Hackers target health care as industry goes digital

Medical fraud could increase as hackers gain sensitive medical information on victims

With more health providers and insurers incorporating IT into clinical care, hackers are viewing the health care industry as their next target.

"Cybercriminals know that the health industry is moving into EHRs and there's more data to steal," said Ann Peterson, program director at the Medical Identity Fraud Alliance, an organization that works to reduce medical fraud.

Electronic health records, or EHRs, are increasingly being used by hospitals and doctors' offices to store information such as test results and treatment plans, along with data such as patient names, Social Security numbers and birth dates.

Health insurance companies also use EHRs and store other personal data, such as credit card details, making them attractive targets for hackers. This week, Anthem, one of the largest health insurers in the U.S., said sensitive information on possibly 80 million employees and customers had been exposed during a cyberattack. The information thieves made off with included patient names, Social Security numbers, birth dates and medical identification numbers.

The information can be pieced together and used to commit a variety of types of fraud, making it lucrative for hackers. Social Security numbers, for example, can be used to gain access to bank accounts, noted John Kindervag, a principal analyst at Forrester Research.

By targeting Anthem, hackers were able to access information that is commonly used to reset user names and passwords, said Ian Campbell, CEO of Nucleus Research. People are sometimes asked to enter their mother's maiden name when signing up for services, for example. Since this information is static, it can be combined with a person's email address to reset a person's email account.

"People should ask 'Will I have a problem 10 years from now because someone knows information that's not normally available?'" he said.

The health care industry is especially vulnerable compared to retailers and banks, which are more accustomed to cyberattacks, said Lynne Dunbrack, research vice president at IDC Health Insights.

"Cybercriminals tend to think of health care organizations as soft targets. Historically, they haven't invested much in IT, and security specifically," she said.

The Anthem breach could affect its finances, Dunbrack said. The U.S. Health Insurance Portability and Accountability Act, which aims to keep health care data private, requires that Anthem notify each victim, a process that costs about US$350 per record, Dunbrack said. Companies that violate HIPAA can face substantial fines. Last year, a New York City hospital was fined $4.8 million after it posted the medical data of 6,800 patients to the Web.

Health care breaches can also lead to an uptick in medical fraud, Peterson said. Health records contain insurance details that people can use to impersonate a hacking victim to receive care. Some insurance plans cover costly procedures that others don't, so there's a demand for credentials to access better coverage.

A set of medical data that can be used to receive care may fetch between $20 and $200 on the black market, Dunbrack said.

Fraud victims often don't realize they've been attacked until it's too late. They might receive a notice from their insurer for treatment they never received. Or they may find out in a more dramatic fashion, such as having an allergic reaction to a drug after an imposter altered a medical record.

"It can be deadly, depending on the level of compromise to the medical records and how much of their data is co-mingled with your data," said Dunbrack.

People need to be as vigilant about protecting and reviewing their medical data as they are with their credit card information, said Peterson at the Medical Identity Fraud Alliance, noting that laws protect people only to a degree.

"We need to do our part and be aware of our medical information," he said.

Fred O'Connor writes about IT careers and health IT for The IDG News Service. Follow Fred on Twitter at @fredjoconnor. Fred's e-mail address is fred_o'connor@idg.com

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Tags Anthemsecurityhealth careindustry verticals

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Fred O'Connor

IDG News Service
Show Comments

Cool Tech

Crucial Ballistix Elite 32GB Kit (4 x 8GB) DDR4-3000 UDIMM

Learn more >

Gadgets & Things

Lexar® Professional 1000x microSDHC™/microSDXC™ UHS-II cards

Learn more >

Family Friendly

Lexar® JumpDrive® S57 USB 3.0 flash drive 

Learn more >

Stocking Stuffer

Plox Star Wars Death Star Levitating Bluetooth Speaker

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest News Articles

Resources

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?