable_text
Excessive user permissions and endpoint leaks round out the top three security vulnerabilities found in health systems and hospitals by Clearwater CyberIntelligence Institute.

- User authentication deficiencies, endpoint leakage, and excessive user permissions are the three most common cyber risks facing health systems and hospitals, according to new data from Clearwater CyberIntelligence Institute.

The report reflected similar findings in a recent Crowe analysis that found access management will be one of the biggest health IT risk concerns across the healthcare sector in 2019.

Clearwater researchers analyzed data from by IRM Analysis, a database of millions of risk records accumulated over the last six years from NIST-based risk analyses of Clearwater customers. The data focused exclusively on risk profiles of hospitals, Integrated Delivery Networks, and business associates.

The researchers found the top three vulnerabilities accounted for nearly 37 percent of all critical risk scenarios. User authentication deficiencies topped the list, consisting of weaknesses in both identifying the user and verifying the level of access to an organization's network.

Password strength requirements, single sign-on controls, and locking accounts after too many failed login attempts are the three primary risks around user authentication. These include generic password use, physically posting passwords on a workspace, and or unencrypted emailing of credentials over external networks, among others.

Authentication flaws are deemed critical, as it means an organization lacks the necessary security controls that would reduce the likelihood the flaw could be exploited, the researchers explained.

Servers and Software-as-Service tools are the media types most frequently associated with the vulnerability. Researchers suggested the organizations can reduce the risk by understanding the gaps in the security controls related to user authentication and the percentage of risks around the flaw, as the controls are highly effective in reducing the risk of exploitation.

Also notable: 90 percent of organizations reported having password or token management policies and procedures, but the organization lacked the technical implementation to render the tool useful.

"A discrepancy between policy and technical implication can put organizations at significant risk for civil monetary penalties in the event of breach-related investigation," the researchers wrote.

To shore up some of these risks, the researchers recommended hospitals and health systems ensure a risk analysis has been performed around user authentication deficiencies. Officials should make sure the controls have been properly implemented, while assessing whether the risk ratings associated with the controls seem accurate.

Further, the providers should ensure remediation plans are in place around user authentication deficiencies.

"Hospital executives should direct their immediate attention to these three top vulnerabilities and consider action to reduce their organization's risk profile," Jon Stone, ClearWater CCI Leader and Senior Vice President for Product Innovation, said in a statement.

"It is critically important that hospitals and health systems evaluate their organization's information systems to determine their specific risk ratings on these three critical vulnerabilities and take the necessary steps to close any gaps," he added.

# data[].attributes.attachment_link.title
User Authentication Most Common Cyber Risk for Hospitals, Health Systems

# data[].attributes.attachment_link.description
User authentication deficiencies, endpoint leakage, and excessive user permissions are the three most common cyber risks facing health systems and hospitals, according to new data from Clearwater CyberIntelligence Institute. The report reflected similar findings in a recent Crowe analysis that found access management will be one of the biggest health IT risk concerns across the healthcare sector in 2019.