Joe Hannan

home

authors

joe-hannan

If you think of keeping your healthcare organization’s data secure as an “administrative nuisance,” then you need to think again.

 The recent attacks against the National Health Service and a Pennsylvania-based organization highlight how cybersecurity needs to be at the forefront of industry leaders’ minds, the article authors wrote.

The threat against healthcare systems, they said, is mounting. Citing a study by the independent 

, the authors said that about 90% of surveyed healthcare organizations have experienced data breaches during the past two years, with 64% saying the attacks were directed toward medical files in 2016. That’s a year-over-year increase in medical-file attacks of 9%.

There’s a reason why medical files are especially valuable to hackers, the authors explained. That’s because the information contained in those files is “durable.” Unlike social security numbers, credit card numbers and insurance information can all be changed. A patient’s medical records cannot. This means hackers can sell this type of information at a premium. The authors cited the example of a hacker who sold 600,000 medical records on the dark web in June 2016.

Many of these attacks, the authors wrote, are of the denial of service (DoS) variety. Hackers behind DoS attacks often demand a ransom for the healthcare system to retrieve its data. They don’t necessarily result in exposure of patient data, but they usually derail business. Hollywood (California) Presbyterian Medical Center recently paid hackers $17,000 to free its data.

There’s also the possibility of outright manipulation of patient files and devices, the authors wrote. They cited a 2015 Food and Drug Administration (FDA) and the U.S. Department of Homeland Security’s Industrial Control Systems Cyber Emergency Response Team alert about an infusion system that could be controlled remotely by hackers.

So what should healthcare system administrators do? The authors have two recommendations:

Be practical. You could have the most secure systems in the world, the study authors wrote, but if using them is so burdensome to employees that they operate outside of those systems, then you’ve defeated the purpose. “A highly secure system that is not usable (and therefore not sued) is less secure than a moderately secure system that is adopted widely.” The authors provided the example of requiring frequent password changes. What’s to stop an employee from writing their 

Educate. “Unintentional negligence remains the biggest risk,” the authors wrote. Don’t assume your employees know the hazards of unsolicited email attachments, or questionable embedded links. Your employees need to be trained. “People are the weakest link in the security infrastructure: our systems are only as secure as the gatekeepers who use them.”

Stay up to date on the latest healthcare analytics news, views, and insights by signing up for our newsletter

Data Breach at Neurological Clinic Highlights Threat Against Smaller Practices

How AI Could Thwart The Next Large-Scale Cyberattack

Cybersecurity: How the World Measures Up, Country by Country

Articles

A recent New England Journal of Medicine article provides healthcare cybersecurity guidance.

Two Quick Steps to Jumpstart Your Cybersecurity Plan

A San Francisco and London-based health startup has received $8 million in Series A investment to develop technology to combat musculoskeletal (MSK) injuries.

The company, Hinge Health, made the announcement in a 

 earlier this week. Hinge Health said that the international venture capital firm, 

, led the Series A investment with all seed investors also contributing. 

, an Atomico partner, will now sit on the Hinge Health board, according to the news release.

Hinge Health is working to create remote physical therapy and behavioral health treatment using wearables and software. The new stream of funding will support development of new products to address lower back and knee pain as well as create new programs to treat hip, shoulder, and neck pain. Current Hinge Health kits include two wearables with motion sensors, a tablet loaded with Hinge software, and some tablet accessories.

Hinge Health sees itself addressing an unmet healthcare need with its devices and software — a view that seems to be supported by data from the Centers for Disease Control and Prevention (CDC).

 that the median number of workdays missed by American workers due to MSK injuries stood at 8. Injuries of this variety accounted for 70 million visits to physicians during the same time, also representing an estimated 130 million health care encounters.

For record-keeping purposes, the Bureau of Labor Statistics of the Department of Labor considers MSK injuries to be:

Tears, sprains, and strains within the musculoskeletal system and connective tissue.

Injuries or disorders called by slips, trips, or falls are not included in the CDC’s estimates.

In its news release, Hinge Health said that it has data on 1,000 patients. Using that data, the company said it has seen chronic knee and low-back pain improve by 50%. The software and data have also helped patients avoid 60% of surgeries, Hinge Health said.

Hinge Health co-founder and CEO Daniel Perez highlighted the need for more evidence to support clinical guidelines for MSK injuries, as well as more support for patient adherence to non-surgical treatment options.

“The result is that patients are shunted onto opiates and eventually surgery,” Perez said. “Our vision to improve the scale, experience and ultimately outcomes for patients by using technology to better deliver evidence-based care, with MSK as our first beachhead.”

Hinge Health had previously received $1.3 million during a seed round that concluded in June 2016, bringing its total funding level to $10 million, the company said.

Google Glass Wants to be Your EHR Solution

Sticky Situation: New Nanomesh for Wearables is Safer, Comfortable, Researchers Say

Verily Incorporates Study Watch into AURORA Research

Hinge Health is working to create remote physical therapy and behavioral health treatment options using wearables and software.

