4 Tips to Prevent and Detect Insider Threat Incidents

As an organization in the healthcare industry, you already know you’re at a higher target for threats because of the information you store and transmit. Most hospitals do their due diligence to set up security standards to protect patient information from outside threats, but then often underestimate the exponential risk of threats that can happen within the organization.

Your employees have access to a lot of information, and while they might not act maliciously, there are a lot of opportunities for patient data to be exposed or used in the wrong way.

You must also consider how work has changed since the surge of COVID-19. Your employees are taking their work home, and many organizations plan to maintain a remote workforce; this calls for even stronger policies and procedures that address our “new normal.”

We’ve gathered a few tips, along with information about our Patient Privacy Manager’s Portal solution, to help you gain insight to prevent and detect insider threat incidents. 

1. Set up guidelines and policies to prevent data mismanagement

Your employees are expected to protect patient data, but to do so, they need a set of guidelines and procedures to follow. Think about your current privacy and security playbook; does it fully outline the critical steps to prevent data mismanagement?

Some essential guidelines you should include are maintaining a need-to-know basis towards healthcare data, specifying which devices can access patient data, and prioritizing discretion when transmitting information.

Make sure your guidelines are clear and well-written, this will make it easier for your employees to understand, and more importantly, to follow.

Plus, if some of your employees have shifted to working from home, it’s also important to address remote work policies as well to ensure they’re staying safe no matter from where they’re logged into your systems.

2. Implement consistent privacy and security training  

Privacy and security training are often a part of first-day orientation, but it shouldn’t stop there. Your team needs to be well-versed and up to date on privacy policies and procedures to carry out their functions.

COVID-19 had many healthcare organizations strategizing how they can better secure information at all levels. This is a critical time to revisit security training, but you should also keep in mind that consistent training is still necessary for moving forward.

The Cost of Insider Threats 2020 Global Report reveals that 62 percent of internal threat incidents were the result of accidental and careless employees. This statistic could be drastically lowered with consistent and proper security training.

3. Use technology resources to detect and prevent insider threats

The same report conducted by Ponemon Institute and co-sponsored by IBM showed that 25 percent of internal threats stemmed from malicious employees. Yet, regardless of an employee’s intent – malicious or accidental – experts agree that it’s an organization’s responsibility to have a threat management plan that combines people, processes, and technology to identify and prevent insider incidents.

4. Document and follow-up investigation reports

Analyzing every access to PHI and spotting suspicious activity is just the first step. Once suspicious activity is spotted, your privacy team must work with department managers to complete the review and documentation.

This process tends to get convoluted with back-and-forth exports and can potentially open your team up to more risk – the best way to review suspicious activity is with a systematic solution.

Introducing Patient Privacy Manager’s Portal

Just last year, 60 percent of healthcare organizations reported that they’d experienced more than 30 insider incidents. According to Proofpoint, health and pharma organizations spend an average of $10.8 million annually on insider breach remediation. With statistics like that, you can’t risk allowing a stack of unresolved incidents to pile up.

Manager's Portal – a part of the iatricSystems patient privacy solutions –  streamlines workflows between the privacy team and your department managers when conducting an internal privacy investigation.

Your managers can gain an at-a-glance view over patient privacy to minimize risk to investigation integrity, increase privacy awareness, and alleviate excess work for the privacy team.

The key to strengthening internal security is connecting the dots between your privacy team and your department managers. Read the full brochure and contact us to learn more about Manager’s Portal and our other patient privacy solutions.