This article highlights some things you can do to make sure your system users can understand intrusion risks from other sources like email and malicious links.
Whether your organization is a covered entity or business associate, the HIPAA umbrella casts a long shadow. Information breaches bring strong sanctions, even in the “Unknowing” category–with a maximum of $50,000 per violation up to $1.5 million annually. The fines and administrative penalties following a hack or unauthorized discloser are somewhat akin to receiving a traffic ticket following an accident that totals your vehicle after you have loaned it to an inexperienced driver.
Your personal health record data is undoubtedly protected in secure servers. You employ malware and virus protection, because you know just how valuable medical records are to the cyber underworld. So the protection may be in the engine, but what about the users at the wheel?
Cyber attacks don’t always depend on backdoor intrusions through vulnerable websites or Internet browsers. For example, this LA Times online story chronicles how 108 county employees opened a phishing email and provided user names and password to their accounts, “some of which contained confidential patient or client information…”
Yes, county officials said “they have strengthened security measures…and enhanced employee training…” but that is scant consolation to the 756,000 people whose names, addresses, dates of birth, Social Security numbers, financial information and medical records ended up in the hands of a Nigerian scammer.
So protecting files is not the same thing as protecting access to them. The LA County incident illustrates several points made in this Health IT Security.com online article by Bill Kleyman:
End-user awareness of underlying security is no more complicated than learning how to identify the threats. Kleyman advises educating employees in what they should not do, i.e.:
In the do category, Kleyman recommends:
The average cost of a data breach in the United States is $8.64 million, which is the highest in the world, while the most expensive sector for data breach costs is the healthcare industry, with an average of $7.13 million (IBM).
The three sectors with the biggest spending on cybersecurity are banking, manufacturing, and the central/federal government, accounting for 30% of overall spending (IDC).
It takes an average of 287 days for security teams to identify and contain a data breach, according to the “Cost of a Data Breach 2021” report released by IBM and Ponemon Institute.
The internal team was energized. With the Level 1 work off its plate, the team turned its attention to the work that fueled company growth and gave them job satisfaction.
Forty-three percent of attacks are aimed at SMBs, but only 14% are prepared to defend themselves (Accenture).
The cost of cybercrime is predicted to hit $10.5 trillion by 2025, according to the latest version of the Cisco/Cybersecurity Ventures “2022 Cybersecurity Almanac.”.
40% of businesses will incorporate the anywhere operations model to accommodate the physical and digital experiences of both customers and employees (Techvera).
More than 33 billion records will be stolen by cybercriminals by 2023, an increase of 175% from 2018.
We did a proof of concept that met every requirement that our customer might have. In fact, we saw a substantial improvement.
We did everything that we needed to do, financially speaking. We got our invoices out to customers, we deposited checks, all the things we needed to do to keep our business running, and our customers had no idea about the tragedy. It didn’t impact them at all.
“We believe our success is due to the strength of our team, the breadth of our services, our flexibility in responding to clients, and our focus on strategic support.”