HIPAA and Data Protection in Healthcare | By: David Stonehill, CTO, NetLib Security

Healthcare organizations face many challenges: they must protect patient privacy, deliver quality care, and meet strict regulations. These organizations, which include medical device manufacturers, are trusted to safeguard incredibly sensitive information, a task that carries immense responsibility.

The healthcare sector remains particularly vulnerable to cyberattacks, given its handling of a substantial volume of Personally Identifiable Information (PII), Protected Health Information (PHI), and Electronic Health Records (EHR). Lacking the necessary expertise to protect this critical data creates a wide-open avenue for significant numbers of potential cyberattacks.

In fact, medical device security has become the weakest link, with half of all connected medical devices in healthcare organizations unmanaged. Due to the Internet of Medical Things (IoMT) devices have a remarkably low barrier to entry. It’s no surprise that attackers are able to exploit inherent vulnerabilities in these unmanaged endpoints. Similarly, while electronic media devices (EMDs) help better manage our healthcare are priceless, they also create a wide attack surface for cyberthieves.

Critical Insight reports that from January to June 2023, there were 308 healthcare data breaches reported to the federal government. While this is a 15% decrease compared to 2022 in the number of breaches, the total number of individuals affected by these breaches has actually increased.

The first half of 2023 saw an average of 131,000 individuals impacted per breach, fueled in large part by the incident at Managed Care of North America which affected 8.9 million individuals and at PharMerica which affected 5.9 million individuals, the third and fourth largest breaches ever recorded, respectively.

The healthcare industry consistently has the second-highest number of data breaches each year, exceeded only by the business sector. However, healthcare has accounted for the highest number of records exposed. This raises a fundamental question: despite the healthcare industry’s reputation for implementing intricate regulations, such as HIPAA compliance, why do so many data breach incidents continue to occur?

Types of Data Breaches in Healthcare

Breaches are most commonly due to:

  • Unsecured Networks – Networks lacking proper security measures can be easily breached, resulting in one of the leading causes of data loss in the healthcare industry.
  • Insufficient Training – Insufficient security training and little familiarity with best practices can lead to errors and vulnerabilities. Employees’ lack of awareness of the impact of weak passwords and of proper security protocols can put the organization at risk of being attacked.
  • Unencrypted Data – Healthcare organizations handle and store sensitive patient information on a regular basis. If this data were saved as unencrypted plain text, hackers could easily access private records through a network breach. That is why it is critically important to encrypt all patient data, so that even if a hacker were to access sensitive data files, the data contained within would be useless.
  • Malicious Software – Hackers can use malicious software, such as ransomware and viruses to infiltrate the networks of healthcare organizations and gain access to the healthcare organizations’ networks.

What happened in 2023 cybersecurity breaches?

In the case of Managed Care of North America (MCNA), a dental insurer, investigators determined that an unauthorized third party was able to access certain systems within its IT network between February and March of 2023. The attack gave them access to full names, Social Security numbers, insurance information, licenses, and dental/orthodontic care details.

The PharMerica Corporation was also attacked by hackers in March. Cyberthieves entered the network and may have stolen personal information like names, Social Security Numbers, medication details, and insurance information. PharMerica says it has implemented additional technical cybersecurity safeguards to prevent similar incidents in the future. Nevertheless, this was the largest healthcare data breach to be reported by a single HIPAA-covered entity in 2023.

How do we protect against attacks like this? Are there guidelines? Procedures? The answer is yes – outside of user awareness and training, there are strict guidelines from HIPAA Compliance.

So what does HIPAA encompass and how do you know if you’re compliant?

What is HIPAA?

If you work in healthcare, you’ve probably heard the term HIPAA (or Health Insurance Portability and Accountability Act). In 1996, a law was passed that required a combined effort between the U.S. government and healthcare companies that work with sensitive patient health information. It required organizations to implement and follow a required set of encryption security standards against breaches for electronic protected health information (ePHI). HIPAA mandates encrypting all data at rest, and ePHI necessitates AES-128 or stronger encryption for safeguarding sensitive information.

HIPAA compliance in 2023

New HIPAA regulations are enacted fairly frequently; however, in recent years the changes have had minimal impact on HIPAA Compliance. The last major update was back in 2013 when the HIPAA Omnibus Final Rule was introduced by the Department of Health and Human Services (HHS), which changed the breach standard from a “significant risk of harm” to a “probability that data was compromised.”

