In order to ensure optimal patient safety and care, healthcare is one of the most standardized industries in the world. Particularly in countries like the US, where liability risks are enormous, hospitals are directing huge amounts of resource to ensure that they are compliant with national, and even international standards, to avoid scrutiny and liability.
The security threat that comes with the increase in mobility and remote technology, means that hospitals also have to be incredibly vigilant about data loss protection (DLP) and the threat that internal sources pose, both maliciously and by accident, in the release of sensitive data. Failure to do so can result in huge fines, a loss of reputation and risks to patient safety. Here are 5 ways that healthcare institutions can look to overcome compliance and security risks:
In a study conducted by Ponemon Insititute LLC, it was found that only 23% of respondents in the healthcare industry were using data loss protection software to prevent against internal data breach. A huge amount of resource is often put towards preventing external threats through anti-malware and anti-virus programs but almost half of all data loss comes from internal sources. DLP software addresses the source of all information – how it operates and moves internally – and therefore helps to prevent its movement externally.
Data loss protection strategies, plans and software are only as good as how they are used and enforced. This requires a great deal of communication from IT departments as well as top level staff at healthcare institutions. A DLP strategy must be used by everyone handling patient information, which involves clear policies and procedures for staff to follow to ensure no accidental breaches, preferably integrated into the DLP software in real-time.Of course, a DLP plan that employs certain overrides can assist with this – for instance, blocking the download of data via a USB port, if that is appropriate.
Visibility and accountability go hand-in-hand when it comes to overcoming security risks in hospitals, particularly those that are internal malicious threats. Employing a system that clearly identifies and tracks the movement of sensitive data, as well as ensuring that user information is connected to that movement, wards off malicious behavior. If the person wishing to release sensitive data knows that there is a higher likelihood that it could be tracked back to them, they will be less likely to do so.
New healthcare protocols globally, and particularly in the US, mean that it is no longer acceptable for hospitals to not be encrypting their data. In the US, this can mean both civil suits and large fines, sometimes up to $250,000 for the individual responsible. The compliance protocols state that any breach that occurs involving sensitive data that was not protected (encrypted) must be reported to the Department of Health and Human Services. Encrypted data that is breached, however, does not need to be reported and is not penalized. It is viewed that the hospital took the necessary steps with a DLP plan to prevent such an occurrence and is therefore, not liable. Investing in encryption is a preventable measure that can significantly reduce large fines and lawsuits.
Hospitals, as we know, are incredibly large institutions and therefore employing a rigorous DLP strategy to meet with compliance requires a huge amount of resource, which often can’t be met in a single financial year. Working with a good DLP company means that you should be able to employ an effective DLP strategy that takes care of the essentials to meet protocols immediately. But can then be scaled up and be fluid enough to change for the upgraded technology that is always occurring in the healthcare industry.
A good DLP strategy is more than just software. Especially when it comes to internal threats, it’s essential that a DLP strategy understands how people think and behave in order to overcome healthcare compliance and security risks. Preventative measure such as encryption and communication can help avoid the accidental breach of data. Clear visibility and accountability can assist in preventing a purposeful and malicious breach, while also ensuring that healthcare compliance protocols are truly met.