Why hackers are increasingly targeting electronic health records
Credit to Author: Trend Micro| Date: Mon, 03 Apr 2017 16:41:02 +0000
Over the past three years, the number of attacks on healthcare institutions have skyrocketed. In 2016, on average, at least one health data breach occurred every day, totaling in about 450 successful attacks over the course of the year, according to a report from Protenus.
The healthcare industry is feeling the brunt of hacker attention more so than any other sector. But what exactly makes this information and this sector so attractive to cyber criminals? Let's take a closer look at why hackers are increasingly targeting electronic health records and how healthcare providers can implement better protections.
EHR is a sitting duck
Before EHR, healthcare institutions had a hard time maintaining, sharing and searching for patient information. Paper copies could be easily lost or misfiled among other paperwork. This fragmented system made it particularly difficult to pass along necessary information to different providers, say from a primary care doctor to a specialist, about the same patient, The Washington Post stated. Lack of coordination often led to inappropriate or duplicate tests and procedures and unnecessary spending. This disconnect between providers posed health risks to patients and likely resulted in poorer outcomes.
EMR has a vast amount of personal information that fetches high paydays for hackers.EHR emerged as the tool that would leave these issues in the past. Doctors could easily send and access vital information quickly, ensuring that they could deliver the best care possible. However, this technology isn't perfect. It has vulnerabilities that attackers can use to breach systems and steal information.
In 2009, there was a major federal push for health files to go digital, with financial incentives for those that adopted EHR systems. Many healthcare providers were forced to abide by these government regulations, even if they weren't adequately ready to invest in protection of EHR software. For example, The Kernel noted that healthcare technology is often outdated and insecure, leaving systems vulnerable to attack vectors long after they are discovered. EHR is a sitting duck for any hacker that understands how to navigate networks that don't have complete protection.
"PII is being leveraged to make new offerings on the Underground."
Patient records fetch big pay days
Further contributing to the issue at hand, healthcare documents contain a vast amount of personally identifiable information that can be lucrative for cyber criminals. Patients fill out details including their name, address, Social Security number and payment information. Attackers can also see patient conditions, medications and history records within compromised EHR files. Each dataset is significantly valuable, particularly when sold in underground markets. Buyers might use these files to commit identity theft and medical fraud.
PII is leveraged to make new offerings on the dark net, opening up new opportunities for hackers to make money. Trend Micro research found that EHRs are being used to create fraudulent documents like fake IDs, tax returns and birth certificates. People can even buy drugs with stolen prescriptions, giving them access to controlled substances like Ambien. It's important for healthcare institutions to bolster their defenses to prevent abuse and protect patients.
EHR benefits healthcare processes, but it also leaves files open to attack if it's not properly secured. According to Dark Reading, a complete EHR database can go for as much as $500,000 when sold on the Dark Web. Cybercriminals are increasingly seeing this opportunity as more successful and lucrative than attempting breaches against other industries.
Healthcare institutions and providers must ensure that their systems are updated and that security measures are in place to protect EHR and monitor network behavior. Data breach tools can identify unusual activity as it happens, enabling organizations to quickly mitigate hacking attempts and minimize potential damage.