Tausight
Healthcare Data Vulnerabilities, Cultural Openness, and Changes Needed

Exciting advances in technology have enabled spectacular improvements in patient care and the accessibility of health care providers to their patients and to critically important data. The last decade has seen the vast dissemination of tools that allow remote access to patients and their families, to electronic health records and diagnostic tools and to personal and clinical data. Moreover, the “internet of things” has allowed devices and equipment to send clinical information throughout institutions and to connected individuals locally and globally. As we learned even more extensively during the pandemic, the remarkable convenience of having information everywhere allows providers and institutions enormous flexibility in how they work and in their ability to meet patients where they are-in an institutional setting, at home or work, or, with some restrictions, even when they are far away. This enhanced access allows providers to perform multiple tasks asynchronously and/or at their own leisure. This has given us the gift (and, for some, the burden) of a highly skilled remote workforce that is essentially available 24/7 and that can expect to be empowered through data.

Unfortunately, the wonder of this digital transformation is severely tainted by the modest investments that we have made to protect the systems that we continue to build. As a result, our most precious personal secrets and our most valuable individual data are easily vulnerable to malevolent and predatory criminal interests.

The healthcare industry is experiencing a seismic increase in the frequency and severity of cyber-attacks: In 2023, the medical records of nearly 100 million Americans have been exposed illegally (source). Regulatory discipline, fines and class action suits pale relative to the potential loss of trust of our patients and our providers. As a former system and hospital CEO and trustee, it’s clear that cybersecurity is not only the purview of the IT or security department, it must be a priority for every hospital executive and board member.

The maturity of our efforts to protect personal health information (PHI) and other critical data lag far behind other industries. Banking, government and legal services have invested massively in cybersecurity. These industries focus on managing their data, centralizing it to a secure location, controlling devices via locking them down and changing the nature of access to the network. More than a decade ago, I began eight years of service on the Board of the Federal Reserve Bank of Boston. Even then, the Fed’s herculean efforts to protect our currency, our financial transactions and our information, for the government, as well as for the entire financial services industry, were far more advanced than the efforts currently in place and required in health care. Is health care’s mission and the human condition less worthy?

The challenge is that healthcare delivery is designed to be part of the community it serves, without real barriers to entry, every day, around the clock. That openness is intended, perhaps inadequately, to reflect an institution’s welcoming nature and inclusiveness. In a digital environment, there is increasing pressure on clinicians to be completely transparent and to respond almost instantaneously to the data that are now at their fingertips. These factors create significant vulnerability.

Traditional cyber approaches clearly are not working. We need to reimagine healthcare information security in a world of producers and protectors of data. A data-first approach needs to be considered in order to fundamentally transform how patient information is protected.

If we can fight cybercrime with some of the same passion that we fight disease and disability, we can make a sustainable difference

This new approach needs to combine a culture change with a technology change. When health system CEOs or operating officers sit with IT advisors, the security recommendations might feel alien to the healthcare ecosystem, as any intervention that further interrupts clinician workflows will severely burden providers and disrupt the provider/patient relationship. As we have done in efforts to improve patient safety, we need to create nearly seamless, clinician friendly approaches, where everyone who touches a keyboard (or a voice activated interface), is a well trained and empowered steward whose great skills and vigilance will reduce our collective vulnerability to cyber vandalism and attack.

This change in culture needs to be combined with technology that identifies and protects sensitive data as they are created, moved and stored - within the clinical workflow. As a board observer at Tausight, I’ve been so impressed to see how a new and greater awareness of PHI and data risk has energized health care leaders and their boards to prioritize these issues as they build their strategies. If we can fight cybercrime with some of the same passion that we fight disease and disability, we can make a sustainable difference.