The healthcare industry is no stranger to data breaches. In a two-year period, the OCR's Breach Reporting Tool, or "Wall of Shame," recorded 414 incidents involving 500 or more people. What's notable is that, according to the Verizon 2018 Data Breach Investigations Report, healthcare was the only industry where more data breaches were caused by insiders (56 percent) than by external threats (43 percent).
To reduce the risk of employees abusing their access privileges, digital security is crucial. However, those security efforts must be combined with physical security measures, such as strict key control. Think about how easily unauthorized key use could cause a data breach. One hospital, for example, lost control of the keys used to access locked bins holding patients’ information sheets waiting to be shredded. Only three employees were supposed to have access to these keys, but an audit revealed that more than 53 employees had key copies, with no record of how they'd acquired them.
If you're a healthcare provider, below are three steps you can take to tighten your facility’s key security.
1. Train employees.
One of the biggest security threats healthcare institutions face are staff members' mistakes. The 2018 Global Cost of a Data Breach Report by Ponemon attributes 27 percent of data breaches to human error alone. To help avoid costly errors, regularly educate your employees — especially those who have access to patient information — on privacy and security best practices. If a potential breach occurs, ensure they know the proper procedure for reporting it.
2. Find a key control system that holds employees accountable.
Your facility may have a key control policy in place, but if it's not enforceable, it's not effective. When it comes to key control, digitizing as many of those procedures as possible helps ensure employee compliance. It's important to find a key control system that minimizes manual steps. Instead of requiring staff members to issue keys, you can reduce the possibility of human error and manipulation by automatically tracking keys and user access.
3. Maintain a verifiable audit trail.
Keeping a verifiable record of employee key access helps you identify potential security breaches (e.g., an employee who regularly returns keys late or attempts to remove keys when they're not on the clock). If an incident does occur, the audit trail demonstrates that you've taken measures to protect patients and their information.
By increasing your key security, you can reduce your odds of an insider data breach and hopefully avoid a spot on the Wall of Shame.