Real life ePHI data breaches aren’t always Russian hackers

Hacking and security breaches are all over the media lately.

Movie scripts and headlines suggest shadowy groups of professional hackers in far off countries are the biggest threat when securing healthcare data. In real life, someone rarely types for a few seconds while flashing text scrolls by on multiple monitors, and then yells “We’re In!” with an Eastern European accent. Today, ePHI losses often occur due to more mundane mistakes. Hacking is generally an opportunistic maneuver rather than a carefully planned attack.

Digicert, a publisher of security certificates for corporate websites, reports that almost half of all healthcare data breaches are caused by lost or stolen laptops. This proves that hackers aren’t necessarily evil geniuses, just patient and lucky. We’ll look at best practices for securing data on laptops, mobile devices and thumb drives in later posts on security.

One of the most common places to lose a laptop is while going through airport security, but airports also contain threats in the form of public wifi networks. Hackers don’t need to target someone in particular in an elaborate plot. They can just sit in a terminal and watch unencrypted network traffic. This is more like gathering than hunting. A hacker can scoop up dozens or even hundreds of log-ins in a single session, and then explore these later for easy data access opportunities.

While we’re on the subject of public wifi, it’s a good time to bring up the need for network segmentation This is the practice of making sure secure communications are always isolated on a separate network. All of your online traffic should never be sent through a single network. A common mistake in retail operations is putting Point of Sale terminals in stores on the general purpose, unencrypted network. Similar differentiation should occur with health care data.

In our next security post, we’ll look more closely at the types of people who are potential threats to your healthcare data.