These rules had not been substantially updated to keep up with the big changes in technology as well as cyber-criminal activity since that time. In April 2023, HHS issued proposed changes to the rule to help further protect PHI data and privacy. The changes to Final Rule are expected to go into effect by the end of 2023.

What is changing?

  • Right to access – this new rule expands the right for patients to inspect and take notes of their PHI, including taking photos. The response time for PHI requests has been reduced from 30 to 15 days.
  • Information sharing and care coordination – this new rule enables patients to make a request to providers to share their EHR with other providers/insurers when necessary.
  • Notice of privacy practice – this piece of the update aims to ease the administrative pressure by modifying the requirement that mandates providers obtain a patient’s written acknowledgement of their notice of privacy practice.

For more information on the proposed modifications to the HIPAA Privacy Rule check out this Fact Sheet from the HSS. From a technology standpoint, you will need to know exactly where your patient data is. How do you prepare for this? Assess your compliance and diligently fill in any gaps you find.

Encryptionizer’s Role in HIPAA Compliance

Those in the healthcare industry must take HIPAA compliance seriously. Not complying may result in significant fines. In the worst case scenario, a facility may have to shut down and cease admitting patients. Maintaining compliance with healthcare regulations is one of the best ways to prevent a data breach.

Safeguard your reputation, reduce regulatory risks, and secure sensitive patient and employee information with our Encryptionizer solution. Our high performance data security software can help you protect your patient data:

  • With virtually no impact on performance
  • With no additional programming
  • In various healthcare environments (physical, virtual, and cloud)
  • Without breaking the budget
  • Installing quickly with just a few clicks.

About NetLib Security

NetLib Security has spent the past 20+ years developing a powerful, patented solution that starts by setting up a formidable offense for every environment where your data resides: physical, virtual and cloud. Our platform simplifies the process while ensuring high levels of security.

Simplify your data security needs. Encryptionizer is easy to deploy. It is a cost-effective way to proactively and transparently protect your sensitive data that allows you to quickly and confidently meet your security requirements. With budget considerations in mind, we have designed an affordable data security platform that protects, manages, and defends your data, while responding to the ever changing compliance requirements.

Data breaches are expensive. Security does not have to be.

NetLib Security works with government agencies, healthcare organizations, small to large enterprises, financial services, credit card processors, distributors, and resellers to provide a flexible data security solution that meets their evolving needs. To learn more or request a free evaluation visit us at www.netlibsecurity.com.

Editor’s Note: David Stonehill is the CTO of NetLib Security, a security software development company that offers a number of data protection products including Encryptionizer®, which transparently encrypts data-at-rest in SQL Server, PostgreSQL, and nearly any Windows-based application. A graduate of Cornell University, David has led development groups at MCI, The Associated Press, and The BoxOffice Company.

Medical Device News Magazinehttps://infomeddnews.com
Medical Device News Magazine provides our readership with breaking medical device / biotechnology news. Our subscribers include medical specialists, device industry executives, investors, and other allied health professionals, as well as patients who are interested in researching various medical devices. We hope you find value in our easy-to-read publication and its overall objectives! Medical Device News Magazine is a division of PTM Healthcare Marketing, Inc. Pauline T. Mayer is the managing editor.

Experts Views and Opinions

Moby Cutter™ is one of the safest surgical wire cutters on the market today! Their medical design team has over 35 years of experience performing surgical procedures in Hospitals, Emergency Rooms and Urgent Care Systems. It has been cleared for commercialization per FDA guidelines and sold as a prescription only (Rx) medical device. Dr. Stanley shares the advantages of the Moby Cutter.
Health systems continue to face ongoing pressures to reduce costs while maintaining quality patient care. With the average operating margin for hospitals at 0.84%, health systems are searching for ways to more effectively manage operating and capital budgets. However, gaps in data often hinder health systems by hiding cost burdens throughout the organization. These hidden costs limit health systems to finding one-time-savings without lasting relief from industry-wide pressures.
Dr. Amy Hester writes, "However, while technology has brought about incredible advancements, an essential aspect must not be overlooked—integrating a human touch in healthcare delivery, particularly in the context of falls prevention among veterans." Read to learn more.
Dr. Kashani offers insights for couples trying to conceive during the holidays, from nutrition and stress management to products to consider.
The creation of CAR T cell therapy begins with collection of the patient’s blood and separation of the lymphocytes. These include T cells, B cells, and innate lymphoid cells, all of which are separated through apheresis (leukapheresis). It is this separation process which, if optimized, has the potential to revolutionize immunotherapy treatments for cancer patients.

By using this website you agree to accept Medical Device News Magazine Privacy Policy