The threat of cyberattacks and breaches causing severe harm to healthcare technology and operations, as well as obstructing access to care, motivates healthcare provider organizations to review their data security measures and pursue IT vendors adhering to industry standards like the HITRUST Common Security Framework in their applications and data platform solutions.
Download
Ongoing concerns about cyberattacks and patient data security have left some healthcare provider organizations feeling anxious and ill-prepared to prevent and address data breaches.
Health systems rely heavily on technology and an intricate web of interconnected data warehousing and reporting applications, including electronic health records (EHR), supply chain management, and medical devices and equipment. As a result, the healthcare industry in recent years has become a prime target for cybercriminals because of its valuable data stores and often inadequate security measures. This has led to an increased need for robust cybersecurity and data loss protections in the healthcare sector.
From 2009 to 2022, the U.S. Department of Health and Human Services Office for Civil Rights (OCR) received reports of over 5,000 healthcare data breaches involving 500 or more health records. Those breaches resulted in the exposure or impermissible disclosure of more than 382 million healthcare records. The incidents included ransomware attacks, system or database hacking, unauthorized access, protected health information (PHI) theft, and other IT events.
Healthcare data breaches and cyberattacks rarely occur as isolated, infrequent events but instead pose ongoing threats that demand constant vigilance. As the industry pushes for greater digital connectivity, health systems, and IT vendors must prioritize an active and optimized common security framework that adheres to industry best practices. Omitting this essential process can erode patient trust and leave health systems vulnerable to potential legal and financial penalties.
The impact of ransomware attacks is particularly damaging to the healthcare sector, according to the Sophos: State of Ransomware Healthcare 2022, Part 2 survey. Researchers have determined that it costs an average of $1.85M to remediate a cyberattack in healthcare.
Data security incidents not only result in financial penalties for health systems but can also have severe consequences for hospital operations. Malware or ransomware attacks compromise EHR systems, disable critical data reporting applications, and cut off access to vital information to treat patients or address population health. System downtime due to technical failures or routine maintenance could also affect patient care and lead to poor clinical quality outcomes.
In general, data security breaches in healthcare trigger severe and long-lasting consequences that may include:
The HITRUST® Common Security Framework (HITRUST CSF®) is a certifiable framework that helps healthcare organizations comply with regulations, manage risks, and protect information. It is the industry standard for safeguarding sensitive healthcare data, protecting organizations, and preventing severe financial losses.
Its origins began when healthcare stakeholders, including payers and insurers, sought to fill a gap in the industry with a framework and certification that would satisfy widely accepted security requirements in the U.S. and internationally. As a result, the HITRUST CSF was developed in 2007 to establish a comprehensive set of baseline security controls leveraging existing standards, including ISO (International Organization for Standardization), National Institute of Standards and Technology (NIST), and PCI Security Standards Council (PCI).
The HITRUST CSF normalizes these security requirements and provides clarity and consistency while reducing the burden of compliance with various regulations, such as the Health Insurance Portability and Accountability Act (HIPAA). HITRUST CSF also promotes a culture of continuous improvement to adapt to evolving cyber threats and regulatory requirements. This is especially critical in these uncertain times when data security in healthcare is a top concern for provider organizations and consumers alike.
IT vendors that maintain HITRUST CSF certification as the basis for their data platforms and applications demonstrate their commitment to information security. The protocols define responsibilities in the vendor-partner relationship and hold vendors accountable for routine audits and compliance measures.
Additionally, selecting a vendor partner who has undertaken the rigorous process of obtaining HITRUST CSF certification assures that their data applications and platforms:
Having HITRUST CSF certification instills confidence in data protection and security, which is highly sought-after by hospitals and health systems as they deal with the growing demand for increased data security. Provider organizations must know that their data is secure and protected — and HITRUST CSF certification provides that peace of mind.
- Kevin Scharnhorst, Chief Information Security Officer, Health Catalyst
Health Catalyst announced several of its applications and platforms have met rigorous data security requirements and achieved HITRUST CSF certification, including:
Health systems can leverage the HITRUST common security framework and certified solutions in various ways to their advantage. The following represent five key areas:
Health systems that share electronic health information across providers and facilities can improve patient outcomes and clinical decision-making by applying standard security framework guidelines to internal or external data platforms. Health Information Exchanges (HIEs) facilitate secure data access and exchange within the medical community. HIEs are crucial in simultaneously advancing interoperability and improving care coordination.
Robust data security controls must be in place for hospitals and clinicians to prevent cyberattacks while exchanging data with HIEs. The seamless integration of multiple systems and secure data-sharing with a patient’s care team is possible through frameworks like HITRUST CSF. HIEs rely on Health Catalyst interoperability capabilities through KPI Ninja by Health Catalyst, which consistently applies HITRUST CSF data protection policies and practices to guarantee the utmost security during data access and exchange.
Apart from attaining HITRUST CSF certification through a vendor partner, hospitals and health systems must implement dependable network security protocols across the technology enterprise to protect data security in healthcare. This includes continuously monitoring technology systems for any anomalies such as unauthorized access, conducting an incident response during an incident or breach, and promptly notifying relevant stakeholders.
