Despite the numerous benefits of adopting secure data sharing, data protection and privacy will be the major challenge for these organizations to overcome.
It is not all about adopting technologies, such as electronic medical record systems, there are policies and processes involved, as well as user awareness.
Indeed, data protection and confidentiality are top priorities in the IT sector, and in healthcare it will be no different. But it is not always easy to achieve these goals on a large scale.
It is no wonder that secure data sharing in healthcare is considered the big hurdle for the coming years.
Always keep patient safety in mind
For many health and IT security experts, data sharing in healthcare is a “double-edged sword”.
On the one hand, managers and doctors want innovation in healthcare and for patients to be able to decide what data they want to share and with whom they want to share it.
On the other hand, technology professionals want to ensure data protection and privacy, and therefore when patients allow the sharing of their medical information, they should fully understand what is happening with their data and where that information travels.
Data privacy can become a trap
To give you an idea, 80% of behavioral health apps in the Apple App Store share information with third parties.
Determining who has access to this data once it is shared can be difficult, especially if an end-user license agreement is involved.
Have you read the Facebook end user license agreement? It would probably take hours. So when we talk about secure data sharing, a user license agreement that takes hours to read and understand is not consent with data protection and privacy in mind.
This concern also applies to healthcare institutions. The rules adopted for the storage and use of data by these organizations will also have a significant impact on patients’ lives, putting the permission to share data directly in their hands.
Ultimately, existing legislations have reduced the risk of information sharing between healthcare organizations, but if a patient allows to share their medical data, the General Data Protection Law (LGPD) may not apply, in cases of problems.
Investment in data protection and privacy is critical, but it is only one stage towards secure sharing.
Today, operating systems and healthcare solutions are better protected and attackers have shifted their attention to the human element, aiming to break into the organization’s information systems.
As the number and frequency of cyber attacks designed to take advantage of innocent people are increasing, the importance of the human factor in information security management cannot be underestimated.
To combat cyber-attacks designed to exploit human factors in the data protection and privacy chain, it is paramount to recognize information security with the aim of reducing risks to health information that occur due to user-related vulnerabilities.
Education, policies and processes as the key to safe sharing
In October 2019, the Alabama health system in the United States was the victim of an attack that left it unable to accept new patients at three hospitals. An undisclosed amount was paid to stop a cyberattack and restore the hospitals’ operations.
But investment in data protection and privacy through technology is not the only thing to be done to reduce the risks and attacks that are bound to occur in this new decade. Technological resources are just the “tip of the iceberg” to ensure secure data sharing.
Often, in order for attacks to occur or for data sharing to happen inappropriately, viruses and malware need the help of users to get into computers.
In the context of information security, social engineering is the use of techniques to manipulate individuals into divulging confidential business or personal information that can be used for fraudulent purposes.
In other words, people can be misled into disclosing strategic information that they otherwise would not.
Common vectors of attack on users include:
- Phishing: fake emails to trick people into clicking on a link or opening an attachment that carries a malware payload;
- Social media: Social media can be a powerful vehicle to convince a victim to open an image downloaded from a website or take other compromising actions;
- Instant messaging: Instant messaging clients can be hacked by cybercriminals and used to distribute malware to the victim’s contact list;
- SMSishing: SMSishing uses text messages to get recipients to navigate to a website or enter personal information on their devices;
Organizations should conduct regular training to help employees avoid common pitfalls of malware and other threats.
|
|
And to achieve this goal, there is a wide variety of methods for information security awareness, such as web-based training materials, contextual training and embedded training.
Why do healthcare institutions need IT security policies and procedures?
The goal behind IT Security Policies and Procedures is to address threats, implement strategies on how to mitigate them and how to recover from threats that have exposed a part of your organization.
IT security policies and procedures provide a roadmap for employees on what to do and when to do it. Remember, for example, the annoying password management policies that every company has.
If this policy and procedure did not exist in organizations, how common would it be for people to use simple, easy-to-guess passwords that ultimately open the organization to a greater risk of data theft and/or data loss.
An organization’s information security policies are usually high-level concepts that can cover a large number of security controls.
Issued by the company to ensure that all employees using information technology assets within the organization comply with established rules and guidelines, the information security policy is designed so that everyone recognizes that there are rules by which they will be held accountable regarding the sensitivity of corporate information and IT assets.
Secure data sharing in healthcare is the convergence of technology and awareness
Senior management in healthcare institutions plays an important role in protecting assets and sharing information in an organization.
Executive management can support the IT security objective by setting security goals and priorities and ensuring the necessary investments for data protection and privacy.
However, even knowing that the use of resources, such as certificates and digital signatures, tools such as antivirus and firewall and personnel specialized in information security.
End users have a responsibility to protect information assets on a daily basis, through security policies and processes that have been defined, communicated and need to be enforced.
End-user compliance with security policies is essential to maintaining information security in an organization, this group primarily represents securing the medical information of patients and family members at what can be considered the most fragile times in a person’s life.
About Eval
A EVAL está há mais de 18 anos desenvolvendo projetos nos segmentos financeiro, saúde, educação e indústria. Desde 2004, oferecemos soluções de Autenticação, Assinatura Eletrônica e Digital e Proteção de Dados. Atualmente, estamos presentes nos principais bancos brasileiros, instituições de saúde, escolas e universidades, além de diferentes indústrias.
Com valor reconhecido pelo mercado, as soluções e serviços da EVAL atendem aos mais altos padrões regulatórios das organizações públicas e privadas, tais como o SBIS, ITI, PCI DSS, e a LGPD. Na prática, promovemos a segurança da informação e o compliance, o aumento da eficiência operacional das empresas, além da redução de custos.
Inove agora, lidere sempre: conheça as soluções e serviços da Eval e leve sua empresa para o próximo nível.
Eval, segurança é valor.
