What are the risks to health information?

Risks to Health Information: Cybersecurity Threats and Privacy Concerns

Health information faces significant risks including data breaches, cybersecurity attacks, privacy violations, and misinformation that can directly impact patient morbidity, mortality, and quality of life. 1

Primary Security Risks

Cybersecurity Threats

• Data breaches: Both unintentional and malicious breaches have been reported by healthcare companies, diagnostic companies, and medical device manufacturers 1
• Ransomware attacks: Recent attacks on healthcare sectors highlight vulnerabilities in digital health systems 1
• Theft of medical records: Allows criminals to gain access to financial services and healthcare 1

Privacy Vulnerabilities

• Information siloing: Leads to inefficiencies, waste, and errors in healthcare delivery 1
• Unsecured communications: Non-HIPAA compliant technology exposes physicians and patients to protected health information breaches 1
• Commoditization of personal data: Risk of "services for data" business models where personal health data is sold to third parties 1

Technological and Human Factors

System Vulnerabilities

• Legacy systems: Outdated technology creates security gaps 2
• Complex network-connected devices: Multiple entry points for attacks 2
• Lack of standardization: Wide variations in semantics, coding standards, and data formats 1

Human Elements

• Unintentional insider threats: On average, more patient records are compromised from human error than malicious attacks 3
• Phishing susceptibility: More records are compromised from phishing scams than any other reason 3
• Limited digital literacy: Users often struggle to evaluate information sources 4

Misinformation Risks

• Health misinformation online: Large amounts of inaccurate health information can lead to poor health decisions 1
• Confirmation bias: Users tend to search for information that confirms initial incorrect hypotheses 4
• Severe consequences: Misinformation about health can directly impact quality of life and mortality risk 1

Recommendations for Protection

For Healthcare Teams

1. Use secure platforms: Employ secured and certified technology integrated with standard EHRs 1
2. Understand limitations: Electronic communication should not be used in isolation without confirmation of receipt and comprehension 1
3. Regular system updates: Update decision support systems regularly to mitigate changes in data quality and population characteristics 1

For Healthcare Organizations

1. Implement clear policies: Establish communication agreements between healthcare teams and patients/guardians 1
2. Ensure regulatory compliance: Create systems to ensure awareness of state and federal requirements 1
3. Implement blockchain technology: Consider using blockchain for tagging data ownership, providing traceability, and enabling incentive programs for sharing data 1

For Patients and Data Protection

1. Patient data ownership: Patients, not vendors or health systems, should "own" their data and control access 1
2. Appropriate firewalls: Place appropriate firewalls and regularly updated cybersecurity measures 1
3. Encryption requirements: Use encryption for sensitive communications containing protected health information 1

Future Directions

• Coordinated national approach: A national strategy for protecting health data would likely be more secure than reliance on individual health systems and vendors 1
• Standardized data formats: Technical shifts to consumer-driven technology might provide a catalyst to standardize biosensor and data formats 1
• Acceptable risk threshold: Stakeholders need to determine an acceptable risk threshold below which data sharing can occur for the benefit of global medical knowledge 1

Healthcare organizations must prioritize cybersecurity investment and training while balancing the need for data accessibility with robust protection measures to safeguard patient information and prevent potentially life-threatening consequences of data breaches and misinformation.