{"id":7021,"date":"2020-11-09T14:02:24","date_gmt":"2020-11-09T14:02:24","guid":{"rendered":"https:\/\/outofsite.biz\/cynance\/?p=7021"},"modified":"2021-03-10T08:54:57","modified_gmt":"2021-03-10T08:54:57","slug":"the-stolen-health-data-market","status":"publish","type":"post","link":"https:\/\/outofsite.biz\/cynance\/the-stolen-health-data-market\/","title":{"rendered":"Health data protection: How to keep patients\u2019 data safe from the stolen health data market"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"7021\" class=\"elementor elementor-7021\">\n\t\t\t\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-45e0897e elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"45e0897e\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-2a13f229\" data-id=\"2a13f229\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-264884f6 elementor-widget elementor-widget-text-editor\" data-id=\"264884f6\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.11.5 - 14-03-2023 *\/\n.elementor-widget-text-editor.elementor-drop-cap-view-stacked .elementor-drop-cap{background-color:#818a91;color:#fff}.elementor-widget-text-editor.elementor-drop-cap-view-framed .elementor-drop-cap{color:#818a91;border:3px solid;background-color:transparent}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap{margin-top:8px}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap-letter{width:1em;height:1em}.elementor-widget-text-editor .elementor-drop-cap{float:left;text-align:center;line-height:1;font-size:50px}.elementor-widget-text-editor .elementor-drop-cap-letter{display:inline-block}<\/style>\t\t\t\t<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">The last year has been tough for healthcare providers around the world. Not only, as you may expect, because of the Covid-19 crisis, but due to the escalating cybercrime threat that has seen many successful attacks on healthcare settings. And while we hope that the Covid-19 pandemic will be over in the near future, the impact of a data breach resulting in stolen health data could have repercussions for a long time to come.<\/span><\/p>\n<p style=\"font-weight: 400;\">\n<\/p><p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">The online information revolution has seen more and more data go online, including patients\u2019 electronic medical records (EMR). This extremely sensitive data needs robust safeguards in place to protect it, because small businesses such as healthcare clinics are doubly attractive to attackers. Whereas large hospitals have larger cybersecurity budgets, access to deeper knowledge and more extensive expertise, and an IT team with information security skills, small, private health clinics may not have the same resources.&nbsp;<\/span><\/p>\n<h2><span style=\"font-weight: 400;\">The stolen health data market &#8211; Not what you thought<\/span><\/h2>\n<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Research in the United States found that more than 230 million health records were stolen or lost between 2009 and 2019. This amounts to the records of 70% of US citizens. Hackers target health-care providers because personal health information (PHI) has the highest value on the <\/span><a href=\"https:\/\/www.experian.com\/blogs\/ask-experian\/heres-how-much-your-personal-information-is-selling-for-on-the-dark-web\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">black market<\/span><\/a><span style=\"font-weight: 400;\">.<\/span><\/p>\n<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Personal health information can be worth ten times more than credit card numbers. This is because personal health records contain complete information about individuals from their personal identification information (PII) through to their height, weight, specific health conditions, health insurance account numbers, even their blood type. Furthermore, while a credit card can be cancelled, personal health information can\u2019t be changed, making it stable for the long term. In short, everything a malicious actor could possibly need.<\/span><\/p><p style=\"font-weight: 400;\"><img decoding=\"async\" src=\"https:\/\/lh4.googleusercontent.com\/2zzwcaMYRFHKqEr3HsYh5VU1QWqYfXeJXsMcIulasrAAWPqqyDAT1x__hGk5xzALH28bsMleS8w0BySlK7NNOgNWXbtBRhmy3cFbfcHxjjNe7eJP6_2kkPmzjZtOyllZw6N0Shsy\" alt=\"\"><span style=\"font-weight: 400;\"><br><\/span><\/p>\n<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Figure 1: Relative price of information records on the dark web. Source: <\/span><a href=\"https:\/\/www.experian.com\/blogs\/ask-experian\/heres-how-much-your-personal-information-is-selling-for-on-the-dark-web\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">Experian 2017<\/span><\/a><\/p>\n<h2><span style=\"font-weight: 400;\">Uses of stolen personal health information (PHI)<\/span><\/h2>\n<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">When cyber criminals steal personal health information, they can sell it on for a high price. Malicious actors who gain access to stolen health data can monetise this information in a variety of lucrative ways, which go far beyond the ways in which \u2018regular\u2019 personal identification information can be used.