Examining Headlines To Protect Your Healthcare Organization

There were 142 hacking incidents reported since last June related to email attacks. Cybercriminals are becoming more sophisticated with phishing emails, and efforts intensified during the pandemic. Despite hours of training and reminders, healthcare employees continue to fall victim to phishing emails, potentially exposing thousands of patient records.

Cybercriminals are speeding up their ransomware and malware attacks on hospital networks, according to a report in The Wall Street Journal. Previously, attackers would take more time to go through data before inflicting malware, but during the pandemic they have begun launching malware right away because hospitals need data back immediately.

Several hospital and health system employees have accessed medical records unnecessarily, which resulted in the employee being terminated or resigning. The temptation to gain information about individuals at hospitals is huge when hospitals treat high-profile individuals or cases.

There is a correct and incorrect way for healthcare organizations to dispose of medical records, and improper disposal is a HIPAA violation. Seven healthcare providers disclosed earlier this year that some patient and employee records were dumped in unsecure locations. The institutions involved in the incident included Saint Joseph Health System in Mishawaka, Ind., which entrusted records that had protected healthcare information to Central Files to destroy some records and securely transfer others to storage. However, the company dumped some of the records in an unsecure place.

There have been 39 incidents of medical record theft in 2020 so far, including electronic files, files stored on stolen laptops and paper files. The largest theft this year has been from Health Share of Oregon; the health plan reported a laptop containing information about 654,362 individuals was stolen. There are also high consequences for stealing PHI; in May, a former clinic administrator was sentenced to four years in federal prison for accessing patients' medical records to steal their information and sell their identities.

Healthcare organizations must choose their partners wisely; a business associate that doesn't comply with HIPAA, or that experiences a cybersecurity incident can expose patient information and violate the law. A business associate was present in 91 of the data breach incidents in the past year and 41 of the breaches occurred among healthcare providers' business associates. Optum360 reported the largest business associate breach in the past year with a hacking incident that affected 11.5 million individuals. BST & Co. also reported a hacking incident in February that affected 170,000 individuals. Both incidents were network server breaches.

Healthcare personnel are busier now than ever, but they still must only access PHI on authorized devices. Clinicians and team members working virtually may access PHI only on authorized devices and must avoid downloading them to unsecure locations.

Even the best-laid plans can be foiled by Mother Nature and other unforeseen phenomenon. Earlier this year, Community Health Systems in Franklin, Tenn., reported that a tornado damaged the Stat Informatics Solutions building in Lebanon, Tenn., and exposed around 2,500 of the system's medical records that were stored there. The facility also housed medical records from other organizations.

The global pandemic has also paved the way for unintentional HIPAA breaches. In the wake of the fast-spreading COVID-19 virus, many health systems updated processes and protocols for identifying employees who tested positive and deploy quick contact tracing to promote self-isolation among those at risk of further spreading the disease.

There have been multiple incidents in the last year of hospitals and health systems, or business partners, inadvertently posting protected health information online. In May, Ashtabula (Ohio) County Medical Center accidentally posted an Excel spreadsheet on its website that included PHI; the spreadsheet was posted on Jan. 6 to comply with government requirements about medical cost disclosures. However, the hospital realized the spreadsheet also included PHI of around 3,683 patients.

Eleven security incidences in the past year have included the loss of medical records. Notable instances occurred at Walmart, where 3,606 individuals were affected by a breach in February 2020, following a separate incidence in which Walmart reported 4,211 patients' information on a portable device was lost in October 2019. Renown Health in Las Vegas also reported a loss incident affecting 27,004 individuals in August of 2019.