Electronic Health Records Under Attack: How to Protect and Secure These Critical Assets

If breaches to electronic health record systems continue at their current pace, each and every American can expect their private medical data to be compromised at least once by 2024. Once adversaries obtain a patient’s health information (PHI), they can sell it to the highest bidder—leaving targets vulnerable to all manner of fraud and theft.

Medical records aren’t just about health information, either. It often also includes highly sensitive info such as a patient’s address, driver’s license number, credit card information and social security number. So how do hackers get a hold of PHI in the first place? For the most part, ransomware is to blame.

That’s why it is imperative that healthcare organizations go beyond check-box HIPAA compliance to truly secure their environment. They can do this by embracing end-to-end visibility and monitoring critical assets, including EHR systems—the repository of PHI.

With the help of Tripwire solutions, healthcare organizations can implement the following best practices to protect sensitive patient data.

Immediately recognize unauthorized changes in your EHR environment

Tripwire Enterprise is the industry leader in File Integrity Monitoring (FIM) and change management. This means that you’ll always have deep visibility into each and every relevant change occurring in your environment.

Many data breaches go unnoticed for long periods of time, but Tripwire Enterprise gives you the advantage of immediate knowledge about what changes are made, when they’re made and by whom—all while filtering out the noise of nonessential data.

Avoid misconfigurations in your EHR environment

An adequately hardened system is one of your best defenses against cyber adversaries. Reduce your attack surface with proper configuration management using the continuous monitoring capabilities of Tripwire Enterprise. Ninety-four percent of malicious data access takes place because of compromised servers.

You can avoid catastrophic EHR breaches by understanding exactly how your assets are (Read more...)