Let’s take a look at the top trends likely to have the biggest impact on US healthcare this year.
More data, more risk
The volume of data within the healthcare systems is exploding. Healthcare data is growing at the fastest rate of any other vertical. With compound annual growth rate estimates ranging as high as 36 percent, HIT leaders can expect to secure nearly 10x more data (both structured and unstructured) very soon. Forbes estimates each patient generates 7-34 Petabytes/patient, which projects to more than 10 zettabytes or 10 trillion gigabytes by 2025.
At the same time, the US healthcare system is under active attack – most directly by nation state actors who see health systems as soft targets that are more likely to pay the ransomware. Known advanced persistent threats (APTs) such as Cozy, Venomous, Voodoo and Fancy Bear are associated with FSB and GRU.
These factors have dramatically increased the value of data – particularly electronic protected health information (ePHI). Indeed, ePHI has never been worth more, with the value of ePHI exceeding $1000, according to Experian. The potential damage to patients from stolen medical information is so significant that the FBI purchased records on the dark web associated with congressional members. The damage from ePHI theft goes far beyond monetary returns.
New challenges, new objectives
Today’s healthcare clinicians routinely share patient information – both internally and externally. This unprecedented level of data sharing presents entirely new challenges in protecting healthcare information. The new generation of clinicians that grew up on the Internet are adept at creating, sharing, and moving information -- whether internally or externally, to the cloud, or to private storage, or wherever. The problem with this new paradigm, in which clinicians are constantly cutting and pasting ePHI from one app to another, creates multiple copies of information that is otherwise safely secured.
This new reality has created new security requirements. Recognizing the impossibility of preventing all cyber incidents, U.S. HHS and the National Institute of Standards and Technology (NIST) now recommends a new objective: business resiliency. This new approach focuses on understanding how to get back to business safely following an incident. Business resiliency requires a strategy that builds on prevention, continuous monitoring, and restoring services back so patient care can be delivered quickly and safely.
Enforcement and insurance agencies are increasing the requirements on health systems to audit, track, and report all information relating to cyber issues. If there is a cyber incident, for example, health systems must now comply with new disclosures requirements that increase the burden to audit and retain details to agencies such as the SEC (8-K), Cybersecurity and Infrastructure Security Agency). In addition, health systems must report the incident to the FTC for Personal Health Record disclosures, HHS for its Breach Disclosure as well as to multiple state attorneys general – each of which may require exact details on the incident, the extent of damage, and potential number of individuals affected. Moreover, 8-K filings require a new level of details (within 4 days) that otherwise would be difficult to provide w/o structural changes.
Cyber insurance companies, meanwhile, now require more cybersecurity details following a breach similar to what needs to be reported within an 8-K. This information now has the potential to affect the underwriting of director and officers (D&O) insurance.
The regulatory landscape is tightening around healthcare data breaches. With stricter disclosure and reporting mandates, healthcare systems need robust tracking and auditing mechanisms.
Back to basics
Healthcare IT has a fundamental obligation to protect the confidentiality, integrity, and availability of PHI. This has not changed since HIPAA was first enacted, and has been enhanced by additional NIST and HHS guidelines to clarify best practices. The basics, however still center on the primary requirement outline in the HIPAA Security rule (note emphasis on “all”)
§ 164.306 Security standards: General rules. (a) General requirements. Covered entities and business associates must do the following: (1) Ensure the confidentiality, integrity, and availability of all electronic protected health information the covered entity or business associate creates, receives, maintains, or transmits.
As part of the administrative safeguards the required Security Risk Assessment must be performed:
§ 164.308 Administrative safeguards.
(a) A covered entity or business associate must, in accordance with § 164.306: (1) (ii) (A) Risk analysis (Required). Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business associate.
All this leads to the need for the business to have much better detection and tracking of how ePHI is protected, monitored and audited. Accurate risk assessment is what the healthcare system needs right now to stay abreast of these dramatic trends.
