There has been a long-held assumption that data security threats originate from nefarious external forces seeking to steal an organization’s most sensitive data. Traditional security models were therefore designed with this view in mind and on the mistaken belief that everything within the internal network is trustworthy. But there is evidence that a majority of attacks come from internal sources, with healthcare, manufacturing and financial services firms at the greatest risk.
An insider threat may be intentional or accidental but, in either case, the risk can be that much greater because it is often difficult to detect and can continue to spread.
In healthcare, having electronic health records (EHRs) that collect a patient’s data in a single record is hugely beneficial to managing patient care and to patients’ ability to gain insights into their overall health and manage their own care. Securing sensitive data is of paramount importance to prevent data theft, identity theft and reputational damage to the provider. Therefore, access must be secure and accountable, regardless of whether the data resides on hospital servers, mobile devices or cloud services.
As the healthcare industry continues to digitize — bringing together EHR data with other data about the patient, including from smart devices — and as it shifts to care without borders, interoperability of data will become even more crucial, but so too will cyber resilience. Organizations will need to focus on hardening access to digital assets as opposed to making them inaccessible.
In an era of patient-driven care, patients expect to be able to trust those caring for them to safeguard their data. Violation of that trust with security breaches affects the quality of care those patients receive. If a reputable hospital suffers a breach, it will influence where a patient will go for care, which could affect the continuity and quality of care.
This is where the security approach known as zero trust comes into its own. With zero trust, there is no assumed trust of corporate devices or networks versus untrusted public networks or personal devices. The same security checks are performed on users and devices. Everybody is equally suspect, but everybody is also equally enabled to gain the access they need. Access policies are applied wherever data is held and across the interfaces of all systems when they are being accessed.
Such a system might sound onerous to operate, but zero trust is not about putting roadblocks on innovation, collaboration and open exchange. Rather, it’s about increasing cyber defense.
In healthcare, zero trust is about finding a solution that can preserve the sharing and giving of information in a patient’s best interest but that will safeguard the information at the same time. The zero trust approach does just that and is a viable option to support digital healthcare.
To achieve the objectives of data security through a zero trust approach, healthcare organizations need to consider three key elements.
- Ensure that zero trust encompasses security at multiple levels. Applications need to be subject to strict login and monitoring rules and complete API security. This is one way an application can be executed, and these interfaces are vulnerable to attacks unless they are properly protected. The network must have strong security measures, such as physical segmentation and firewalls, plus security monitoring across all users and IT systems. Multilevel security programs should also address training for staff and patients to spot phishing attempts and practice good security hygiene, such as setting strong passwords. And the infrastructure needs to monitor all users logged into the overall system. Patients who read reports that their hospital is being investigated for security breaches will choose to go elsewhere. Once a hospital’s reputation is damaged, the stigma is hard to overcome.
- Ensure that all patient data and resources are accessed securely with the appropriate permissions. Knowing where data is held allows controls to be extended to wrap and protect data on-premises, in the cloud and on personal devices. Once the data is classified, the correct access policies can be enforced when that data is being accessed. Healthcare organizations need to be able to audit who has accessed information to ensure accountability.
- Have in place a “least access” strategy through an identity and access management solution, and grant access only to people authorized to access data. For example, if a physician is allowed to access a patient record, only that physician should be able to do so, not other clinical staff involved in caring for the patient. The objective is to ensure that the hospital is running an environment with the proper protection in place. Zero trust needs to be ingrained in human resources policies. Since hospitals typically have a large temporary workforce and a lot of personnel changes, the identity management system can automate safeguards to identify new employees and those moving into different roles or leaving the organization. So, if a nurse or doctor leaves the hospital, that person’s authorized access will be automatically revoked.
The patients’ trust and confidence in the healthcare system rely on healthcare organizations being able to safeguard their data and ensure that it is only used legitimately. Trust drives all consumers’ experiences in terms of whom they engage with. And in an era of patient-centered care, patients expect their hospital or clinician to also care for their personal data.
