2018-07-12
医疗行业在处理黑客攻击风险方面步履缓慢，数据泄露事件不断增加。安全专家必须更积极主动地保护患者的安全。
想象一下，一家当地医院的IT系统被黑客入侵，黑客威胁要在网上发布患者的姓名、地址和病历。在2016年9月，俄克拉何马州的6000名患者就遭遇了这样的事情。
正如安全专家所知，这只是医疗数据盗窃的其中一个例子。埃森哲（Accenture）的最新研究发现，多达26％的美国消费者遭遇了医疗数据泄露事件，在这其中，有50％的人之后又遭遇了医疗身份盗用。
大多数消费者都意识到了在线交易的风险，但是很少有人能够意识到医疗身份盗用及其可能造成的损害，这就要求安全专家提供更强大的防盗措施，要求医院在遭遇数据泄露期间和之前更好地进行管理。
医疗数据包括测试结果和诊断，还包括社保号、出生日期、联系信息和驾照号码。这些信息共同构成了一个在线身份。安全专家知道黑客能够利用这些信息来做什么。这些个人信息或医疗数据被售卖，黑客可能以此威胁医院支付赎金，否则就“在网上公布数据”（如俄克拉荷马州事件），或阻止医院访问这些重要信息。
其他行业正在加紧步伐应对数据安全，所以旨在窃取个人数据的黑客不得不换个目标。而且，大多数医疗信息是以电子方式存储的，可以追溯到好几年前，因此对黑客来说医疗行业就是瓮中之鳖。在2016年，医疗行业发生了377起数据泄露事件，占所有数据攻击事件的34.5％。在2017年，截至2月中旬，已经发生了144次数据泄露事件。看来，这种趋势正在加速。
一个合乎逻辑的问题是：“这些数据泄露事件发生在哪里，应该如何阻止？”根据埃森哲的研究，数据泄露事件最有可能发生在医院，其次是急诊室、药店、医生办公室和健康保险公司。通常情况下，医疗机构无法及时发现问题：在遭遇数据泄露的美国消费者中，有一半是因为信用卡对账单或利益解释有误而自己发现了数据泄露。只有三分之一是被医疗机构告知了数据泄露事件，只有15％是被政府机构告知的。安全专家了解医疗信息泄露的潜在机会，能够帮助医院系统和整个医疗行业加强防御措施，以确保消费者数据安全。
医疗机构有义务（和固有的利益）来保护医疗和金融数据。当安全措施不足时，就会导致数据泄露和之后的数据窃取。埃森哲的研究表明，许多受影响的消费者会采取行动。受影响的受访者或者更换了医疗服务提供商（25％）或保险计划（21％），或寻求法律顾问（19％）。根据最近的趋势和事件来看，安全专家的作用只会越来越重要。
许多消费者首先了解数据泄露对其财务状况和健康状况的影响。每起医疗身份盗用事件的受害者平均损失为2500美元，与信用卡数据泄露不同，身份盗用的受害者通常没有追回损失的权利。有趣的是，埃森哲的调查发现，当医疗机构主动与消费者进行沟通时，追回损失的几率仍然很高。在安全专家看来，这再一次说明了提前准备好应对潜在攻击的重要性，这样，医疗机构能够迅速采取行动，在事件发生期间或之后帮助减轻消费者的恐惧心理。
医疗服务提供商是时候更加认真地看待数据窃取了，安全专家也是时候在患者和医疗机构之间建立更强大的信任关系了。首先，以下几个措施能够帮助保护消费者数据：
敦促消费者监督医疗记录并阅读所有声明。如果病历不准确，那么他们的数据可能与其他人的混合了。敦促患者密切关注医疗服务提供商给出的病历和声明，并要求他们至少每年一次给出摘要。
提醒消费者查看其信用报告。信用报告的任何差异都有可能意味着消费者的医疗数据已经受到了侵害。
不要过分分享信息。消费者只应该提供所需的最低限度的个人信息，例如医疗服务提供商不需要患者的社保号。消费者还应该警惕虚假通信：在2015年的Anthem数据泄露事件之后，受害者报告称接到了钓鱼电话和电子邮件。
立即发出警报。如果消费者发现任何异常，应立即通过用户友好的渠道告知医疗服务提供商或保险公司。
《How Security Pros Can Help Protect Patients from Medical Data Theft》
Reza Chapman
7/13/2017
The healthcare industry has been slow to address the dangers of hacking, and breaches are on the rise. Security pros must be more proactive in keeping people safe.
