Managing insider threats in healthcare

Often when discussing common healthcare security threats, external breaches are the main focus. However, recent evidence shows those breaches are not the biggest concern to hospitals – they’re more concerned with breaches that can happen within their own halls, by their own internal staff. HIMSS Media recently conducted a study on behalf of SailPoint, and the consensus was that healthcare provider organizations are highly concerned with insider threats. 43% of healthcare provider respondents said they were more concerned about insider threats to data than external breaches. Given this concern, it would be assumed that these organizations have the technology in place to help them audit internal accesses; but this is currently not the case. Instead, the top tactics to deter insider threats are training and awareness programs for users. While these are both important, training can only do so much, and it cannot be the complete process for preventing and detecting internal threats. The best way to combat insider threats is by combining a training and awareness program with technology. With machine learning, user-based analytics, and artificial intelligence programs that monitor ePHI access, hospitals can catch inappropriate access to patient data. Although these programs have recently been on the rise in the healthcare industry, only 48% of healthcare provider organizations use access behavior monitoring and analytics as part of their approach to detecting insider threats. Many compliance officers are still using manual solutions for their internal auditing, which is time-consuming and cannot scale with millions of accesses per day. There’s always a level of uncertainty when adding a tool to an auditing process. Users wonder if it will actually help, or if it will add more work to their day, making their job more difficult. When exploring potential tools, users should search for a patient privacy monitoring system that is easy to use, ensures smooth integration into their current process, and will allow them to review and approve auditing policies, so they can explain what the machine algorithm is doing and define their policy to regulators if needed. It’s clear that insider threats are a high-priority concern, yet healthcare provider organizations are only beginning to leverage the powerful technology available to monitor these accesses. A proper training and awareness program combined with an auditing system that can detect and report on unauthorized access is vital to all of these organizations. Contact us for more information on how Imprivata can help you manage insider threats to your healthcare institution.