Local: (805)-371-3680 | Toll Free: (800) 240-CHIV
Facebook
Twitter
LinkedIn
YouTube
Chivaroli Insurance Services
  • INSURANCE COVERAGE
    • Healthcare Professional Liability
    • Directors’ & Officers’ Liability
    • Commercial Property
    • Managed Care / Billing / Miscellaneous
    • Employment Practices Liability
    • Difference in Conditions
    • Regulatory Proceedings Errors & Omissions
    • Fiduciary Responsibility
    • Property Terrorism
    • Commercial General Liability
    • Commercial Crime
    • Commercial Automobile
    • Stop Loss Coverage
    • Representations & Warranties
    • Business Owners Package
    • Security & Privacy (Cyber Liability)
    • Workers Compensation
    • Home / Auto / Valuables / Umbrella
  • OTHER SERVICES
    • Credentialing Requests
    • Consulting Services
    • Alternatives
    • Risk Management
    • Wholesale Brokerage
  • RESOURCES
    • Healthcare Resources
    • Insurance Resources
    • Terms & Definitions
  • NEWS
  • ABOUT
  • CONTACT

Healthcare Firms at Risk; Hackers Value Medical Records Over Credit Data

December 19, 2014Chivaroli and Associates Insurance ServicesArticle Archives

As seen on Insurance Journal:

Your medical information is worth 10 times more than your credit card number on the black market.

Last month, the FBI warned healthcare providers to guard against cyber attacks after one of the largest U.S. hospital operators, Community Health Systems Inc., said Chinese hackers had broken into its computer network and stolen the personal information of 4.5 million patients.

Security experts say cyber criminals are increasingly targeting the $3 trillion U.S. healthcare industry, which has many companies still reliant on aging computer systems that do not use the latest security features.

“As attackers discover new methods to make money, the healthcare industry is becoming a much riper target because of the ability to sell large batches of personal data for profit,” said Dave Kennedy, an expert on healthcare security and CEO of TrustedSEC LLC. “Hospitals have low security, so it’s relatively easy for these hackers to get a large amount of personal data for medical fraud.”

Interviews with nearly a dozen healthcare executives, cybersecurity investigators and fraud experts provide a detailed account of the underground market for stolen patient data.

The data for sale includes names, birth dates, policy numbers, diagnosis codes and billing information. Fraudsters use this data to create fake IDs to buy medical equipment or drugs that can be resold, or they combine a patient number with a false provider number and file made-up claims with insurers, according to experts who have investigated cyber attacks on healthcare organizations.

Medical identity theft is often not immediately identified by a patient or their provider, giving criminals years to milk such credentials. That makes medical data more valuable than credit cards, which tend to be quickly canceled by banks once fraud is detected.

Stolen health credentials can go for $10 each, about 10 or 20 times the value of a U.S. credit card number, according to Don Jackson, director of threat intelligence at PhishLabs, a cyber crime protection company. He obtained the data by monitoring underground exchanges where hackers sell the information.

ATTACKS ON THE RISE

The percentage of healthcare organizations that have reported a criminal cyber attack has risen to 40 percent in 2013 from 20 percent in 2009, according to an annual survey by the Ponemon Institute think tank on data protection policy.

Founder Larry Ponemon, who is privy to details of attacks on healthcare firms that have not been made public, said he has seen an increase this year in both the number of cyber attacks and number of records stolen in those breaches.

Fueling that increase is a shift to electronic medical records by a majority of U.S. healthcare providers.

Marc Probst, chief information officer of Intermountain Healthcare in Salt Lake City, said his hospital system fends off thousands of attempts to penetrate its network each week. So far it is not aware of a successful attack.

“The only reason to buy that data is so they can fraudulently bill,” Probst said.

Healthcare providers and insurers must publicly disclose data breaches affecting more than 500 people, but there are no laws requiring criminal prosecution. As a result, the total cost of cyber attacks on the healthcare system is difficult to pin down. Insurance industry experts say they are one of many expenses ultimately passed onto Americans as part of rising health insurance premiums.

Consumers sometimes discover their credentials have been stolen only after fraudsters use their personal medical ID to impersonate them and obtain health services. When the unpaid bills are sent on to debt collectors, they track down the fraud victims and seek payment.

Ponemon cited a case last year in which one patient learned that his records at a major hospital chain were compromised after he started receiving bills related to a heart procedure he had not undergone. The man’s credentials were also used to buy a mobility scooter and several pieces of medical equipment, racking up tens of thousands of dollars in total fraud.

