“Healthcare as an industry has not taken seriously security in the past, to the extent that other kinds of industries have taken security and privacy, and has not bothered to put those security components into place that would protect the privacy of that information,” says Kibbe in an interview with Information Security Media Group. “They are trying to play catch-up now, very desperately.”
Recent breaches in the healthcare sector, such as the cyber attack on Anthem Inc., which impacted nearly 80 million individuals, show that “information is in these giant repositories, and is quite vulnerable to the bad guys breaking into that information and making use of it,” he says.
“It’s worse in healthcare than it is in other industries that have hardened their security practices as a result of these hacks,” he says. “We’re starting to see healthcare institutions and organizations being hacked because they’re easier targets.”
Kibbe recently testified at a Senate Committee on Health, Education, Labor and Pensions hearing about the state of secure information exchange in the healthcare sector, which is often hindered by intentional “information blocking” (see How to Unblock Secure Info Exchange) .
That includes information blocking caused by interoperability issues between electronic health record systems from different vendors, as well as situations in which healthcare providers incorrectly use the HIPAA privacy rule as an excuse for refusing to share patient information with other healthcare entities.
There are several important steps that healthcare entities can take to improve the overall protection of health data, as well as safeguard patient information that’s being exchanged with others, Kibbe says. That includes implementing strong encryption for data at rest and in transit; using multi-factor authentication; and building much better awareness of security and privacy throughout the healthcare sector.
Healthcare entities need “to take privacy and security very, very seriously beyond their own enterprises,” he urges. “We now live in a world where health information, as well as other personal information, exists in the cloud and people need to be very wary. They can put moats around their own information resources, servers, but you have to think about everybody else’s servers at the same time.”
In the interview, Kibbe also discusses:
The security and privacy challenges faced by health information exchange organizations that handle and store large volumes of patient data;
A progress update on the use of Direct secure messaging in the healthcare sector;
DirectTrust’s plans to unveil in 2016 Direct-based secure texting and “chats” for use on mobile devices, such as smartphones, in the healthcare sector.
Kibbe, a physician, is founding president and CEO of DirectTrust, a nonprofit alliance that created and maintains the security and trust framework for using the Direct Project for secure e-mail in the healthcare sector. He is also senior adviser to the American Academy of Family Physicians. Kibbe in 2014 was named a top 10 Healthcare Information Security influencer by Information Security Media Group.
This article was published in August 14, 2015 edition of DataBreach Today.
http://www.databreachtoday.com/interviews/how-neglect-made-healthcare-no1-target-i-2840?rf=2015-08-18-edbt&mkt_tok=3RkMMJWWfF9wsRolsqvLZKXonjHpfsX67%2BUtX6G3lMI%2F0ER3fOvrPUfGjI4ETMpkI%2BSLDwEYGJlv6SgFSrXEMbp407gPWBY%3D