According to a report by the healthcare consulting firm Kaufman Hall, the industry experienced 20 announced hospital mergers and acquisitions in the second quarter of 2023, the highest number since the first quarter of 2020. While M&A transactions can bring exciting new clinical and financial opportunities and growth, they could also jeopardize organizational data.
One of the main reasons why mergers and acquisitions present unknown data security dangers is the integration of different IT systems from the companies involved. This process requires transferring and sharing data between systems that may have varying levels of security protocols in place. In some instances, one system has gaps or vulnerabilities that could compromise the overall cybersecurity posture of the newly formed entity.
Regulatory compliance is another aspect worth considering regarding data security vulnerabilities in M&A deals. Companies operating in different jurisdictions are often obligated to various stipulations concerning patient data protection and privacy laws.
Therefore, as more data, systems, and people operate under a new and expanded organizational umbrella, health systems must be vigilant and implement necessary precautions to protect sensitive data. Failure to do so makes patient and employee data vulnerable and exposes the organization to legal repercussions, fines, and reputational damage.
Healthcare institutions may mitigate the liabilities associated with M&A activity while protecting themselves from cyber threats by garnering C-suite support to prioritize the following strategies:
Security frameworks, such as HITRUST CSF, offer a structured methodology for undertaking these tasks during mergers or acquisitions, ensuring the secure integration of data assets of newly formed entities.
In 2021, an Illinois hospital fell victim to a ransomware attack that rendered it incapable of processing insurance claims, Medicare, or Medicaid for months, sending it into a financial spiral and eventual closure. This is the first healthcare facility on record to close because of a ransomware attack. The incident suggests that other hospitals could shutter their doors depending on the severity of the cyber breach.
The incident demonstrates the significant financial consequences that a hospital or healthcare provider organization can face because of a data security breach, which is influenced by various factors, such as:
In addition to temporary or permanent closures, cybersecurity hazards that compromise healthcare cost management include:
The Health Catalyst Data Platform adheres to HITRUST CSF standards to protect data warehousing. This layer of security can safeguard a hospital’s financial stability by preventing costly fines, remediation fees, and unwanted data breach exposures. Furthermore, the data and analytics platform is healthcare-specific, open, flexible, and scalable, which seamlessly integrates and organizes disparate data sources to enable self-service analytics.
Leading health systems trust the secure data platform as it enables their organization to:
Mobile health applications and other technological advancements have the potential to improve access to care, fill gaps in treatment, and boost patient engagement. However, there is a valid concern regarding the security of data exchanged through novel communication methods in healthcare settings.
By collaborating with a patient engagement solutions provider that offers applications that safeguard patient privacy and comply with industry regulations, hospitals can significantly improve the protection of patient information transmitted via text or other mobile channels.
Twistle® by Health Catalyst is a leading clinical workflow and patient engagement platform that meets key regulatory, security, and privacy requirements. Twistle utilizes mobile platforms and automated technology to facilitate secure communication between patients and providers. The solution also enables IT practitioners and clinicians to convey programs, policies, and potential risks to stakeholders, including patients, in an easy-to-access format.
A common security framework that provides a solid foundation for protecting against cyber threats, coupled with cutting-edge augmented intelligence tools that offer sophisticated risk models, has the potential to transform healthcare delivery by ensuring patient privacy while empowering decision-makers with actionable insights.
By utilizing AI-powered risk models to proactively recommend interventions, healthcare delivery organizations can achieve long-lasting benefits, enhance financial, operational, and clinical performance, and gain a competitive advantage.
HITRUST CSF is the ideal foundation for these cutting-edge tools as it promotes ongoing assessment and improvement of security measures to adapt to evolving threats, track data protection progress, and identify gaps. As a result, teams can confidently collaborate and implement recommended organizational improvement strategies using such solutions while ensuring compliance with industry information security and protection standards.
Hospitals and other medical organizations can limit their financial, clinical, and operational data from exposure to cyber threats by partnering with IT vendors recognized for systems and applications that safeguard patient data, achieve compliance, and maintain patient and provider trust.
HITRUST CSF takes a holistic approach by considering all relevant regulations into a single risk management framework. This approach simplifies the compliance process for health systems and solutions providers, saving time and resources while addressing various requirements.
The decision for health systems to choose the HITRUST common security framework stems from its ability to simplify compliance efforts and ensure ongoing monitoring for improved data and cybersecurity resilience.
Leading IT vendors and health systems prefer HITRUST CSF for the following five reasons:
By implementing the proper security measures and working with expert partners, healthcare provider organizations can minimize exposure to cyberattacks and protect sensitive patient data. Take action today to uphold patient well-being, protect organizational data, and ensure safe operations with a proactive and sustainable defense against cyber threats.
Would you like to learn more about this topic? Here are three articles we suggest:
COVID-19 Healthcare Cybersecurity: Best Practices for a Remote Workforce
The Healthcare Cybersecurity Framework: A Top Defense Against Data Breaches and Attacks
Twistle by Health Catalyst Achieves HITRUST CSF® Certification
