WinZip Blog

The Health Information Technology for Economic and Clinical Health (HITECH) Act transformed how public and private healthcare providers store and access clinical information. As the healthcare industry adopted electronic health records (EHR) systems, the amount of patient health data skyrocketed. Each year, a single patient generates around 80 megabytes of EHR data.

Today, around 30% of our global data volume comes from the healthcare industry. This amount is expected to grow even further, with the compound annual growth rate (CAGR) for healthcare data estimated to reach 36% by 2025.

Data security in healthcare is essential to protect this highly sensitive information from unauthorized access, loss, destruction, and more. Insufficient data security can leave healthcare organizations vulnerable to a host of risks, such as costly fines, reputational damage, and business loss.

In this article, we will explore why data security is so important in the healthcare industry. This will include the top benefits of data security, as well as real-world examples of how data security incidents impact healthcare organizations.

Why data security is imperative in healthcare

Cybercriminals target protected health information (PHI) due to its high value on the dark web. This is because a single medical record contains a host of sensitive data, including financial details, personal information, Social Security numbers, and more. When stolen data is sold on the dark web, healthcare records sell for an average of $250, compared to approximately $5 for payment card details.

The healthcare industry is subject to several federal, state, and industry-specific data protection laws. The most well-known example is the Healthcare Insurance Portability and Accountability Act (HIPAA). HIPAA rules apply to covered entities (e.g., healthcare providers, health plans, clearinghouses) and their business associates.

While HIPAA’s data privacy and security standards are often more stringent than other industries, it’s still important for healthcare organizations to closely follow other data privacy laws. For example, 13 states have stricter regulations than HIPAA when it comes to medical record access.

Failure to comply with these regulations can result in monetary penalties exceeding hundreds of thousands of dollars (based on factors such as the severity of the breach, mitigation efforts, and the number of individuals affected).

Benefits of data security

Advancing digital technologies mean that today, patient records are held on servers, computers, and storage devices rather than stored on paper in file cabinets. All this information is accessed, updated, recorded, and shared between multiple facilities and healthcare providers.

A robust data security strategy does more than secure healthcare data against cyberthreats. It also plays a critical role in controlling malicious and negligent insider threats, which are a top cause of data loss. According to the Ponemon Institute’s 2022 Insider Threats Report, 56% of data breaches involving an insider are the result of careless or negligent behavior.

For example, 63% of employees worldwide are using personal file sharing systems for work-related data. While unintentional, this creates an immense opportunity for information loss and compromise because consumer-grade solutions do not offer sufficient data security controls.

When it comes to protecting healthcare information, data security offers the following benefits:

• Safe harbor for HIPAA’s Breach Notification Rule. According to HIPAA, data encryption is an effective security measure for protecting PHI. Following a breach, healthcare organizations do not have to notify affected individuals so long as the information was encrypted properly. This is because encrypted data cannot be used by unauthorized individuals, creating a safe harbor for breach notification requirements.

• Better care outcomes. According to the Cybersecurity and Infrastructure Security Agency (CISA), cyberattacks have a direct impact on patient mortality. An attack on a healthcare organization’s network can render patient records inaccessible, disrupt communications, and delay treatment and testing. Prioritizing data security is an effective way of ensuring continued delivery of quality care.

• Increased cybersecurity awareness. Data security policies ensure that all staff are educated on the value and importance of securing healthcare data so that they can detect and respond to fraudulent behavior. This is especially important for smaller health systems and specialty clinics that often lack the security levels, staff, and budget for robust cybersecurity defenses.

Data security incident examples

The healthcare industry remains a top target for cyberattacks, threatening both organizations and patients. In 2022 alone, more than 40 million patient records have been exposed or stolen due to security vulnerabilities in EHR systems.

Much of the threat landscape centers around outdated legacy systems, limited IT budgets, and a growing shortage of healthcare cybersecurity personnel. In addition, the growing use of connected medical devices also expands a healthcare organization’s attack surface. This is because 68% of health entities don’t consistently update devices when new security patches are available.