<\/span><\/p>\n<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">1) <\/span><b>Sell stolen health data to rogue data kingpins<\/b><span style=\"font-weight: 400;\"> &#8211; PHI can be sold to rogue data brokers who then sell it on to insurance and other similar companies (yes, you read correctly). These companies will use this data to re-evaluate insurance policies, target marketing campaigns to the individuals whose data was compromised, and even share it or resell the stolen health data to other parties.<\/span><\/p>\n<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">2) <\/span><b>Purchase medical equipment or drugs<\/b><span style=\"font-weight: 400;\"> &#8211; PHI may also include information about medical personnel. This information about the specific staff can in turn be used to steal the identity of medical workers and gain access to medical equipment or drugs.<\/span><\/p>\n<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">3) <\/span><b>Identity theft<\/b><span style=\"font-weight: 400;\"> &#8211; PHI usually contains large amounts of persona identifiable information (PII) about each patient, and that can be used to steal identities, file fraudulent claims with insurance companies, carry out tax and other forms of financial fraud.<\/span><\/p>\n<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">4) <\/span><b>Carry out advanced social engineering attacks<\/b><span style=\"font-weight: 400;\"> &#8211; PHI provides attackers with the sensitive information they need to carry out confidence attacks on individuals. Phishing attacks using PHI&nbsp; may look particularly genuine as they contain a large amount of factual information gleaned from the victim\u2019s PHI, which increases their confidence in the email, and makes them more likely to interact with it.<\/span><\/p>\n<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">These well crafted social engineering attacks could affect both individuals and enterprises, causing significant damage, and taking advantage of human error to bypass the advanced technological solutions these organisations have in place.<\/span><\/p>\n<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">5) <\/span><b>Ransomware attacks<\/b><span style=\"font-weight: 400;\"> &#8211; Cyber criminals could hold stolen health data for ransom, stopping services, and threatening to leak the information they hold unless a ransom is paid. Should the information be published online (with or without a ransom), it will cause embarrassment, loss of reputation and patients and more.<\/span><\/p>\n<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Ransomware attacks are increasing on hospitals and other healthcare organisations, simply because attacks on hospitals have a higher chance of success. Healthcare organisations are often quick to pay ransoms because they can\u2019t afford to experience downtime (see <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/warning-ransomware-attacks-may-cost-lives\/\"><span style=\"font-weight: 400;\">what happened in Dusseldorf, Germany<\/span><\/a><span style=\"font-weight: 400;\">, when a hospital was attacked by ransomware).<\/span><\/p>\n<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">So what can be done to improve health data protection and avoid the consequences of a breach resulting in stolen health data?<\/span><\/p>\n<h2><span style=\"font-weight: 400;\">Improve personal health data protection in your organisation<\/span><\/h2>\n<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">It is a matter of when, not if, a data breach will affect an organisation. Taking a proactive approach towards <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/security-risk-and-compliance\/cybersecurity-risk-management\/\"><span style=\"font-weight: 400;\">cybersecurity risk management<\/span><\/a><span style=\"font-weight: 400;\"> will improve health data protection and reduce the likelihood and potential impact of cybersecurity attacks, including stolen health data.<\/span><\/p>\n<p style=\"font-weight: 400;\"><b>Technology is not enough<\/b><span style=\"font-weight: 400;\"> &#8211; Firewalls, anti-malware solutions (formerly known as anti-virus products), and data encryption will help improve personal health data protection, but they are not enough to defend against cyber attacks.<\/span><\/p>\n<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">A broader vision is required, one that takes into account all the different variables of cybersecurity, including technological solutions, best practice implementation, good internal processes, empowered employees who understand their information security responsibilities, and constant monitoring of these defences in order to ensure that they are always up to date and in working order.