Recent major cyber attacks on the healthcare community, such as Petya and WannaCry, have created unprecedented levels of fear on IT security professionals. In fact, a cybersecurity report from HIMSS last month noted that these two vulnerabilities in particular continue to affect various industries around the world, only adding to the growing concern. And while much of the focus has been how these attacks have impacted larger organizations in recent months, there hasn’t been a whole lot of discussion on how their small-practice brethren could be affected.
Indeed, small physician practices can fall victim to ransomware and many other types of cyber attacks, as they don’t often have the budget for proper protection to fend off hackers. But experts in the field do attest that there are some low-cost ways they can combat an attack without breaking the bank.
Helping smaller practices in this regard is Jorge Rey, director of information security and compliance at advisory firm Kaufman Rossin. Rey is primarily responsible for the firm’s compliance with federal and state cyber security and privacy information laws and regulations. Recently, Rey spoke with Healthcare Informatics about steps smaller physician practices can take to better protect their data in addition to broader cybersecurity trends he is seeing. Below are excerpts of that discussion.
What are the main things you are working on these days as it relates to healthcare cybersecurity?
We’re an accounting firm, and I work in the consulting division where I specialize on HIPAA [the Health Insurance Portability and Accountability Act] and HITECH [the Health Information Technology for Economic and Clinical Health] consulting. Under those areas, we focus on small and large practices, hospitals and business associates (BAs). We assist clients with their HIPAA compliance requirements, whether it is doing risk assessments, policy and procedures implementation, penetration testing, vulnerability assessments, or technical assessments, so we are helping them translate the requirements of the rules into actionable items that they can use in their operations while still complying.
How ready and prepared are most of your clients?
A lot of the organizations have at least something in place, so it’s not like they’re all starting from scratch. It is now about looking at what they have in place and figuring out how they can improve upon that. For example, everyone has a computer with some type of anti-virus, and by doing that you are at least accomplishing being effective with one of the requirements. Depending on how big the organization is might depend on how sophisticated its firewalls are, but everyone pretty much has some type of firewall. They are already backing up their data, too. But when you specialize into different departments, that’s where you start to identify the gaps.
What’s most concerning for your clients today?
We do have small physician practices who are completely unaware of the requirements. In their minds HIPAA is still a privacy issue, so when you talk to them they think they are HIPAA-compliant because they have a form at the front of the medical office [for patients]. But what they don’t understand is that even after that form, you need to keep the information secure, too. A lot of physician practices are ignorant on the rules and requirements, and that creates concerns. So we spend time trying to educate the doctors or office administrators on the requirements and what they need to do, and that could become overwhelming for them.
As far as the bigger companies, they have more employees and an IT department, so educating the board and senior management about why you need to spend money is probably the biggest issue. So in both cases it is about education.
We are constantly reading about hackers, laptops being stolen, and ransomware, and all of these are huge issues, but not everyone deals with the same threats. It depends on their environment. A lot of people have a false sense of security—they think they are compliant because their laptop is encrypted, but they don’t have the BA agreements and don’t even know that they need them.
Looking beyond HIPAA and other requirements, true defense is much more than that, right?
Compliance doesn’t necessarily mean security; you could be in compliance with the rules, but that doesn’t mean your information is completely secure. You can have the policies in place, everyone trained, and have all of the things that might pass an audit, but you can still be exposed.
One of the rules requirements is that you need to perform a risk analysis of your health information, be it electronic or paper. Sometimes, and perhaps often, you don’t do a good assessment of that risk analysis, so you fill out the forms and you move on. We often identify that the risk assessment [that was performed] did not truly identify the threat, so you did not truly look at the controls you had in place or should have had in place.
One of the biggest issues we’re seeing out there is phishing—it’s the way ransomware is getting downloaded and the way we are getting hacked. We still see that people don’t have phishing training at all. We know what the biggest threat we have as an industry is, but we are not educating the people who click those links. And then you go back to the board and tell them that they need to spend money on training, and they look at you and ask why they need to spend on that since everyone already knows not to click [bad links]. That’s where the biggest disconnect is.
Get the latest information on Health IT and attend other valuable sessions at this two-day Summit providing healthcare leaders with educational content, insightful debate and dialogue on the future of healthcare and technology.