Systems Thinking on a National Level, Part 2Drew David.docx
- 1. Systems Thinking on a National Level, Part 2 Drew Davidson, Eric Sinclair Banyon, Shady Navarro, Shalamar Santana, Ziomara Pagan, & Stephanie Jean Coute MHA/505 February 11, 2019 Rachael Kehoe Running head: SYSTEMS THINKING ON A NATIONAL LEVEL, PART 2 1 SYSTEMS THINKING ON A NATIONAL LEVEL, PART 2 10 Systems Thinking on a National Level, Part 2 Cybersecurity breaches in the Healthcare industry pose a significant threat to those organizations. According to Gordon et al., cybersecurity breaches not only affect the patient’s information but it can also affect the organization's creditability (2017). When an organization creditability comes into question due to a cybersecurity breach, that organization may lose customers due to the fear of their information not being appropriately protected. In Healthcare it is crucial that we understand the impact of cybersecurity breaches. Most of the major hospital in the United States are using electronic medical records (EMR). A lot of hackers are using phishing methods to
- 2. trick hospital and breaching their security protocol by tricking staff members into disclosing sensitive and personal information (Winder, 2014). Therefore, the following will discuss way cyber security breaches happen in the healthcare industry and way to prevent them from happening in the future. Cyber Security Breach Diagram Malicious and Non-Malicious Cyber security breaches in healthcare can happen in several different ways. These different types of breaches can either be malicious or non-malicious. A malicious cyber security breech in healthcare, is when an individual or individuals purposely hacked into and attack or gain unauthorized access to members PII. Unauthorized access (such as hacking) to protected healthcare systems is the result of malicious behavior, things like holding the system ransom or stealing private information are acts of malicious behavior (Katz, 2018). Penetrating a system manually and disabling the systems defenses or by downloading software programs are other types of malicious behavior. Hacking is a malicious behavior, but just because the system is hack doesn’t necessarily mean any personal information is compromised. A number malicious cyber security breach may not be done intentionally but can cause just as many issues as a malicious cyber security breech. When data is unintentionally left exposed to an authorized access it is a non- malicious behavior. Cyber security breaches in healthcare can be the result of employee error or negligence. In healthcare malicious behavior is a portion of the inflow of cyber security breaches and non-malicious behavior is the portion of the outflow of a cyber security breech. Eavesdropping As a group, we have identified a multitude of cybersecurity breaches that are growing concerns amongst the healthcare providers and companies that offer their services to the community. Another one of these concerns’ hails in the form of
- 3. eavesdropping. Eavesdropping is a dilemma within the healthcare industry. As we advance in the use of technology about how we communicate patient’s private information, eavesdropping is one of those breaches that causes heighten awareness. As the industry advances in the transmission of information via cyberspace, the threat of information falling in the hands of those who seek criminal activities are more prevalent. According to Epic University (“Epic University, ”2019) The term 'eavesdropping' is used to refer to the interception of communication between two parties by a malicious third party. Since the beginning of the digital age, the term has also come to hold great significance in the world of cybersecurity. Using wireless services, smartphones, and handheld computers must have protection at all cost. The encryption of these devices is by far the most critical aspect of protecting consumers information where this level of communication rules. If these devices are not able to be encrypted to protect the consumers, they should not take precedent. Eavesdropping, within the industry, affect all areas of cybersecurity. This phase of cybersecurity is like the kryptonite of all virus. Eavesdropping can infiltrate all aspects of cybersecurity and reap major havoc for any organizations. It is essential that we understand what eavesdropping can do to an organization and provided the necessary tools to combat these threats. We as individual and organizations must obtain the required education, training, and etcetera to help protect the consumer's personal information. SQL Injection Attacks Not only is eavesdropping being a problem, but so is having to deal with SQL injection attacks. Eavesdropping along with the other forms of cybersecurity attacks cannot be ignored, but this attack can cut a bit deeper and cause an organization to lose creditability. This attack affects the coding of a healthcare organization, and coding within the healthcare system is like peanut butter and jelly. It’s like mostly you cannot have one without the other. Here we are talking about getting deep into a
