HCS 483 Week 2 Security and Privacy in Health Care Technology Example

One Click Away: Phishing as the Front Door to Health Care Data Breaches, and a Security and Privacy Plan for a Regional Health System's 9,000 Email Users

[Student Name]

University of Phoenix

HCS/483: Health Care Information Systems

Week 2 Assignment

[Instructor Name]

[Date]

The health system, its simulation results and its plan are composites written for a model paper; research findings come from the sources listed.

Last month, the information security team of a regional health system with four hospitals, 60 clinics and about 9,000 email users sent a simulated phishing email to every employee. It looked like a notice from the benefits office about an overdue enrollment form. Within four hours, 1,480 people, about 16%, had clicked the link, and 310 had typed their username and password into the fake page. No real harm was done, but leadership asked a direct question: what would have happened if the email had been real, and what should the system do? This paper answers with a security and privacy plan.

Privacy and Security Are Not the Same

Privacy concerns who may use and disclose protected health information and for what purposes. Security concerns how electronic protected health information is kept confidential, accurate and available. The HIPAA Privacy Rule governs the first; the Security Rule governs the second and requires covered entities to conduct risk analyses and put administrative, physical and technical safeguards in place (U.S. Department of Health and Human Services, 2022). A phishing attack is a security failure that can quickly become a privacy breach if an attacker uses stolen credentials to view patient records.

Why Phishing Matters

Phishing is not a minor nuisance in health care. Gordon et al. (2019) analyzed 95 simulated phishing campaigns at six anonymized U.S. health care institutions, covering nearly three million emails. About 14.2% of emails were clicked, with institutional median click rates ranging from 7.4% to 30.7%. Importantly, repeated campaigns were associated with lower odds of clicking: organizations that ran more than ten campaigns saw about a two-thirds reduction in the odds of a click compared with early campaigns. The health system's 16% click rate sits squarely in that range.

The consequences can be severe. Neprash et al. (2022) documented 374 ransomware incidents at U.S. care delivery organizations over six years, from 2016 through 2021, which together exposed records on close to 42 million people. The yearly count more than doubled over those six years, and almost half disrupted care, most often through electronic system downtime, and sometimes through canceled appointments or ambulance diversion. Many ransomware attacks begin with a single stolen login, which means the 310 employees who typed their passwords into a fake page were, in a real attack, 310 possible doors into the health record.

Administrative Safeguards

The plan starts with people and processes. Every employee will complete a short, scenario-based phishing module each year, and monthly simulated phishing campaigns will continue, varied in difficulty. Employees who click will receive immediate, brief training rather than punishment, and those who report suspicious emails will be recognized, because a culture of reporting catches real attacks faster. The security team will update its risk analysis to rate phishing and credential theft as high risk, and managers will receive monthly results for their departments.

Physical Safeguards

Although phishing is an email threat, attackers who obtain credentials may try to use them from any device. The plan requires that clinical workstations lock automatically, that laptops and phones used for work be encrypted and enrolled in device management so they can be wiped remotely, and that shared workstations use badge tap-in rather than typed passwords where possible.

Technical Safeguards

Technical controls reduce the damage when a person makes a mistake. Multifactor authentication will be required for email, remote access and the electronic health record from outside the network, so that a stolen password alone is not enough. Email filtering will flag external senders and quarantine messages with known malicious links. The security team will monitor audit logs for unusual access, such as a user viewing hundreds of records at 3 a.m. Backups of critical systems will be kept offline and tested, so that recovery from ransomware does not depend on paying.

Vendors and Business Associates

The health system's own employees are not the only target. Billing companies, transcription services and software vendors that handle its patient data are business associates under HIPAA, and attackers often phish them instead. The plan requires every business associate agreement to include multifactor authentication for any access to the system's data, prompt notice of any security incident and the right to review the vendor's security assessment. Vendors with remote access will connect only through monitored accounts that expire when a project ends.

When Prevention Fails: Privacy and Response

If an attacker uses stolen credentials to view patient records, the event becomes a potential breach of unsecured protected health information. The privacy officer will lead an investigation, including a risk assessment of what was accessed. If notification is required, affected patients must be told promptly, within 60 days of the breach being discovered at the latest, and breaches affecting 500 or more people must be reported to the Department of Health and Human Services and the media. An incident response plan, practiced twice a year in tabletop exercises, will assign roles in advance.

Measuring Progress

The plan will track the click rate and credential entry rate on monthly simulations, the reporting rate for suspicious emails, the share of accounts protected by multifactor authentication and the time from report to containment for real incidents. The target for the first year is a click rate below 8% and multifactor coverage of all remote access. Results will go to the board's audit committee each quarter.

Cost

Training and simulation software, multifactor authentication licenses and additional email filtering are estimated at $420,000 in the first year, far less than the cost of downtime and recovery after a single successful ransomware attack.

Conclusion

Phishing is the front door to many health care breaches, and one in six employees at the health system walked through it in a test. A plan that combines training and repeated simulations, device controls, multifactor authentication and filtering, monitoring and practiced incident response addresses the threat through all three kinds of safeguards and protects both the security and the privacy of patient information.

References

Gordon, W. J., Wright, A., Aiyagari, R., Corbo, L., Glynn, R. J., Kadakia, J., Kufahl, J., Mazzone, C., Noga, J., Parkulo, M., Sanford, B., Scheib, P., & Landman, A. B. (2019). Assessment of employee susceptibility to phishing attacks at US health care institutions. JAMA Network Open, 2(3), Article e190393. https://doi.org/10.1001/jamanetworkopen.2019.0393

Neprash, H. T., McGlave, C. C., Cross, D. A., Virnig, B. A., Puskarich, M. A., Huling, J. D., Rozenshtein, A. Z., & Nikpay, S. S. (2022). Trends in ransomware attacks on US hospitals, clinics, and other health care delivery organizations, 2016-2021. JAMA Health Forum, 3(12), Article e224873. https://doi.org/10.1001/jamahealthforum.2022.4873

U.S. Department of Health and Human Services. (2022). Summary of the HIPAA security rule. https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html