Exposing the Risks of Data-Driven Healthcare

This is a guest post from blogger Jared Hill as a special contribution to SafeLogic.

The recent Heartbleed and POODLE data leaks exposed some of the major dangers of living in a digitized world. With the entire healthcare system becoming increasingly reliant upon digital organizational systems, a patient’s most private information — prescriptions, records, communications, you name it — might be vulnerable to hacks. While many hoped doctor-patient confidentiality and legal privacy rights would be easily applicable across the board, this guarantee can simply not be made in the digital realm.

Illegally obtained medical records promise huge sums of money on the black market, more so than customer or banking information, or even risque photos of famous celebrities. Certain kinds of personal information are very valuable for those wanting to pose as someone else in order to obtain medical care. Although there are dozens of cybersecurity-related legislative proposals before Congress and amendments made to pre-existing legislation, notably, the Health Information Portability and Accountability Act (HIPAA), there is still much work to be done to safeguard patients against data hacking.

The Heartbleed “mishap” incited widespread privacy and identity panic, particularly from those within the healthcare sector, but also among other professionals who are now culpable for such dataleaks. It has suddenly become glaringly obvious that thousands of servers are vulnerable to attacks from outside intruders, and it’s also clear that unsophisticated Secured Sockets Layer (SSL) certificates are not as safe as experts believed.  POODLE has illustrated the dangers of misconfiguration and untrusted networks in its own way.

The real question, then, is by what means can healthcare companies safeguard themselves against the next threat?  Some are confident that newly drafted legislation like FedRAMP will be helpful towards that end. One health IT expert was optimistic recently, saying, “Ideally, the FedRAMP regulations will adequately address common security concerns, such as multi-tenancy and shared resource pooling, and provide a standard set of regulations that would ensure secure cloud usage in the Healthcare industry.”  That would be a major step in the right direction.

Whether FedRAMP or the amendments made to HIPAA will increase patient privacy and data security remains to be seen. They may not be strong enough legislation.  Devices are emerging that have the ability to record DNA, heartbeat patterns, and a myriad of other integral and unique personal characteristics. Instead of solely responding to current issues and security breaches, startups and tech industries need to have a conversation now regarding exactly how users will be protected from technology that won’t arrive for another decade.

Rohit Sethi, vice president of security consulting firm Security Compass said, “Maybe down the road our heartbeat, for example, becomes the main way we prove our identities.  And if we didn't protect it 10 years ago, we don't have a way of correcting it. So we have to treat it as serious now because we can’t predict the future."

Sethi has a point, and a frightening one at that. Sethi cites startups (responsible for creating many of the latest apps and storage systems) as a particularly worrisome area. While established companies have spent years understanding security breaches, startups are often run by young, motivated techies who are concerned about the innovation of the product first, and user security as a distant second.

Sethi predicted that, unless strong regulations are implemented and upheld, everything from medical information to our DNA fingerprints could all become subject to theft and misuse. “You can get a credit card reissued,” Sethi said, “but you can’t reset your heartbeat or your DNA.”