IT security should be a top priority for health care organizations. Along with compliance with federal regulations, patients expect their personally identifiable information (PII) to be secured against outside interference.
As noted by SC Magazine, however, a recent Ponemon Institute study found that 89 percent of all health care companies suffered at least one data breach in the last two years. Additionally, IT security is “not even close to top of mind” in many of these organizations.
In other words, security is on life support. How do health agencies get back on track as data breaches ramp up?
Data Breaches Bring Culture Shock
According to the study, 50 percent of health care providers surveyed said that cybercrime was the top cause of data breaches, up 5 percent from last year. Problems with third-party providers came next at 41 percent, while stolen devices slotted into third place at 39 percent.
Interestingly, the most-cited security concern of health agencies was employee negligence: 54 said that workers are often negligent when handling patient data. Thirty-two percent blamed poor vetting of technology partners leading to security risks.
But the poor prognosis for IT security in health care may not be so straightforward. Larry Ponemon, co-founder of the Ponemon Institute, said employees working in the health sector are often tasked with providing such a high standard of care that there’s little time left over to consider IT security implications.
Expected to do more with less, is it really surprising to receive a “glaze-eyed look” from health employees when the subject of data security came up?
A Tempting Target
It’s also worth noting that health companies believe they’re more vulnerable to breaches than other industries. There’s data to support this belief: According to Med City News, 23 percent of all data breaches occur in health care at a cost of $363 per record, the highest of any industry.
As noted by Dark Reading, this adds up to $6.2 billion lost in the last two years. But with more than half of all security budgets staying flat and 10 percent in decline, this shouldn’t come as a surprise. In fact, most health organizations don’t believe they have enough in the budget to effectively protect critical data.
Health care is under siege. Data breaches are up and cybercrime is the most common cause. Employees are shouldering part of the blame for not properly handling patient data, even when the money and time needed are trending downward.
The result? Investments and expectations must be managed concurrently. Just throwing money at this problem won’t solve it; health agencies need to spend on IT security tools that better detect malicious code and strange behavior, and also automate and streamline necessary data entry.
Health care security is on life support. Reducing care standards to solve the problem is robbing Peter to pay Paul. To shake off the unwanted title of most-breached industry, health agencies need to spend on safeguarding data the moment it moves from doctor to database.