- 4. database to retrieve a personal information phone number, address, financial information, etcetera. If the wrong individual obtains that vital information, an organization will have to deal with potential liability that is tough to recover. This type of attack is getting to the heart of the administrative side of thing. Some of the most critical information is housed for the patients, and information that violates so many different aspects of a patients record. Imagine if this attack happens at a large Hospital and the Cyber thieves were able to decode the system and completely wipe their database system. I know this is not something you would want to be a part of figuring out. These attacks are why it is super essential for employees to be very cautious when handling patient’s information. Protecting the privacy of your passwords, not opening phishing emails, not violate HIPAA rules, not leaving data exposed, and etcetera is vital. This type of attack happens typically via a company Website. All in all, education of how to spot these threats, and not allowing or minimizing vulnerability goes a long way. This attack, as well as the other attacks mention, will forever be a part of our lives. But being prepared to combat these threats can make the difference between success and failure of any organization. HIPPA HIPPA is an internal source of threats to healthcare information security. Goals of data security are to allow access to healthcare information to authorized individuals, allow access only when needed and retrieve what is accurate for use (Donald & Berwick, 2018). HIPPA has many gaps which should be addressed. First, the privacy rule should be made applicable to all healthcare entities and not only those covered. This means, it must be made a mandatory. Second, the security rule should not only cover electronically stored data but also paper records. Lastly, all covered entities have not fully complied with HIPPA requirements, a more serious threat to information. Unless these are addressed, insecurity will still be a problem.
- 5. Data Loss As an industry, healthcare institutions need to implement strategies that can prevent data loss while ensuring privacy and security of information. Prevention of data loss can be done by configuring solutions that are designed to protect sensitive data (Abouelmehdi et al., 2018). This data include Electronic Medical Records, Protected Health Information and other data so that it is not accessed and misused in anyway by unauthorized users (Abouelmehdi et al., 2018). Data loss prevention tools are helpful for monitoring endpoints, streams of network data and cloud, thus protecting data from any potential loss to any insider or outsider. Phishing Emails Phishing emails are a huge thing for hackers to get into health care systems and get protected health information. In fact, ninety-three percent of the breached data in the health care industry is due to phishing emails ("Perils Of Healthcare Phishing And What You Can Do About It", 2019). Then calculated the eighty-three percent of all doctors have experienced cyber-attacks from phishing emails ("Perils Of Healthcare Phishing And What You Can Do About It", 2019). Many of these attacks have caused a full day of clinical downtime. How do the hackers do it? The phishing emails look just like an email a staff member would receive that is safe and from a trusted source ("Perils Of Healthcare Phishing And What You Can Do About It", 2019). Phishing emails have caused one- hundred and fifteen million-dollar lawsuits on health care facilities ("Most Common Phishing Emails Identified", 2019). That is more than most have for revenue in a year. Then there are at least six-teen phishing emails sent to the facility and each staff member every thirty days ("Most Common Phishing Emails Identified", 2019). There has to be quarterly training on the newest phishing email trends according to HIPAA. The most common phishing email in the health care industry is fake payments. Health care in America has become so costly and the hackers have caught on that all healthcare providers have an
- 6. account that is in default so making malware look as though it is a payment or is about a payment is the easiest way in to the protected health information ("Most Common Phishing Emails Identified", 2019). Data Exposure The increase of technology in the healthcare industry has provided many health organizations with the ability to monitor their patients remotely through digital devices and electronic health records. The healthcare data is often collected and stored into a cloud base system where healthcare providers can have access anywhere to the patient's data in real-time. However, the vast network of devices that are connected directly with each other to collect, process, and share vital information has put many healthcare organizations at great risk for cybersecurity breaches. "Failed security has resulted in massive data breaches that have led to the loss or compromise of millions of personally identifiable healthcare records. Historically, the security of information systems, in general, has not been seriously considered in many instances until a breach has occurred." (Moganedi, 2018, p. 297). Therefore, it is significant for healthcare companies to take measurable actions to prevent their patient's information from being accessible to unwanted users. Such measures can be made by performing annual HIPPA security risk analysis, implementing role base permission only for individual employees to have access to certain areas of the database, and requiring employees to change their username and password frequently. Password Protection Password protection is so very important when dealing with access to protected health information. Having to change passwords at least every three months seems so difficult and so annoying to many health care providers. HIPAA is in healthcare it may be the first true definition learned. HIPAA has certain requirements that are put on passwords for accessing protected health information. HIPAA wants there to always be a two factor authorization for logging in to protected health