Without proper preparation, data security incidents can result in operational downtime, loss of public trust, financial consequences, and more. The following recent examples demonstrate the importance of comprehensive data security:

• Legacy Health. Portland, Oregon-based Legacy Health experienced a data breach caused by an insider threat. A lab employee copied patient records to their personal storage devices using email and external drives. The compromised files contained patient names, medical record numbers, health insurance information, and other types of personal data.

• Broward Health. In October 2021, an unauthorized individual used a third-party medical provider’s office to gain access to Broward Health’s network. More than 1.3 million patients and employees were affected, and the breach investigation revealed that prior to the incident, the health system lacked basic data security measures such as multifactor authentication (MFA).

• Partnership HealthPlan of California (PHC). A cyberattack took down PHC’s computer systems in March 2022. The Hive ransomware group took credit for stealing 850,000 PII records from PHC, as well as 400 GB of files stored on PHC’s server. The health plan faces a lawsuit in which plaintiffs allege that PHC failed to provide basic data security measures, including user authentication practices, security privileges, and patching/updating protocols.

How WinZip Enterprise ensures data security in healthcare

Data security is focused on three primary components: confidentiality, integrity, and availability of data. Also known as the CIA triad, this data security model helps organizations ensure that information is kept safe from unauthorized access, cannot be altered by unauthorized individuals, and is readily accessible to authorized users.

When faced with ever-growing cybersecurity threats, WinZip Enterprise helps healthcare organizations secure the components of the data security CIA triad. This fully customizable solution features a complete set of data security tools, including:

• Encryption. File-level encryption safeguards highly sensitive PHI data both at rest and in transit. Whether data is stored in a device or actively moving from a sender to a receiver, encryption renders the information unable to anyone without the proper encryption key

• Access control. An access control system limits user access rights to only what is needed for an individual’s job role. Administrative controls to manage access and permissions include MFA, principle of least privilege (POLP) access, and using audit logs to quickly detect anomalous behaviors that could compromise data security.

• Data backup and compression. If a cyberattack compromises, corrupts, or erases data, backing up files creates a safety net for quick information recovery. WinZip Enterprise also compresses backup files, which reduces data storage costs while maximizing the capacity of a backup server.

Discover how WinZip Enterprise ensures data security for healthcare organizations.

The healthcare industry has long been a preferred target of cybercriminals. This is due not only to the high value of protected health information (PHI) records, but also because the digitization of the industry’s technology infrastructure has created new ways for attackers to infiltrate healthcare systems.

Following the passage of the HITECH Act in 2009, the industry experienced a significant expansion in health information technology. Electronic Health Record (EHR) systems have made it easier to share information with patients and other providers, but they also make it easier for cybercriminals to find and leverage system vulnerabilities.

In 2015, Congress passed the Cybersecurity Information Sharing Act (CISA) to improve cybersecurity practices and make it easier for companies to share information related to cybersecurity threats with the government. Following the passage of CISA, the Department of Health and Human Services (HHS) established the Healthcare Industry Cybersecurity Task Force.

The goal of the Task Force is to improve healthcare cybersecurity practices. Its members represent a range of organizations within the healthcare industry, such as hospitals, insurers, IT vendors, and more.

In this article, we will cover what the Healthcare Industry Cybersecurity Task Force does to improve cybersecurity practices, analyze Task Force activity updates, and detail how solutions like WinZip® Enterprise can help healthcare organizations mitigate the ever-changing cybersecurity threats facing the industry.

History of the healthcare industry cybersecurity task force

The Healthcare Industry Cybersecurity Task Force first convened in March 2016. At the time of its formation, the healthcare industry had already suffered significant cybersecurity events, including:

• Boston Children’s Hospital, 2014. The hacktivist group Anonymous launched a massive, sustained, distributed denial of service (DDoS) against the 395-bed facility in April 2014. The hospital spent more than a week fending off the cyberattack.

• Anthem, Inc., 2015. A Chinese hacking group targeted and breached Anthem’s computer systems in 2015, compromising the data of nearly $80 million individuals. The stolen data included names, dates of birth, Social Security numbers, health identification numbers, and more. This incident is the largest healthcare data breach to this day.

