There are few forms of information more personal and sensitive than health care data, but new research suggests the behavior of hospital employees may be putting patients at greater risk than ever before.

Less than half of staff employed by health care organizations receive security training, according to a study from Trustwave. That education gap may explain why only 14 percent of nontechnical staff believed a data breach had ever taken place in their organization. Although technical staff appeared to have a better sense of the risk, the research suggested they aren’t doing much about it: 47 percent of organizations admitted they do security testing once a year or less.

An expert told CSO Online that health care organizations need to spend more time to make sure employees — particularly those on the front lines dealing with patients — do everything possible to keep data safe. This could start with just pointing out where vulnerabilities may crop up. According to the Trustwave study, only 51 percent of nontechnical staff recognized the potential threats.

The next step could be examining the value of the health care data an organization manages. As InfoWorld recently reported, cybercriminal groups are getting up to $50 per record in some cases for stolen patient information. This may be because the data includes not only prescriptions or medical charts, but also Social Security numbers and insurance information. It may be necessary for hospitals and similar organizations to increase layers of authentication or encryption for the data, which are clearly of great interest to thieves.

We Live Security went even further and suggested conducting risk assessments on an ongoing basis. As with other industries, it may be best to set up a security plan that assumes data has already been breached. That way, employees are already on their guard and ready to contain further risks as much as possible.

To some extent, the rise in attacks on health care organizations comes as patient information is increasingly digitized. That means that the efficiency doctors and patients crave will be offset by greater risk. That’s why eSecurity Planet recommended training staff on attack types such as ransomware and other forms of malware and also establishing a breach response plan so employees can take action rather than panic.