May 17, 2016 By Douglas Bonderud 2 min read

IT security should be a top priority for health care organizations. Along with compliance with federal regulations, patients expect their personally identifiable information (PII) to be secured against outside interference.

As noted by SC Magazine, however, a recent Ponemon Institute study found that 89 percent of all health care companies suffered at least one data breach in the last two years. Additionally, IT security is “not even close to top of mind” in many of these organizations.

In other words, security is on life support. How do health agencies get back on track as data breaches ramp up?

Data Breaches Bring Culture Shock

According to the study, 50 percent of health care providers surveyed said that cybercrime was the top cause of data breaches, up 5 percent from last year. Problems with third-party providers came next at 41 percent, while stolen devices slotted into third place at 39 percent.

Interestingly, the most-cited security concern of health agencies was employee negligence: 54 said that workers are often negligent when handling patient data. Thirty-two percent blamed poor vetting of technology partners leading to security risks.

But the poor prognosis for IT security in health care may not be so straightforward. Larry Ponemon, co-founder of the Ponemon Institute, said employees working in the health sector are often tasked with providing such a high standard of care that there’s little time left over to consider IT security implications.

Expected to do more with less, is it really surprising to receive a “glaze-eyed look” from health employees when the subject of data security came up?

A Tempting Target

It’s also worth noting that health companies believe they’re more vulnerable to breaches than other industries. There’s data to support this belief: According to Med City News, 23 percent of all data breaches occur in health care at a cost of $363 per record, the highest of any industry.

As noted by Dark Reading, this adds up to $6.2 billion lost in the last two years. But with more than half of all security budgets staying flat and 10 percent in decline, this shouldn’t come as a surprise. In fact, most health organizations don’t believe they have enough in the budget to effectively protect critical data.

Health care is under siege. Data breaches are up and cybercrime is the most common cause. Employees are shouldering part of the blame for not properly handling patient data, even when the money and time needed are trending downward.

The result? Investments and expectations must be managed concurrently. Just throwing money at this problem won’t solve it; health agencies need to spend on IT security tools that better detect malicious code and strange behavior, and also automate and streamline necessary data entry.

Health care security is on life support. Reducing care standards to solve the problem is robbing Peter to pay Paul. To shake off the unwanted title of most-breached industry, health agencies need to spend on safeguarding data the moment it moves from doctor to database.

More from

SoaPy: Stealthy enumeration of Active Directory environments through ADWS

10 min read - Introduction Over time, both targeted and large-scale enumeration of Active Directory (AD) environments have become increasingly detected due to modern defensive solutions. During our internship at X-Force Red this past summer, we noticed FalconForce’s SOAPHound was becoming popular for enumerating Active Directory environments. This tool brought a new perspective to Active Directory enumeration by performing collection via Active Directory Web Services (ADWS) instead of directly through Lightweight Directory Access Protocol (LDAP) as other AD enumeration tools had in the past.…

Smoltalk: RCE in open source agents

26 min read - Big shoutout to Hugging Face and the smolagents team for their cooperation and quick turnaround for a fix! Introduction Recently, I have been working on a side project to automate some pentest reconnaissance with AI agents. Just after I started this project, Hugging Face announced the release of smolagents, a lightweight framework for building AI agents that implements the methodology described in the ReAct paper, emphasizing reasoning through iterative decision-making. Interestingly, smolagents enables agents to reason and act by generating…

4 ways to bring cybersecurity into your community

4 min read - It’s easy to focus on technology when talking about cybersecurity. However, the best prevention measures rely on the education of those who use technology. Organizations training their employees is the first step. But the industry needs to expand the concept of a culture of cybersecurity and take it from where it currently stands as an organizational responsibility to a global perspective.When every person who uses technology — for work, personal use and school — views cybersecurity as their responsibility, it…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today