• Hollywood Presbyterian Medical Center, 2016. Hackers used malware to infect and seize control of the hospital’s computer systems in early 2015. Following the ransomware attack, Hollywood Presbyterian Medical Center paid a $17,000 ransom to restore its systems and operations.

Healthcare Industry Cybersecurity Task Force members spent a year analyzing cybersecurity concerns impacting healthcare systems. Task Force members held public meetings and met with industry leaders and stakeholders to identify trends, threats, concerns, and best practices related to cybersecurity.

The information and ideas gathered by the Task Force enabled its members to address key CISA requirements:

• Analyze how other critical industries address cybersecurity threats through various strategies and safeguards.
• Identify barriers and challenges that private entities in the healthcare sector face regarding preventing cyberattacks.
• Review challenges specific to securing networked medical devices as well as other software or systems connected to EHRs.
• Provide information and strategies to help healthcare entities strengthen their defense and response to cybersecurity threats.
• Establish a plan that enables healthcare organizations and the federal government to share actionable cyberthreat indicators and defensive processes.

Congress received the first Task Force report in June 2017, which detailed complex challenges the healthcare industry faces when it comes to securing and safeguarding against cybersecurity risks. The Report on Improving Cybersecurity in the Healthcare Industry also identified key imperatives for improving cybersecurity practices:

• Define leadership and governance for healthcare industry cybersecurity.
• Increase the security of medical devices and health IT.
• Develop the healthcare workforce capacity needed to prioritize cybersecurity awareness and technical abilities.
• Improve cybersecurity awareness and education.
• Protect research and development (R&D) efforts and intellectual property (IP) from cybersecurity threats.
• Enhance information sharing of threats, risks, and mitigations.

Task force year one update

HHS studied the Task Force’s report and worked across its agencies and offices to implement recommended changes. In the year following the Healthcare Industry Cybersecurity Task Force report, HHS took the following actions to address the report’s key imperatives:

• Defining leadership and governance. The Deputy Secretary for HHS was designated as the lead official for all HSS cybersecurity measures. An internal working group was also established to coordinate cybersecurity activities, such as implementing the Task Force’s recommendations.

• Increasing IT and medical device security. To address the challenges of securing medical devices and EHRs, the Food and Drug Administration (FDA), an HHS agency, developed the Medical Device Safety Action Plan. The plan prioritizes innovation to improve patient safety and develop more effective products and services to resolve unmet medical needs.

• Developing the healthcare workforce capacity. HHS coordinated with National Initiative for Cybersecurity Education (NICE) to help lead its Federal IT Workforce Committee. The Department also leveraged the NICE Framework to improve its ability to attract, develop, and retain IT professionals in the health sector.

• Improving cybersecurity awareness and education. HHS has prioritized cybersecurity outreach by offering continuing education and outreach activities, as well as online resources for non-technical audiences.

• Protecting R&D and IP. Clinical trials, drug and device development, and even general healthcare operations can be opportunities for cybercriminals to commit healthcare intellectual property theft. To prevent attacks and unauthorized data exposure, HHS worked with the National Academies to add research institutions to HHS’s private sector critical infrastructure partnership.

• Enhancing information sharing. To improve information sharing between the government and the healthcare industry, HHS developed executive and technical summaries on emerging cyberthreats and provided grants to promote information sharing across a wide range of healthcare entities.

Addressing the healthcare industry cybersecurity task force recommendations

The Healthcare Industry Cybersecurity Task Force report stated that healthcare cybersecurity was in critical condition back in 2017. Today, this assessment remains true. The healthcare industry has been the primary target of ransomware and other cyberattacks, making it critical for organizations to prioritize and improve their cybersecurity practices.

While the Healthcare Industry Cybersecurity Task Force disbanded after delivering their report, efforts to address the Task Force’s recommendations are ongoing. In the face of ever evolving cyberthreats, healthcare organizations turn to solutions such as WinZip Enterprise.

