Cyber Attack On The Healthcare Industry: Article Analysis

Identify theft, in general, can affect a person for a lifetime. Federal law defines medical identity theft as “A fraud committed or attempted using the identifying information of another person without authority to obtain medical services or goods, or when someone uses the person’s identity to obtain money by falsifying claims for medical services and falsifying medical records to support those claims.” (“Red Flag Rule - Identity Theft Prevention Policy”, 2009). However, medical identity theft is not as easily traced compared to something such as, credit card theft. With the crime being less traceable and the ever-expanding health care system, it is not surprising that medical identity theft is continually rising. Medical identity theft accounts

The Health Insurance Portability and Accountability Act (HIPAA) was intricately designed to provide not only a more efficient health care system but also as a protection for private patient information and data. With the widespread use of technology and computers in hospitals, the availability of patient information, their health portfolio, and their previous care has greatly improved the efficiency of health care. However, this also means that there is greater leeway for that information to be lost and/or shared without patients consent.

Let’s analyze about financial impact of HIPAA violations in healthcare companies and find out how to prevent security breaches. Patients and healthcare facilitators both need to be informed on how to help these companies be protected and be prevented from identity theft. Also, there will be emphasis on what the penalties are in result to violation of HIPAA

In his Modern Healthcare article, “HIPPA Hurdles”, author Joe Carlson exclaims his concern for the new rules set in HIPPA that will be put into place this month. HIPPA is a set of measures, and laws, that healthcare provider’s take to ensure they are “safeguarding” patient’s health information (Carlson 2013). Carlson is speaking up for most healthcare providers when he describes his distaste for these new provisions in the Omnibus HIPPA Final Rule. The main issue in these provisions states that providers will have to “Honor requests from patients to withhold sensitive records from insurance companies if the bills are paid out of pocket.” (Carlson 2013). He asserts that the reason this will become an issue is because no one has the technology to simply safeguard one hospital or doctor visit from insurers, and that their own technological programs compile everything together and make this request difficult. While this new rule may be helping out patients, it will be causing more hardships and possible punishments when the healthcare providers forget or are not able to do as the patient asks. By grabbing his audience’s attention through appealing to our logic and emotions, Carlson does succeed in informing us about these new concerns.

Removing any inaccurate information from patient records could take years and cost medical companies in all types of ways -- from administrative costs to malpractice lawsuits. High-profile breaches in personal medical data continue to increase and are often low-tech -- criminals grabbing an unguarded laptop, phishing scams or people getting access to hard copies of medical records. A study published in the Journal of the American Medical Association reported that more than 29 million breaches of information security in healthcare occurred between 2010 and 2013.[3] The recent hacking of major insurance companies Anthem and Premera Blue Cross generated record breaches that dwarfed the JAMA study figures by exposing more than 90 million records to criminals in just a few months.[4] The JAMA study also revealed that there have been more than 1,000 major breaches since 2010, and of these, one-third occurred in five populous states: Florida, California, New York, Texas and

The significance of patient privacy and the security of confidential information are increasingly vital given the approval of electronic health records. Healthcare providers have recognized striking prices due to security threats and subsequent breaches. According to U.S. Department of Health and Human Services (2002), under the Privacy Rule healthcare establishments must establish protections that establish procedures and rules that guarantee least levels of privacy in relation to patient information. When violations are recognized, it is required that a compliant be created by the individual or unit experiencing the violation. In the complaint, the name of the person who participated in the violation, in addition to the nature of the violation, must be comprehensive. The filing of the complaint initiates an investigation by the Secretary of the U.S. Department of Health and Human Services under HIPAA values (U.S. Department of Health and Human Services, 2013). The establishment of a procedure related to privacy violations has resulted in many cases relating to electronic data breaches. Next is a consideration of two such cases to demonstrate the role of privacy in regards to HIPAA and electronic health database breaches.

