Over the past few weeks, there have several posts in my LinkedIn feed around the growing concern around insider threats for healthcare organizations. The most recent of these posts was a write-by on Maize Analytics which was a summary of his thoughts on a recent HIMMS study performed by SailPoint. In his (Dan Fabbri) post he calls out the following to combat healthcare insider threats:
The best way to combat insider threats is by combining a training and awareness program with technology. With machine learning, user-based analytics, and artificial intelligence programs that monitor ePHI access, hospitals can catch inappropriate access to patient data.
While this approach is one step in controlling access to sensitive data the reality is that it is not protecting the data. The above approach should be partnered with technical solutions that classify and protect the data that may be exported out of clinical systems. Traditionally, some of the larger healthcare organizations have tried to implement a client (agent) based DLP solution(s) to address this scenario but in a lot of cases have had challenges, if not failures, due to the complexity of these systems.
Given that the majority of the data generated out of a clinical system ends up in an unstructured form (ie Office or PDF files, makes up 85% of unstructured data in most corporations) a technical solution that classifies and protect these files at the time of creation should be considered. One such technical solution that can classify and protect files is Microsoft’s Azure Information Protection (AIP) which automatically labels sensitive files being created by staff.
An example from working with healthcare customers is that physicians were exporting sensitive patient data from the EMR in order to perform clinical research with colleagues at another healthcare organization. This data was being sent in an Excel format via email with no protection and was accidentally sent to a recipient with 1000’s of sensitive patient information. In this scenario, if AIP had been in place the data could have been automatically classified as having sensitive patient information then applied protection (encrypting the file) to ensure that unattended recipients couldn’t have opened up the document. This protection is applied at the file level so even if the file was placed on an external drive, a network share or online storage (Box, DropBox, Google Drive, OneDrive, etc) it would still be safe.
As healthcare organizations adopt Exchange Online and other cloud technologies, leveraging a Cloud App Security Broker (CAS-B) to monitor for sensitive data leaving the organization should be a technical solution to evaluate to further expand data protection.
More information about Microsoft’s Azure Information Protection can protect data is available here.