Startup Nets $8 Million in Series A Investment to Treat, Prevent Musculoskeletal Injuries

A new study shows that tracking Google searches may be an effective means of monitoring mosquito-borne disease activity.

, suggests that a similar framework used to track influenza globally can also apply to diseases such as dengue. In other words, Google searches pertaining to dengue — when put through a statistical model – correlate to dengue activity, researchers say.

, the Centers for Disease Control and Prevention (CDC) estimates that as much as 

 is at risk for dengue infection. The virus is one of the chief causes of death and illness in the planet’s tropic and subtropic regions. The CDC puts annual infection estimates at about 400 million people. The study authors called it one of the fastest-growing global diseases.

Verily Looks to Swat Zika with Population Health Initiative

In response to the World Health Organization’s call for better early detection methods of dengue, the study authors investigated whether internet searches could serve as a disease activity barometer. The team turned its attention to data from Mexico, Brazil, Thailand, Singapore, and Taiwan. They then compared aggregated dengue time-series data from government agencies in each country to online search volume and online search term selection in Google.

“We used the multivariate linear regression modeling framework ARGO (AutoRegressive model with Google search queries as exogenous variables), previously used to track flu incidence using flu-related Google searches, to combine information from historical dengue case counts and dengue-related Google search frequencies with the goal of estimating dengue activity one month ahead of the publication of official local health reports,” the researchers wrote.

The comparison showed that the ARGO model outperformed current disease-tracking methodologies in 4 of 5 studied countries. Researchers saw fewer errors during periods of low infection and peaks of activity.

Current models in Taiwan outperformed ARGO, with internet access likely being a contributing factor. Internet penetration in Taiwan, researchers noted, may cause an inflated level of perceived disease activity. They added that ARGO outperformed current models in Brazil and Singapore — where the level of internet access is moderate – compared to Mexico and Thailand, where levels are lower.

“Web penetration is nevertheless still an important factor,” researchers said.

Despite the limitations, the researchers concluded that using Google and the ARGO method offers useful insights regarding disease activity.

“Our findings confirm that combining historical dengue incidence information with dengue-related Google search data, in a self-adjusting manner, leads to better near real-time dengue activity estimates than those obtained with previous methodologies that exploit the information separately.”

Keep up with the latest news, views, and insights by signing up for our newsletter

Microsoft, Machine Learning, and Better Mosquito Defense

Infants Potentially Exposed to Zika Virus Should Undergo Routine Eye Exams

Using Google to Gauge Dengue Disease Activity

Being a small or single-practice facility doesn't make you any less appealing as a target for cybercrime.

That’s the takeaway from the recent news of a malware attack at an Atlanta-based neurological clinic. Administrators there discovered while investigating a malware attack that the clinic unknowingly was the victim of another breach that went undetected for more than a year.

Peachtree Neurological Clinic broke the news to its patients earlier this week in a 

According to the clinic, its computers were recently hit with a ransomware attack that encrypted all its EHRs. The attacker then demanded money, which the clinic did not pay, to decrypt the files. Peachtree retrieved the patient data from backups and has since recovered from the attack. In the letter, the clinic’s administrator, Dr. Lawrence Seiden, M.D., says that subsequent scans revealed that the clinics computers are malware free.

However, the ensuing investigation showed that a second undetected breach had gone on from February 2016 to May 2017.

“We are not able to confirm which, if any, files or patient information was accessed by these unauthorized individuals,” the letter reads. It notes that the cyber criminals may have had access to names, addresses, phone numbers, social security numbers, dates of birth, driver’s license numbers, insurance information, as well as data on treatments or procedures.

The clinic says that the investigation continues and it has offered identity-theft monitoring to those affected.

 were the predominant victims in the recent spate of headline-grabbing cyberattacks, the incident at Peachtree highlights how small- and single-practice facilities can also fall victim. At the recent American Academy of Orthodontics 2017 meeting in San Diego, Steve McEvoy, an IT consultant demonstrated the severity of the issue by 

Logging into the system McEvoy uses to monitor security for his clients, he showed one practice that had successfully repelled 1,200 cyberattacks from Russia during one day. This was not, he said, an atypical example.

According to Pat Little, D.M.D., who runs a private security consulting firm for dental practices, the source of breaches in small-office settings are often easily correctable.

“It’s also amazing when I go into offices, just how many times I see open charts,” he said. “But even passwords that are stuck on sticky notes that are sitting right up on the monitor. Not secure at all,” he said.

Other common sources of breaches, he said, include removing unencrypted laptops from the office or backing up to external hard drives.

Our sister publication Dentist’s Money Digest® contributed to this report

Google Finds Another Privacy Controversy in Healthcare

Being a small or single-practice facility doesn't make you any less appealing as a target for cybercrime. That’s the takeaway from the recent news of a malware attack at an Atlanta-based neurological clinic.