- 7. information ("The HIPAA Password Requirements And The Best Way To Comply With Them", 2018). This means that a username and password are required plus a pin number ("The HIPAA Password Requirements And The Best Way To Comply With Them", 2018). Protected health information is personal and should always be protected especially when getting the information or storing the information electronically. HIPAA also requires every password to access the protected health information to be at least eight characters long("The HIPAA Password Requirements And The Best Way To Comply With Them", 2018). This of course is using numbers and letters. A suggestion from HIPAA for making a password to gain access to protected health information is that the capitalization is random and that you take a phrase that you can remember then mix up the spelling ("HIPAA Security And Privacy ", 2003).There are penalties involved with sharing passwords for gaining access to protected health information one is up to two-hundred and fifty thousand dollars in a fine and the other is up to ten years in prison ("HIPAA Security And Privacy ", 2003). There are simple rules to follow when making sure that your password is protected. It can be devastating if someone unauthorized gains access to protected health information. Take our military and wars into consideration, what if during a war a main terrorist is after a certain general and hackers can decode a password to protected health information to find the generals information of what hospital he is at. Think about law enforcement there have been many in the news lately and an officer involved shooting can cause quite an uproar. Imagine the wrong person gaining access to the officer involved address or where he was being treated at. The results from these situations would make a bad situation even worse. These are just a few reasons why password protection in the health industry is so important. Viruses All it takes is one click, and the virus could spread like wildfire. That is why it is so vital that healthcare organization train their employee on how to look out for possible phishing
- 8. emails which is the highest risk for health organizations to receive a virus. “Before 2016, healthcare organizations were not thought to be a primary target for ransomware. However, 14 hospitals had become the target of ransomware, and a total of 173 hacking/information technology (IT) incident data breaches had been officially reported by October 16, 2016, 17, 18. Hospitals have become an easy target for hackers for two reasons: The necessity of computer storage of information associated with patient care and the security holes in IT systems" (Spence, Bhardwaj, & Paul, 2018, p. 2). Therefore, healthcare organization must take actions by training their staff never to open up unknown emails, documents or download unknown files. Also, healthcare organizations must implement preventive measures such as having the latest virus software and running daily virus scans on all electronic devices within the organization. Without the proper actions taken to prevent data breaches within the healthcare industry, the percentages of cybersecurity attacks will continue to rise putting patients at risk. Conclusion Cybersecurity breaches in the Healthcare industry pose a significant threat to those organizations. That is why security breaches in the healthcare organizations must be handled immediately for the safety and security of the patients. Therefore by educating the staff about various ways security breaches can occur and ways to prevent them from within and outside the organization, then the decrease in cybersecurity beaches will began to improve in the healthcare industry. Reference Epic University (2019). What is Eavesdropping in Computer Security? Retrieved from https://www.ecpi.edu/blog/what-is-eavesdropping-in- computer-security. Gordon, W. J., Fairhall, A., & Landman, A. (2017). Threats to information security—Public health implications. New England
- 9. journal of medicine, 377(8), 707-709. Moganedi, S. (2018, June). Undetectable Data Breach in IoT: Healthcare Data at Risk. Cyber Warfare and Security, 8(1), 296- 298. Retrieved from https://search-proquest- com.contentproxy.phoenix.edu Most common phishing emails identified (2019). Retrieved from https://www.hipaajournal.com/most-common-healthcare- phishing-emails-identified Perils of Healthcare phishing and what you can do about it(2019). Retrieved from https://healthitsecurity.com/features/perils-of-healthcare- phishing-and-what-you-can-do-about-it Spence, N., Bhardwaj, N., & Paul, D. (2018, June). Ransomware in Healthcare Facilities: A Harbinger of the Future? Perspectives in Health Information Management, 1-22. Retrieved from https://search-proquest- com.contentproxy.phoenix.edu Storm, D. (2015). MEDJACCK. Hackers Hijacking Medical Devices to Create Backdoors in Hospital Networks. The HIPAA Password Requirements and the Best Way to Comply With Them(2018). Retrieved from https://www.hipaajournal.com/hipaa-password-requirements Winder, D. (2014). "Phish Your Own Staff: Arming Employees to Beat Modern Attacks," Info security, Nov. 28, 2014.