John Schoew, Managing Director, North America Health & Public Service Security Lead for Accenture, contributed to this article.
Imagine discovering that a local hospital's IT system has been hacked and the hackers are threatening to publish patients' names, addresses, and medical records on the Internet. In September 2016, this happened to 6,000 patients in Oklahoma.
As security professionals know, this is just one example of many when it comes to medical data theft. New research from Accenture finds that a startling 26% of U.S. consumers have experienced a healthcare data breach, and 50% of these people subsequently have been victims of medical identity theft.
Most consumers are aware of the risks of online transactions, but far fewer are aware of how susceptible they are to medical identity theft — and the damage it could cause — leaving room for security professionals to help promote stronger anti-theft measures, and allowing hospitals to better manage breaches when and before they occur.
Identity Crisis
Medical data is made up of test results and diagnoses, but it also includes Social Security numbers, dates of birth, contact information, and driver's license numbers. Together, this information creates an online identity. Security professionals are aware of what a hacker could or might do with this level of detail. Mixing identities by selling personal information or falsely obtaining healthcare could lead to dangerously muddled patient records. Hackers might threaten to "dump the data on the Internet" unless the organization pays a ransom, as in the Oklahoma case, or block the organization from accessing this vital information altogether.
Other industries are stepping up their games in terms of data security, so hackers coveting personal data have had to look elsewhere. And, with most health information held electronically and dating back years, the medical sector is a sitting duck. In 2016, there were 377 data breaches in the healthcare/medical industry — 34.5% of all data attacks. In 2017, there had already been 144 breaches by the middle of February. It appears that this trend is accelerating.
A logical question is likely to be, "Where are these breaches happening and how can they be prevented?" According to Accenture's research, breaches were most likely to occur in hospitals, followed by urgent-care clinics, pharmacies, physicians' offices, and health insurers. Often, organizations are late to detecting a problem: half of U.S. consumers who experienced a breach discovered it themselves through an error on their credit card statement or benefits explanation. Only a third were alerted to the breach by the organization where it occurred, and just 15% were alerted by a government agency. Security professionals, aware of the potential opportunities for healthcare information breach, are capable of helping hospital systems, and the industry overall, strengthen defenses to help ensure that consumer data is safe.
What Security Pros Can Do
Healthcare organizations have an obligation — and an inherent interest — to protect medical and financial data in their care. When security practices fall short, resulting in a breach and subsequent data theft, Accenture research indicates that many affected consumers will take action. Affected respondents either changed healthcare providers (25%) or insurance plans (21%), or sought legal counsel (19%). Based on recent trends and incidents, the role of security professionals will only become more important in making the protection a reality.
Many consumers understand firsthand the impact that a breach can have on their finances and potentially their health. The average out-of-pocket cost for victims of medical identity theft is $2,500 per incident — and, unlike the subjects of credit card breaches, victims of medical identity theft often have no automatic right to recover their losses. Interestingly, Accenture’s survey finds that retention rates remain high, despite a breach, when healthcare organizations proactively communicate with consumers. For security professionals, this reiterates the importance of preparing in advance to manage a potential attack so that quick action can be taken to help assuage potential consumer fears during or after an incident.
It's time for providers to take data theft more seriously, and for security professionals to recognize an opportunity to build greater trust between patients and healthcare entities. To begin, here are a few simple reminders of measures security professionals can continue reinforcing to help protect consumer data:
Urge consumers to monitor medical records and read all statements. If patient records are inaccurate, their data might have been combined with someone else's. Urge patients to pay close attention to records and statements from providers, and to ask them for a summary at least once a year.
Remind consumers to check their credit report. Any discrepancies on credit reports could mean that consumers' medical data has been compromised.
Discourage oversharing. Consumers should only give out the minimum personal information required — healthcare providers do not need a patient's Social Security number, for example. They should also be alert to phony communications: following the 2015 Anthem breach, victims reported receiving phishing phone calls and emails.
Raise the alarm — promptly. If consumers discover anything unusual, they should be encouraged to immediately let providers or insurers know, and should have access to user-friendly channels through which to do so.
附件：
《How Security Pros Can Help Protect Patients from Medical Data Theft》--原文.pdf
《How Security Pros Can Help Protect Patients from Medical Data Theft》--译文.pdf
微信公众号