Despite the data privacy protections supposedly conferred by regulations like HIPAA and HITECH, consumers’ confidential health and personal information is still not safe enough. That’s the lesson to be learned from Franklin, TN-based Community Health Systems’ (CHS) August 18 regulatory filing. In the filing, CHS disclosed that the names, SSNs, addresses, birth dates, and phone numbers of approximately 4.5 million people across 28 states have been stolen, according to Computerworld. Those 4.5 million victims, whom Computerworld reported had either received or been referred for services to CHS-affiliated physicians, are now at risk of identity theft, thanks to the security weaknesses of their healthcare provider. This latest large-scale data breach serves to highlight just how critical data security is in today’s connected age.
Computerworld reported that the breach is being investigated by Mandiant, which “believes that a known Advanced Persistent Threat (APT) group, based in China, is responsible for the breach.” Computerworld further notes that “since the breach was discovered, CHS is working with Mandiant to clean out its systems and implement new remediation measures” as well as cooperating with federal investigators. These post-incident measures come a bit too late to protect those 4.5 million victims, or CHS’s reputation itself, but provide a fresh reminder to other healthcare organizations that data security matters.
And HIPAA and HITECH aren’t the end-all, be-all of healthcare data security. As CIO.com pointed out after the CHS breach was disclosed, “many organizations pay little more than glancing attention to the rules because of the relatively lax enforcement of the standards.” Even though regulations are growing stricter and penalties stiffer, auditing requirements still fall behind those of other regulated industries, such as financial services. Healthcare organizations see little incentive to beef up their data security. Then a breach happens, and both patient trust and public reputation suffer.
What’s the Solution?
Healthcare organizations must see the CHS breach as a wake-up call to reevaluate and strengthen their data security measures. And this process must go all the way to the top of the organization. As CipherCloud Chief Trust Officer Bob West has pointed out, security leadership is absolutely essential at any security-conscious enterprise. Having data security leadership that’s independent of the IT department and able to communicate and work effectively with the business, legal, and financial leadership of the organization will go a long way towards making sure that patient data gets the attention and protection it needs. Risk assessments, data classification, strict access controls, and data encryption are all critical components. So is a change in culture to one that values data privacy and data security enough to invest in it.
The consequences of this lack of security leadership and prioritization may not always be apparent when regulatory bodies are lax in enforcing their own rules, but they will become all too apparent to any healthcare provider that suffers a breach like CHS did. If you want to prevent your organization from becoming the next CHS, you must act while you have a chance. Protect your data before it comes under attack so that you won’t have to suffer the aftermath of one for which you weren’t prepared. The alternative is to lose control of millions of patients’ data—and millions of patients’ trust.
What lessons have you learned from the CHS data breach? Tell us what you think in the comments.