This powerful, customizable tool protects critical data through industry-leading encryption, management, sharing, backup, and compression capabilities. WinZip Enterprise also offers native integration with leading enterprise-grade cloud storage providers, providing unsurpassed protection for data at rest and in transit.

Discover how WinZip Enterprise can help your organization maintain cybersecurity risks.

In the healthcare industry, information security is crucial for patients and providers alike. Whether through unintentional accidents or targeted attacks, data exfiltration is one of the fastest-growing cybersecurity threats.

Cyberattacks are on the rise, increasing in both frequency and efficiency. Hacker groups from around the globe have targeted hospitals and health systems to exfiltrate protected health information (PHI), personally identifiable information (PII), and other restricted data.

As threats increasingly target the healthcare sector, these organizations are also facing a critical shortage of cybersecurity professionals. On average, cybersecurity jobs take 70% longer to fill than other IT roles, often due to the potential consequences and ramifications of a cyberattack.

Security-related certifications ensure staff have the knowledge and skills necessary to manage cybersecurity threats. There are numerous options when it comes to certification programs in cybersecurity, but there’s no one-size-fits-all solution.

This is because the credentials for healthcare cybersecurity certification are based on different skill sets and focus areas. For example, some cybersecurity certifications are meant for IT professionals with years of experience. Others can be obtained with little to no experience, requiring minimal continuing education or on-the-job experience to qualify.

Let’s look at some of the top cybersecurity certifications available, their benefits, and how to prepare for the exams.

Entry-level certification

Organizations that focus on recruiting and developing entry-level cybersecurity staff can accelerate the hands-on training needed to overcome the cybersecurity labor shortage. Cybersecurity certification can help remove barriers to enter the field and allows candidates to demonstrate their understanding of important concepts and best practices.

The two most prominent healthcare cybersecurity certifications are the Certified Associate in Healthcare Information and Management Systems (CAHIMS) and the (ISC)² Certified in Cybersecurity.

CAHIMS

CAHIMS is offered through the Healthcare Information and Management Systems Society (HIMSS), a leading source of authority for healthcare IT. Ideal for entry- and junior-level staff, this certification establishes a solid foundation for a career in health information and management systems.

Anyone with a high school diploma (or equivalent) as well as 45 hours of continuing education is eligible for CAHIMS certification. A candidate holding an associate’s, bachelor’s, or other advanced degree only needs 25 hours of continuing education. Relevant work experience can be used in lieu of continuing education credits, but the hours required are greater—150 hours for those with a high school diploma and 75 hours for those with an associate’s or higher.

The CAHIMS exam features 115 multiple-choice questions, 100 of which are graded. Exam topics are based on common knowledge and skills in healthcare IT, including:

• Organizational environment
• Technology environment
• Information and systems management
• Privacy and security
• Clinical informatics

Certified in Cybersecurity

The nonprofit International Information System Security Certification Consortium, Inc. (ISC)2 offers globally recognized certifications for information security. (ISC)2’s Certified in Cybersecurity certification is a pilot program that began in early 2022 and is meant to provide new pathways for people interested in cybersecurity roles.

Obtaining this certification will help candidates demonstrate the foundational knowledge, skills, and abilities needed to obtain entry-level work in cybersecurity. The exam is multiple choice, 100 questions, and covers topics including, but not limited to:

• Security principles
• Access control concepts
• Network security
• Incident response, business continuity, and disaster recovery concepts
• Security operations

Professional certification

Experienced professionals can also demonstrate commitment to and expertise in the field of cybersecurity through various certification programs, including:

• Certified Professional in Digital Health Transformation Strategy (CPDHTS)
• Certified Professional in Healthcare Information and Management Systems (CPHIMS)
• Certified Information Systems Security Professional (CISSP)
• Healthcare Information Security and Privacy Practitioner (HCISPP)

CPDHTS

The CPDHTS certification program demonstrates a candidate’s competence in digital health transformation strategy, which is the adoption of technologies that improve workflows, efficiency, and patient care outcomes. Electronic health records (EHRs), telehealth solutions, and cloud security technologies are all examples of digital transformation.

