Healthcare Data Security: How to Mitigate Risks While Managing Costs

No organization on earth is immune to phishing and ransomware attacks. The HIPAA Guide describes several examples of recent phishing attacks in healthcare. An attack on Anthem Inc. involved malware that exposed the PHI of 78.8 million people and cost the company $179 million in regulatory fines and legal fees.

Meanwhile, ransomware attacks on healthcare organizations nearly doubled between 2020 and 2021. The average ransom payment in the industry was $197,000.

Implementing a secure data sharing solution, eliminates the need for your employees to store files on their computers or hard drives. Instead, store your most valuable information in a secure cloud location. And because the files in that cloud location are individually encrypted and require a key to open, even a cybercriminal who breaches the login process will be unable to steal your information. These are the kinds of controls that keep regulators happy and patient data secure.

It’s an ongoing challenge to healthcare data security: many employees have, and require, access to files containing confidential patient data. There are too many opportunities for a staff member with malevolent intentions to capture files for their own use. But even innocent mistakes—such as attaching the wrong patient file to an email—can have major consequences.

Rather than simply encrypting files in transit and at rest, the right secure data sharing solution will enable you to establish tight controls on who accesses your patient records. Taking it one step further, you can also restrict access by location and time. These controls help you ensure that an off-duty employee won’t be able to access a patient record from their home laptop, or while they’re on vacation — times when it is unlikely they are doing so for a legitimate professional reason. A secure data sharing solution, makes it easy to demonstrate data security compliance to regulators.

Here’s a good rule of thumb in healthcare data security: any data that leaves your EMR system is highly at risk. Here’s another one: sharing that data with a third party introduces a whole new level of risk. You can never be sure your partners and other third parties are adhering to the same stringent security policies you’ve implemented. Are they encrypting every file, in transit, and at rest? How secure is their email system? Do they have an audit trail for every document?

You can take many threats out of the equation by using a secure data sharing solution. Storing sensitive data in a secure cloud location and providing your partners with a key to access specific documents, eliminates the chance of them storing documents in non-secure locations or forwarding them unencrypted to other partners. And you automatically maintain an audit trail of who has accessed your documents and when. You can easily share these audit trails with regulators to demonstrate that your patients’ PHI never goes unaccounted for—even in your communications outside the organization.

The concept of saving money by replacing legacy systems hardly needs explaining. With the right secure data sharing platform, you can retire six of your legacy systems and pay just one subscription fee.

Secure data sharing enables you to replace:

• File sharing. Have you been sharing files through a mainstream online provider? These services require a subscription fee for business use. They’re “secure” in the sense that they require a password to log in. But as we all know, cybercriminals breach password-based defenses every day. At some point, it makes sense to move on to a secure data sharing system that provides a more advanced level of security around your files.
  
• Secure FTP. For years, secure FTP has enhanced healthcare data security by encrypting files in transit. When your files are hosted in a secure data sharing system, there’s no need to send them—encrypted or otherwise—because your audience can simply use a unique key to log in and access them in the cloud.
• Encrypted email. With encrypted email, you render the text of an email unreadable to anyone who doesn’t have the necessary key. But it doesn’t secure attachments. For that, you need end-to-end encryption (E2EE), which also scrambles the text of attachments. But why invest in E2EE when you can get powerful encryption functionality on a secure data sharing platform that doesn’t require you to send files in the first place?
• Hosted data. Commonly used file management and storage services help you control access to your files. But they lack the sophisticated controls of a strong and secure data sharing system, which will empower you to control access based on factors such as location and time.
  
• Disaster recovery communication. Your organization no doubt has a disaster recovery plan in place as part of its healthcare data security strategy. But did you know that a secure data sharing system can serve as a valuable communication tool during a disaster? Suppose your cloud provider is wiped out by a malicious attack or natural disaster - in that case, your employees can use a data sharing system to send messages and keep processes moving to the greatest extent possible.
• Record retention. Healthcare organizations like yours face stringent record retention requirements. These standards often burden staff with tedious manual processes and the stress of adhering to multiple timelines for retaining records. With a secure data sharing system, your staff can automate many aspects of record retention, improving job satisfaction, reducing administrative costs, and streamlining regulatory compliance.

By consolidating to one secure data sharing solution, you’ll not only save money, but also dramatically reduce the daily complications your staff endure to complete simple tasks. Think of the impact for onboarding new staff: rather than having to issue them accounts and passwords for up to six different systems, you’ll simply set them up once with a secure data sharing platform, and then set them free to do what you hired them to do.

Consolidating systems is also a major push in healthcare providers’ digital transformation. Phase 1 of that transformation was to move manual, paper-based processes to the web. But when workers face a dizzying array of digital systems every day, one could argue that their productivity hasn’t increased as much as it should. Phase 2 of the digital transformation can and should include a consolidation of systems that eliminates redundant technology.

As part of your healthcare data security efforts, you may have pursued or received a certification of your organization’s level of data security. Once you’ve earned certification, you have the documentation you need to prove to regulators and other organizations that you’re taking appropriate safeguards to protect data. But earning these certifications can be a costly, time-consuming process—and you must take steps to maintain your certification year after year by ensuring you’ve put all the right controls in place and kept them up-to-date.

When you move to a secure data sharing solution, you can demonstrate your level of data storage security simply by providing information about the solution, such as encryption technology or user access controls. Good solutions have robust controls built in, which saves you from having to prove that you’ve implemented these controls yourself. You’ll save time while you save money.

When it comes to healthcare data security, many organizations believe they should go big. Unfortunately, they end up going big on costs, too.

Looking to keep your organization’s data as secure as possible without a huge financial investment? Some data loss prevention (DLP) solutions cost $100,000 per module. A massive hospital system may be able to withstand that blow to the bottom line. But mid-market and regional systems will likely balk at that price tag.

Ask yourself which capabilities your organization really needs. This is not to suggest that the best DLP solutions don’t deliver good value to the organizations that really need them. But weigh cost against functionality to determine whether they’re the right choice for you. Depending on your needs, a secure data sharing solution may only cost you $15,000 to $20,000 per year. And after careful evaluation, you may discover that these solutions check off all your highest healthcare data security priorities without bursting your budget.

Remember: the largest DLP solutions are built to meet the needs of a broad range of industries. By choosing the right secure data solution, you may end up with more customized protection at a fraction of the cost.

At Cocoon Data, we’re in the business of helping healthcare organizations optimize data security at a price they can afford. HIPAA-compliant, our highly secure data sharing platform is designed to help enhance collaboration and productivity, while keeping your PHI and organizational data secure.

We’d love to offer you a demo and answer your questions. Contact us today