MEDICARE FRAUD

The government’s efforts to combat Medicare fraud have focused on traditional types of scams that involve provider billing and over billing. Fraud involving the Medicare program for seniors and the disabled totaled more than $6 billion in the last two years, according to a database maintained by Medical Identity Fraud Alliance.

“Healthcare providers and hospitals are just some of the easiest networks to break into,” said Jeff Horne, vice president at cybersecurity firm Accuvant, which is majority-owned by private equity firm Blackstone Group.

“When I’ve looked at hospitals, and when I’ve talked to other people inside of a breach, they are using very old legacy systems – Windows systems that are 10 plus years old that have not seen a patch.”

KPMG partner Michael Ebert said security has been an afterthought for many medical providers – whether it is building encryption into software used to create electronic patient records or in setting budgets.

“Are you going to put money into a brand new MRI machine or laser surgery or are you going to put money into a new firewall?” he said.

Tags: hackers, Healthcare, healthcare at risk, security features, U.S. personal information
Chivaroli and Associates Insurance Services
Chivaroli & Associates Insurance Services is a full-service brokerage and consulting firm that specializes in the custom design and placement of property and casualty insurance and alternative risk funding solutions for healthcare organizations.
Previous post Telemedicine effective for PTSD treatment of rural veterans Next post Chivaroli Holiday Message

Related Articles

Healthcare organizations under siege from cyberattacks, study says

February 25, 2014Chivaroli and Associates Insurance Services

Hacking Incidents Prompt Universities to Rethink Balance between Openness / Security

March 21, 2014Chivaroli and Associates Insurance Services

Safeguard Your Patients From Healthcare Data Breaches

November 12, 2014Chivaroli and Associates Insurance Services

Sign up for News Updates

* = required field

Categories

  • Article Archives
  • General Article
  • Private
  • Uncategorized

Archives

  • March 2023
  • February 2023
  • January 2023
  • December 2022
  • October 2022
  • September 2022
  • August 2022
  • July 2022
  • June 2022
  • May 2022
  • April 2022
  • March 2022
  • February 2022
  • January 2022
  • November 2021
  • September 2021
  • August 2021
  • July 2021
  • June 2021
  • May 2021
  • April 2021
  • March 2021
  • February 2021
  • January 2021
  • November 2020
  • October 2020
  • September 2020
  • August 2020
  • July 2020
  • June 2020
  • May 2020
  • April 2020
  • March 2020
  • February 2020
  • January 2020
  • August 2019
  • July 2019
  • June 2019
  • March 2019
  • February 2019
  • January 2019
  • December 2018
  • November 2018
  • August 2018
  • July 2018
  • June 2018
  • May 2018
  • April 2018
  • March 2018
  • February 2018
  • December 2017
  • November 2017
  • October 2017
  • August 2017
  • July 2017
  • June 2017
  • May 2017
  • April 2017
  • March 2017
  • February 2017
  • January 2017
  • November 2016
  • October 2016
  • September 2016
  • August 2016
  • July 2016
  • June 2016
  • May 2016
  • April 2016
  • March 2016
  • February 2016
  • December 2015
  • November 2015
  • October 2015
  • September 2015
  • August 2015
  • July 2015
  • June 2015
  • April 2015
  • February 2015
  • January 2015
  • December 2014
  • November 2014
  • October 2014
  • September 2014
  • August 2014
  • July 2014
  • June 2014
  • May 2014
  • April 2014
  • March 2014
  • February 2014
  • January 2014

Chivaroli and Associates Insurance Services is a full-service brokerage firm specializing in the custom-design and placement of insurance and alternative risk funding solutions for your healthcare organization.

Facebook
Twitter
LinkedIn
YouTube

Contact Us Today

Address:
200 North Westlake Blvd., Suite 101
Westlake Village, CA 91362
Phone:
805-371-3680
E-mail:
mail@chivarolitr.wpengine.com

Resources

Health Care
Insurance
Terms & Definitions
News
About

Policies

Cookie Policy
Disclaimer

Recent News

  • Lawmakers Seek New Limits to Travel Nurse Costs
  • Experts Predict Healthcare M&A Will Accelerate in 2023
  • Surveys Indicate a Persistent Hard Insurance Market
  • Doctors are Disappearing from Hospital ERs as Private Equity Cuts Costs
© 2023 All rights reserved. Powered By Insurance Agency Website by Stratosphere