OnPage’s Guide: Cyberattacks and HIPAA-Compliant Messaging

Mobile devices offer clinicians the opportunity to easily engage with patients, coordinate care and ultimately save money, time and improve the quality of healthcare services. At the same time, as mobile devices are increasingly used by healthcare workers (80% use by doctors and 70% use by nurses), they are also becoming an increasing vector for cybersecurity attacks.

The mandates of HIPAA-compliance, if followed, would significantly improve the security of hospitals and clinics. Specifically, HIPAA-compliance requires a high level of security to ensure the safety of patient information. If applied to smartphone communications, cyberintrusions would be mitigated. Increasingly, hospitals need to think of cyberattacks and HIPAA-compliant messaging in the same vein.

The goal of this blog is to investigate how you can improve your institution’s resilience against cyberattacks. To this end, we will delve into the following points:

• Why we cannot ignore mobile cybersecurity
• The importance of human factors in maintaining security
• 3 ways to improve your security footprint

Why we cannot ignore mobile cybersecurity

Clearly, doctors and nurses are pushing more and more information through their mobile devices. At the same time, ransomware attacks on healthcare organizations—the No. 1 cyber-attacked industry—will quadruple by 2020. Combine this fact with the knowledge that Gartner has reported that the focus of endpoint breeches will shift to tablets and smartphones by 2017 and one can begin to see the birth of a new cybersecurity storm.

Additionally, when information has been breached, patients stand to have their personal information compromised. According to information from the Deep Dot Web website, patient records are being sold by a hacker operating in TheRealDeal, a deep web marketplace known for peddling stolen data, codes and zero-day software exploits US$96,000 to $411,000.

In turn, criminals use these records to pretend to be someone else (living or dead) by falsely assuming and using that person’s identity to gain access to resources or services, apply for credit cards or loans, register fake accounts, file fraudulent tax returns to collect rebates, and other activities without the victim’s knowledge or consent. For healthcare organizations, these sorts of data breaches that result in leaked PHI can be incredibly costly, averaging $363 per lost record according to Ponemon.

Impact of human factors on cybersecurity

Human factors – meaning simple human errors such as sending messages to the wrong recipient, loss of the device or logging onto an insecure network – impact the overall security of smartphone device. In fact, 68 percent of healthcare security breaches were due to the loss or theft of mobile devices or files. Further, 48 percent of data lost was on a laptop, desktop computer or mobile device.

Cyberattacks and HIPAA-compliant messaging

The following tips highlight ways that healthcare providers and the institutions they work for can decrease the risk and impact of mobile cyberattacks. Realizing that human factors are the biggest factor in causing attacks, human factors needs to be our first point.

1. Human factors education. If human factors are the biggest culprit in advancing cyberattacks then they must be first on the agenda when it comes to determining a solution. This means that employees are trained and retrained frequently so they remember security protocols and best practices.
2. Culture of communication. Educate staff on the virtues of having a culture of communication where it is easy to contact IT support when an issue arises such as a potential malware download. There should be a guilt-free culture around this since if employees are worried they’ll be ridiculed or penalized, they will likely not self-report
3. Make sure smartphone applications are HIPAA compliant. Lots of patient PHI is passed over communications devices. HIPAA requires that messages containing patient information are also encrypted. If you are using a secure HIPAA-compliant messaging platform then patient information is safe. This means that all messages are encrypted and secure in transit and at rest

Want to learn more about how you can mitigate the impact of cyberattacks and HIPAA compliant messaging? Download our whitepaper, Mitigate Cyberattacks With HIPAA Compliant Communications.