To earn professional certification through the CPDHTS exam, candidates must meet eligibility requirements related to education and work experience. While this is not meant for entry-level staff, CPDHTS certification goes a long way toward resolving a common pain point in digital transformation—70% of such projects fail.

The CPDHTS exam has 150 multiple-choice questions relating to IT ecosystems, health, transformation, and strategy. Topics addressed include, but are not limited to:

• Privacy and security
• Digital infrastructure and interoperability
• Virtual healthcare delivery models
• Compliance and adherence
• Data science and analytics

CPHIMS

The CPHIMS credential demonstrates that an individual meets an international standard of knowledge and competence relating to information and management systems. Because this certification establishes a professional’s expertise in the field, it requires more education and experience than CAHIMS:

• Ten years of experience working in information and systems management, eight of which must be specific to a healthcare setting;

• A four-year degree in addition to five years of hands-on work experience, three of which must be in a healthcare setting; or

• A graduate degree or higher in addition to three years of on-the-job experience, two of which must be in healthcare.

The CPHIMS exam is 100 questions, all of which impact the final score. It addresses the same core topics as CAHIMS but in greater detail commensurate with the test-taker’s experience.

CISSP

The CISSP is recognized worldwide as a highly valuable security certification. The CISSP certification exam aligns with the (ISC)2 Common Body of Knowledge (CBK). The CBK contains all the relevant subjects a cybersecurity professional should be familiar with, including skills, techniques, and best practices.

The technical knowledge covered by the exam focuses predominantly on security controls and operations. Earning CISSP certification demonstrates an individual’s ability to understand a wide range of information security disciplines.

The exam, offered through (ISC)², evaluates a test-taker’s technical and managerial competence across eight areas of expertise. Eligible candidates must have at least five years of experience in two or more of the domains:

• Security and risk management
• Asset security
• Security engineering
• Communications and network security
• Identity and access management
• Security assessment and training
• Security operations

• Software development security

HCISPP

(ISC)2 also offers cybersecurity certification specific to healthcare. The HCISPP combines cybersecurity skills with the best practices and techniques to safeguard patient health information. Certification places heavy emphasis on regulatory issues, risk management, data governance, and other privacy concerns.

With the growing volume of ransomware attacks, the knowledge and abilities needed to assess, implement, and manage cybersecurity controls in healthcare organizations are more important than ever.

The HCISPP exam focuses on seven domains of expertise. Qualified candidates must have at least two years of paid work experience in at least one of these domains:

• Healthcare industry
• Information governance in healthcare
• Information technologies in healthcare
• Regulatory and standards environment
• Privacy and security
• Risk management and assessment
• Third-party risk management

Exam preparation

HIMSS certification exams are based on relevant work experience, which requires candidates to recall, apply, and analyze information. To ensure that candidates meet the minimum requirements, knowledge, and skills, HIMSS publishes candidate manuals for each examination.

Candidate manuals include information on how to prepare for exams, an overview of topics, and a competency gap assessment. This tool helps test-takers identify the topics that require extra study and review prior to the exam. HIMSS also has practice exams and review guides for each program that can be used to familiarize test-takers with the exam’s format and types of questions.

(ISC)2 also offers a variety of materials to help candidates prepare for exams, including study guides, practice tests, and flash cards. Test-takers can also prepare using (ISC)2 online training, which includes options for self-paced learning as well as virtual learning with an authorized instructor.

Today, cybercriminals can breach an estimated 93% of company networks. Healthcare IT professionals are in high demand, and both experienced and junior staff can advance their knowledge and skills through cybersecurity certification.

How WinZip Enterprise can enhance cybersecurity certifications

To control and mitigate cyberthreats, healthcare organizations look to solutions such as WinZip® Enterprise. This highly customizable solution empowers IT staff with centralized control over the data environment, including the ability to set and enforce encryption standards, access controls, and other important security protocols.

Discover how WinZip Enterprise keeps your organization safe from the most important cybersecurity threats.