‍

The dance of health data begins early

From the first moments after birth, a baby today will have Personal Health Information entered into an Electronic Health Record. This will generally include weight, length, body temperature and any complications during delivery. 

Tracking this type of medical information from the first moment of a patient's life - and ongoing - can offer clinicians a rich tapestry of context about a person's health, which can aid greatly in treatment decisions.
‍

The danger of breached data

While the extensive nature of the data being collected offers huge benefits to patient care, it has its potential pitfalls.

A data breach of any kind is highly problematic, so when health data is involved the potential consequences can be catastrophic for individuals. 

This could include:

● Economic harm like

• Losing a job
• Losing health insurance
• Losing their housing if the wrong type of information becomes public knowledge

● Social harm

• If a diagnosis like AIDS is exploited 

● Psychological harm

● Identity theft - the most dangerous, lucrative and psychologically damaging of them all.
‍

A security breach can also cause disruptions to critical care systems that could literally cost lives due to the lack of access to historical patient information.
‍

Health data is under constant attack

According to the Australian Cyber Security Centre, Australian hospitals are under constant cyber attack.
‍

“Attacks against the health-care sector are dangerous at any time. But when services are under pressure from COVID-19, and information-sharing (including tools such as contact tracing) is increasingly important, an all-out cyber attack against the health sector could be very damaging.”

They’ve also identified healthcare is the most targeted sector, by a significant margin. 

The reason?

Unfortunately, the industry typically features a lack of cyber-security training, lax security practices and chronic underinvestment in technology and digital infrastructure.
‍

Cybercriminals love health data

You might be surprised to know that cybercriminals are especially interested in electronic medical records. 

Why? Because the black market rate for this kind of information is much higher than credit card numbers or bank account passwords. 

Data protection is multifaceted and requires the implementation of strategies that not only react and protect data but also predict and prevent any assaults launched by cybercriminals.
 

How to protect your sensitive medical data 

The goals of security are threefold: 

1. to ensure that only authorised individuals see stored data
2. To ensure that they only see the data when they need to use it for an authorised purpose
3. To ensure the data they see is accurate

Implementing an Information security management system (ISMS) standard, such as ISO27001, is a good start to adding organisation-wide security safeguards, controls, and policy guidelines that can remediate any security gaps. 

This is a risk-based approach that raises awareness across all levels of the organisation. 

This also serves to give customers, staff, and other stakeholders of the organisation more confidence in the organisation's ability to manage their security and cyber threats. 
‍

Your data security checklist should include:

• A clear incident response plan
• Optimised restrictions, access controls and mechanisms
• Performance of regular cybersecurity penetration tests and bug bounties
• Frequent testing of continuity plans
• Regular education of staff
  ‍

How will data security evolve in coming years?

It’s becoming apparent that AI will play a bigger role in combating cyber security into the future, while ironically also being the cause of greater future threats. 

It is hard to predict what the broader landscape will look like as technology is changing at such a fast rate. 

Organisations that are serious about protecting their data will have to proactively employ a team of cybersecurity experts to combat the ever-growing threats. 

The human factor will continue to be an ever-present risk for cyber attacks. The risk-based organisation approach will be important to make sure the entire organisation is aware of all possible attacks and there are controls and policies to help avoid and mitigate them.
‍

The competitive upside of high quality data security

Organisations that are investing heavily in cybersecurity standards and baking these into their offering stand to gain a significant advantage over their competitors.
‍

The organisations that give their clients the confidence that security risks are mitigated will be the ones that will secure long-term contracts - and will ultimately see the greatest success - in the highly sensitive health sector.
‍

You can find out more about the Australian legislation around privacy and data security here.