When a group of hackers stole more than 4.5 million patient records from a Tennessee-based (USA) hospital chain, more people began to realize that data breaches aren't just for banks and major retailers. In fact, over the past several years, more than 500 medical institutions have been attacked, resulting in the exposure of well over 25 million patient records. It appears the hackers are not only operating from the U.S., but also from China and other countries. 

Earlier this year, I spoke about the Heartbleed vulnerability. As it turns out, researchers believe the Tennessee hospital breach was a result of the hackers exploiting that faulty code. It is more critical than ever before that patient information is effectively secured everywhere it is stored and accessed.

It's incredibly important for healthcare providers, insurers and the businesses doing work for them to step up their games. Below are important components of an effective information security and privacy program:

1. Establish comprehensive information security and privacy policies and supporting procedures that meet all HIPAA requirements. Follow them!
2. Provide information security and privacy training so all who have access to patient information understand how to most effectively protect information.
3. Perform regular risk assessments. 
4. Keep all systems, applications, network security and code updated. Be sure to include medical devices, which are all too often not secured. 

Here are five ways consumers can help improve the security and privacy of their own patient information:

1. Read the Notice of Privacy Practices (NPPs) supplied by doctors and health insurance companies and take note of when it was updated. All NPPs should have been updated last year.
2. Ask to see their own healthcare records to ensure they're accurate. Every healthcare provider and insurer must have efficient and timely procedures in place to allow for this.
3. Ask how often personnel are trained, and if they give them ongoing awareness communication. These are not only HIPAA requirements, they ensure personnel understand how to effectively safeguard information.
4. Ask for proof that medical devices that transmit data wirelessly have been secured. Most medical devices do not have sufficient security, which puts data...and possibly health...at risk.
5. Don't use mobile apps to collect, store or process health information until you've verified them to be secured. Research shows most apps do not have adequate safeguards in place.  

Bottom line: Healthcare organizations (and all other types of organizations) need to step up their information security and privacy efforts. Patients and insureds need to tell them that this is important, and pressure them to strengthen their safeguards to address today's many, and increasing, risks.

Early to Bed, Early to Rise, Keeps You Healthy, Wealthy & Wise

From the time you get up in the morning to the time you finally hit the hay, you have come into the contact with more "smart" equipment than you can probably imagine. Your thermostat, your medical device, your car... most every digitally powered gadget in your life either already is or will soon be connected to what's known as "The Internet of Things."

Here is an infographic I created to illustrate The Internet of Things

In 2009, there were nine million smart gadgets. In 2012, there were nine billion. That's expected to be as many as 90 billion by 2020. Imagine how much personal data will be floating through the air, on servers, in the gadgets and on networks and clouds that year!

Smart gadgets can be used, worn, installed... and now even swallowed. Yes, swallowed. There is such a thing as a smart pill that will report on your internal health and vitals and then dissolve inside you.

Naturally, there are great benefits to these devices. Yet providers and users - especially those in the medical field - have to be aware that all of this information is vulnerable to collection, analysis and theft.  

The Internet of Things was one of the topics we discussed on my most recent visit to the Great Day morning show, which you can watch on YouTube. I also spoke about the risks in a keynote I gave in Bogota, Colombia in June.

Prevention Is Better Than Cure 

A strong password has always been a best security practice. Yet, it's becoming even more important now as hackers have learned to successfully pose as system administrators to accomplish their dastardly deeds. Contemporary crooks are using remote control tools, like Microsoft and Apple remote desktops and LogMeIn, to gain administrative access to payment systems to steal unencrypted payment card data and other sensitive information.

A weak password today is like an open door in a high-crime neighborhood. Although no system is ever truly hack-proof, administrators have no excuse for avoiding the simplest of security steps.

Medical administrators, in particular, must pay extra attention to securing their access. According to the editor of Healthcare Informatics, many user logins in healthcare can be characterized as "incredibly lame passwords on the part of end-users in patient care organizations."

In addition to simply being "lame" (think 12345, for example), a second common practice is making passwords an incredibly hot commodity on the black market. Take the Russian theft of passwords that numbered in the billions. These criminals attacked lower-level retail and other websites to get at passwords people use not only for access to those systems, but also for access to their financial institutions. Unfortunately, it's not uncommon for someone to use the same password for the local library as for online banking access. Folks, use different types of passwords...GOOD, STRONG passwords...for different types of sites!!

Even passenger jets are vulnerable, as we learned in August when cybersecurity researcher Ruben Santamarta demonstrated how he could hack the satellite communications equipment on passenger jets through Wi-Fi and in-flight entertainment systems. This makes it more important than ever for airplane computer engineers to build in strong security controls.  

Three Scams Bad for Privacy Health

What follows are pointers to some new and some well-worn scams. Share this warning with your friends, colleagues and family to keep everyone up-to-date and secure.

Facebook color changer app is nothing but a scam - This trap lures users to download an app called "Facebook color changer." Doing so gives the culprits access to the victim's personal information and Facebook friends list, plus potentially to their entire site.

Ohio Turnkpike Commission warns E-ZPass customers of email scam - With the email subject line "E-ZPass Info," phishing artists con unsuspecting commuters into giving up their personal information and potentially even their money.

Con artists posing as soldiers scam women out of thousands - Preying on lonely hearts, this trap uses legitimate, stolen identities to convince women the scammers are actually military officers. After establishing a digital relationship, the faux soldiers then request money for things that will keep the "romance" going, like laptops and internet access.