The Health Insurance Portability and Accountability Act (HIPAA) of 1996 is a US law aimed to advance the portability and continuity of health insurance coverage in both the group and individual markets, and to combat waste, fraud, and abuse in health insurance and health care delivery as well as other purposes26. The Act defines security standards for healthcare information, and it takes into account a number of factors including the technical capabilities of record systems used to maintain health information, the cost of security measures, the need for training personnel, the value of audit trails in computerized record systems, and the needs and capabilities of small healthcare providers. A person who maintains or transmits health information

Peel’s interpretation of the HIPAA regulation is that “HIPAA does not protect privacy” (Peel, 2014). She explains that health data is continuously being bought and sold between multiple different agencies and that data breaches are due to a policy problem and not a technology problem (Peel, 2014). This stance on the lack of privacy and security under HIPAA is an accurate point of view. Amendments to the HIPAA in 2002 included eliminating required consent for PHI disclosure, changing the policy for obtaining patient consent allowing for the free oral communication between doctors to discuss patients’ PHI, clarifying the current physician’s discretion to provide or deny access to children’s health records, restricting PHI for marketing purposes or use by parties not directly involved in patient care, and provisions for providers regarding billing and business practices (Norman, & Burroughs, 2002, p. 865-866). These amendments that eliminate the need for patient consent further degrade the lack of protection of PHI. Dr. Peel challenges the medical community to expose the continuous transfer of vital patient records between third party corporations in an attempt to draw attention and make a positive change toward proper security of patient’s

One type of personal data we should be concerned with keeping secure is Protected Health Information or PHI. PHI is defined in the Privacy Rule section of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) as “"individually identifiable health information" held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral” (U.S. Department of Health & Human Services). While HIPAA was enacted to address the protection of PHI, it falls short of this task because there are no measures to proactively ensure entities are abiding by its guidelines, the penalties are subjective and fail to inflict enough punishment on entities for data breaches and it puts the onus

As health professionals, it’s essential to take every precaution to protect sensitive patient information including personal contact information and medical history. Patient data is regulated by the government and provides privacy and security provisions for safeguarding medical information. The law that regulates these processes, the Health Insurance Portability and Accountability Act (HIPAA), has become a prominent point of public discussion over recent years due to an onslaught of security concerns and cyberattacks on health providers and insurers.

This increase of sensitive data available online, commonly accessed through usernames and passwords, has produced a dramatic jump in healthcare information compromised by data breaches. In 2015, the IRTC reported that a staggering 66.7% of all records compromised in data breaches were in the healthcare industry; in 2014, this number was only 9.7%.

There’s an increasingly new wave of thieves who desire this type healthcare data. This usually includes specific information about an individual’s health status and payment for healthcare.

Security breaches of EMRs vary from someone without consent viewing the patient’s information, to a hacker using the information to steal one’s identity. According to Privacy Rights Clearing House, more than 260 million data breaches have occurred in the United States, including those of health related records. Approximately 12 percent of data breaches involve medical organizations (Gellman, 2012). According to Redspin, a provider of Health Insurance Portability and Accountability Act risk analysis and IT security assessment services, more than 6 million individual’s health records were compromised during a period from August 2009 and December 2010 (Author Unknown, 2010). A provision of the Health Information Technology for Economic and Clinical Health (HITECH) Act requires all breaches affecting 500 or more people to be reported to the Department of Health and Human Services. This reporting is to be accomplished within 60 days of discovery. The Redspin report covering the period above involved 225 breaches of protected health information. The amount of people with access to an individual’s health record creates concern with confidentiality. According to the Los Angeles

The department of Health and Human Services protects and guides the health and well being of individuals here in America (Thacker, 2014). They fulfill these duties providing Americans with adequate and efficient health and human services and monitoring services designed to increase the efficiency of care in the health system (Thacker, 2014). One of the services being monitored by the department of Health and Human Services is the electronic health record system, which carries private and vital information of patient’s health record enabling all eligible participating health workers access to these records (Thacker, 2014). A breach of the protective health information of patients in a health organization creates chaos as these are against the health insurance portability and accountability (HIPAA) law (Thacker, 2014). Hence, measure will have to be put in place to determine what caused the breach and how to rectify it to ensure the breach never happens again (Thacker, 2014).

The rapid changes in technology over the past few decades has left the healthcare industry ill-prepared to operate in today’s environment. Most substantial protections of sensitive consumer information has come as a result of federal regulation, most notably in 1996 with the Health Insurance Portability and Accountability Act and 2009 as part of the American Recovery and Reinvestment Act. Protection of information in the healthcare industry has lagged behind all other industries, perhaps because the records aren’t financial in nature or sensitive government information. Implementing simple steps for many organizations may be enough to limit the vast majority of breaches, although a layered, comprehensive security approach should be the ultimate goal for companies.