<\/span><\/p>\n<p style=\"font-weight: 400;\"><b>Manage security vulnerabilities<\/b><span style=\"font-weight: 400;\"> &#8211; Attackers usually get into systems by exploiting vulnerabilities in these systems. In order to stay ahead of attackers, you need to proactively check for, identify, and mitigate these vulnerabilities across your network.<\/span><\/p>\n<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Vulnerability management involves ensuring that you configure your systems securely, changing system permissions, and applying updates and security patches as soon as they are released. Remember, some of the worst security breaches on record were caused by poorly configured systems, or when no one changed system permissions, using the defaults, that attackers are all too familiar with.<\/span><\/p>\n<p style=\"font-weight: 400;\"><b>Create a monitoring process with complete logs of activities<\/b><span style=\"font-weight: 400;\"> &#8211; Logs and records of what goes on on your network are important elements of your cybersecurity. Good network monitoring and logs are invaluable when things go wrong, and you need to call in a professional cybersecurity team to investigate and remedy the situation, getting you back up and running as fast as possible. Without proper monitoring and logging of systems, even the best incident response team will struggle to fix the situation.<\/span><\/p>\n<p style=\"font-weight: 400;\"><b>Back up your systems<\/b><span style=\"font-weight: 400;\"> &#8211; The best way to return to normal after a ransom or other attack on your systems is to have a properly configured backup drive that you can immediately recover and apply to your systems. Make sure that it is protected separately from your regular drive, because if it is also encrypted in a ransomware attack it will not be able to help!<\/span><\/p>\n<p style=\"font-weight: 400;\"><b>Train your employees to be security smart<\/b><span style=\"font-weight: 400;\"> &#8211; Many data breaches are caused by human negligence. In some cases, employees fall for phishing scams, giving attackers access to records. In other cases, employees lost or left unattended computers or other devices containing unsecured health data, which was then stolen.&nbsp; Every employee in your organisation from doctors down to administrative staff should be guided and trained in how to stay safe, and avoid opening the door for attackers.<\/span><\/p>\n<p style=\"font-weight: 400;\"><b>Plan your response to an attack<\/b><span style=\"font-weight: 400;\"> &#8211; If all else fails, have a clear incident response plan in place that will help you address any incident that comes your way, including malicious attacks, data breaches, or data loss incidents. Incident response plans contain instructions to your team to identify the problem, contain it, eradicate the threat, recover any lost data, and set out a framework for learning how to prevent an attack like this from happening again.<\/span><\/p>\n<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">The incident response plan should be a living document that is reviewed regularly to ensure that everyone knows what to do in the event. Incident response plans (and their current relevance to your company) are also super important to your customers who are looking for reassurance that you will be on top of any kind of incident.<\/span><\/p>\n<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Personal healthcare data protection can be complicated and expensive, but as healthcare professionals all know, prevention is better than cure. Healthcare settings do not have the luxury of taking it easy when it comes to protecting PHI. It\u2019s always the right time to check your cybersecurity defences, ensure they are healthy, and get a second opinion from a \u2018cybersecurity doctor\u2019!&nbsp;<\/span><\/p>\n<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Stay safe<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>Stolen health data is extremely lucrative on the black market, and private health clinics are attractive targets for cyber criminals.<\/p>\n","protected":false},"author":10,"featured_media":7029,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[19],"tags":[63,62],"_links":{"self":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts\/7021"}],"collection":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/comments?post=7021"}],"version-history":[{"count":0,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts\/7021\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/media\/7029"}],"wp:attachment":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/media?parent=7021"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/categories?post=7021"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/tags?post=7021"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}