Healthcare Law Blog

Healthcare Entities: How is Your Cyber Security?

In an evolving world of cyber terrorism where individuals such as Edward Snowden grab headlines by stealing national secrets, it should come as no surprise that protected healthcare information (“PHI”) kept by providers has become a “target rich environment” for foreign governments and individual hackers alike. In addition to threats from outside entities, healthcare providers must also realize and appreciate that state and federal regulatory and statutory requirements govern the creation, maintenance and protection of PHI, including through but not limited to the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and the Health Information Technology for Economic and Clinical Health (“HITECH”) Act.  Failure to abide by these complex and stringent rules can lead to significant penalties. 

When patients see healthcare professionals, they anticipate that their medical problems will be solved, not that the information they give to their provider will become public knowledge. Patients, now more than ever, have come to expect that their PHI is secure and safe from hackers. Yet ransomware –the holding hostage of electronic data and the threat to publish or continuously block the health care entities’ access – is unfortunately now an almost daily occurrence. Hacking of the healthcare industry is especially profitable as the breach and potential exposure of PHI can force affected healthcare entities to pay significant monetary amounts to re-secure their data or simply to re-gain access to their systems. In fact, according to Becker’s Hospital Review, 77% of organizations recently surveyed suffered a form of cyber-attack in 2017. Just over half of those organizations, 55%, fell victim to a ransomware infection in 2017. 

Assessment of your cyber security risk is the most important initial step in determining how exposed your healthcare entity is and how effectively your entity can respond to a known cyber security threat. However, an assessment is just one step in a multi-layered approach to protect your healthcare entity, patients and employees. In determining how to better secure your operating systems and PHI, your entity should consider the following steps:

 1.    Encourage and grow a culture of governance and compliance among your employees to properly utilize and retain PHI and other data;

2.    Ensure that your entity has a dedicated IT system and qualified personnel to operate not only the system, but respond to known threats;

3.    Always provide the opportunity for your employees to continually train and improve their IT / cyber security knowledge without hesitation;

4.    Establish effective and efficient policies, procedures and protocols for data compliance, security and responses to potential breaches; and

5.    Utilize up-to-date encryption software and processes.

The cyber security threat continues to evolve every day. To ensure that your healthcare entity is up to speed on the wide array of federal and state requirements, or to assist with a known breach, McBrayer’s healthcare team is online and able to remote in to assist. Feel free to contact me with any questions.

William J. George is a Senior Attorney at McBrayer law and is located in the firm's Lexington office.  Mr. George focuses his practice on administrative law, corporate investigations, criminal defense, healthcare law and malpractice and professional liability defense.  He can be reached at wgeorge@mcbrayerfirm.com or (859) 231-8780, ext. 1263.  We take a team approach to deliver effective counsel to all our clients, so other attorneys in the firm may perform these services as well.

This article does not constitute legal advice.