Why Are Health Records So Valuable to Cybercriminals?

Defending the information in digital well being data didn’t begin with the appearance of HIPAA — the Well being Insurance coverage Portability and Accountability Act of 1996 — as many individuals assume. Defending well being data has been a important requirement within the healthcare house because the computer systems grew to become a fixture in hospitals. Nevertheless, HIPAA added public stories of fines issued for coated entities’ failure to correctly shield information contained inside EHRs.

Many individuals assume that EHR information has restricted worth to unauthorized customers. (Who cares about my blood take a look at outcomes, or that I simply visited my dermatologist?) Understanding their worth is sort of easy, although. Along with private well being info, or PHI, EHRs include Social Safety numbers, which by no means expire — and cybercriminal use of SSNs shouldn’t be simply detected.

No Expiration Date

Stealing EHRs is best for cybercriminals than stealing bank cards, which can be utilized solely till the cardboard expires, is maxed out or canceled, based on a Development Micro research launched final month.

“…an EHR database containing PII that don’t expire — reminiscent of Social Safety numbers — can be utilized a number of instances for malicious intent,” the research explains. “Stolen EHR can be utilized to accumulate pharmaceuticals, obtain medical care, falsify insurance coverage claims, file fraudulent tax returns, open credit score accounts, get hold of official government-issued paperwork reminiscent of passports [and] driver’s licenses, and even create new identities.”

One other necessary statistic that helps clarify why cybercriminals are interested in EHR information is that 91 % of the U.S. inhabitants has medical insurance. It’s no surprise, then, that 113.2 million healthcare-related data had been stolen in 2015, based on Development Micro.

What About Federal Legal guidelines?

Everybody remembers signing dozens of paperwork earlier than attending to see a health care provider. If you happen to had been to learn every doc, you’d discover that you simply agreed to permit the safety of your private well being info. The U.S. Division of Well being and Human Providers is answerable for HIPAA oversight.

Below HIPAA, all coated entities should shield PHI in very particular methods. Healthcare suppliers which can be coated entities embody medical doctors, clinics, psychologists, dentists, chiropractors, nursing properties and pharmacies — however provided that they transmit any info in an digital type in reference to a transaction for which HHS has adopted an ordinary.

There are millions of coated entities on the market, together with solo medical doctors, psychologists, dentists, and chiropractors, all of whom have the responsibility to guard PHI — however how do small practitioners who can not correctly afford the IT infrastructure shield PHI?

Small coated entities rent an organization to assist, which HIPAA refers to as a “enterprise affiliate.” Below HIPAA, every enterprise affiliate should signal an settlement with the coated entity to guard PHI, aptly termed a “enterprise affiliate settlement,” or BAA.

Below the HIPAA Privateness Rule, a BAA “permits coated suppliers and well being plans to reveal protected well being info to those ‘enterprise associates’ if the suppliers or plans get hold of passable assurances that the enterprise affiliate will use the data just for the needs for which it was engaged by the coated entity, will safeguard the data from misuse, and can assist the coated entity adjust to a few of the coated entity’s duties below the Privateness Rule.”

The HHS affords a pattern BAA that explains the enterprise affiliate’s potential legal responsibility below HIPAA:”A enterprise affiliate is straight liable below the HIPAA Guidelines and topic to civil and, in some circumstances, legal penalties for making makes use of and disclosures of protected well being info that aren’t licensed by its contract or required by regulation. A enterprise affiliate is also straight liable and topic to civil penalties for failing to safeguard digital protected well being info in accordance with the HIPAA Safety Rule.”Given the potential legal responsibility, all coated entities and enterprise associates use extraordinary efforts to guard PHI and EHRs.

Who Protects EHRs?

The HHS Workplace of Civil Rights (OCR) Investigates “civil rights, well being info privateness, and affected person security confidentiality complaints to establish discrimination or violation of the regulation and take motion to right issues.”

The OCR continuously stories coated entities that fail to guard PHI correctly, and people entities are fined accordingly.

Quite a lot of states, together with Texas, New York and Ohio, have created their very own legal guidelines to guard PHI. Texas in 2011 handed Home Invoice 300, which “locations stricter necessities on affected person well being privateness than these required by HIPAA and likewise expands the definition of coated entities to incorporate those who come into possession of, get hold of, assemble, acquire, analyze, consider, retailer, or transmit protected well being info.”

Given their immense long-term worth, cybercriminals seemingly will goal PHI and EHR databases for years to return, so it’s incumbent upon all coated entities and enterprise associates to make the protection of this info a prime precedence, and do the whole lot potential to guard their PHI and EHR databases.