How a dose of AI could be the cure for hospital EHR cyberattacks in 2017

I know how terrible hospital record theft can be. I myself have been the victim of a data theft by hackers who stole my deceased father’s medical files, running up more than $300,000 in false charges. I am still disputing on-going bills that have been accruing for the last 15 years.

This event led me on the path to finding a solution so others would not suffer the consequences that I continue to be impacted by, but hospitals and other healthcare providers must be willing to make the change.

The writing is on the wall.  A report by Experian predicts 2017 will even be worse for the healthcare industry as more attackers recognize the value in rich medical record info.  Cybersecurity Ventures predicts global annual cybercrime costs will grow from $3 trillion in 2015 to $6 trillion annually by 2021, which includes damage and destruction of data, stolen money, lost productivity and theft of intellectual property, personal and financial data, embezzlement and fraud. (This doesn’t even include post-attack disruption to the normal course of business, forensic investigation, restoration and deletion of hacked data, systems and reputational harm.)

Things will not change until we recognize the problems.  Firewalls and reputation lists are nice, but not enough; perimeter security is regularly by-passed.  Along with insufficient threat detection, these traditional tools can contribute to “alert fatigue” by excessively warning about activities that may not be indicative of a real security incident.

This requires skilled security analysts to identify and investigate the alerts when there is already a shortage of these types of skilled professionals.  Hospital CISOs and CIOs already operate under tight budgets without needing to hire additional cybersecurity guards. 

The problem is not only high-tech, but also low-tech, requiring that medical facilities across the healthcare continuum become smarter about data protection and privacy issues. Hospitals are finding they must teach doctors and nurses not to click on suspicious links.

It’s the data, stupid

In addition to healthcare industry IT operational changes, my personal data theft odyssey has led me to discover that safeguarding of the EHR data is primary, protecting the network or the perimeter is secondary.  Why?  Personal health information is 50 times more valuable on the black market than financial information.  Stolen patient health records can fetch as much as $60 per record, as I well know!

If your data is protected, the roads leading to it become less strategic. Why have post incident responses when you can deploy a pre-incident response?  It is the old stop chasing the rats and protect the cheese argument.   

A data centric approach can also mitigate the argument of whether threats are caused more by rogue insiders or malicious outsiders. It simply will not matter. The real question for medical facilities now is how to best concentrate IT security efforts on protecting EHRs.

The hospital solution I have discovered requires fewer security sleuths, strategic focus on data protection and a 24×7 “human error proof” intruder watch dog and is cloud driven for a broad safety net.  The answer is to deploy an AI strategy using forensic technology, and I’m not the only one who believes this. IDC forecasts global spending on cognitive systems will reach nearly $31.3 billion in 2019.  

The AI digital eye sees all

While the technology is advanced, the concept is simple. I have found that one of the easiest and cost effective AI strategies is to deploy an ambient cognitive cyber surveillance shield which casts an “all seeing eye” security net over EHRs. This technology digitally “finger prints” user access behavior, identifying rogue users virtually instantly.  The beauty of AI and machine learning for hospital EHR security is that it can understand, recognize and remember normal user habits, patterns and behaviors as medical pros go about their day-to-day work.

This technology creates a virtual, formidable defense layer powered by cognitive surveillance that is simple to deploy, easy to use, and operates automatically in the background. It can vastly improve a hospital’s defense against cybersecurity threats and data breaches while also complying with HIPAA privacy laws. By nature, the technology is also perfect for hospitals and other healthcare facilities as its self-learning protective shield can rapidly scale across EHR systems, distributed or centralized, cloud or on-premise.

I truly hope, for your benefit, as well as mine, that 2017 marks the beginning of finally giving patients, providers and the entire healthcare industry the security it deserves so we can focus on cures for people and not cures for data theft.