The recent Anthem breach points to the need for all organizations to secure the personal information of their employees and patients, including health insurance information. Crooks know this kind of information will sell like hot cakes on the black market, both to knowing criminals looking for access to prescription drugs, as well as unsuspecting individuals simply looking for affordable healthcare options.

I advise people to check with their healthcare providers and insurance companies as often as they check with the three major credit bureaus. Just as we need to look for unauthorized transactions on our financial accounts, we need to watch for fraudulent activity on our increasingly valuable (and vulnerable) health insurance accounts.

The Health Insurance Portability and Accountability Act (HIPAA) requires healthcare providers and insurers to share information with patients about the way in which their personal data is secured, as well as who has recently accessed it for reasons that do not support treatment, payment or operations, upon request; HIPAA refers to these as "accounting of disclosures." This is in addition to sharing the details in times of a breach. HIPAA also requires that healthcare providers and insurers provide a copy of the medical records (contained within what is called a "designated record set") upon the request of patients and insureds.

This underscores the need for healthcare providers and insurers to perform strong and frequent due diligence on the safety controls of their own systems and activities. Ask to see your patient records and accounting of disclosures at least once a year to make sure all your information is accurate. 

Tip #2: Monitor Your Third Parties

In many of the most publicized data breaches, such as Chick-fil-A, contracted third parties have been found to be main point of entry for hackers. That's why it's so important to determine the strength of a contracted business provider's security before entering into a partnership.

To address this need, I've developed a third-party contractors tracking and risk-evaluation service specifically for healthcare providers held to HIPAA requirements for covered entities. The service helps privacy, compliance and security managers keep track of their business associates, centrally documenting the health information each has access to, the security controls and practices they follow and other important information the covered entities need to know. This helps each covered entity (the healthcare providers, insurers and clearinghouses) better determine the risks each entity poses to patient privacy and the organization's overall security. As well, the service helps covered entities manage updates provided by the business associates.

FYI, I am happy to share the news I will be making this third-party contractors system available to all industries in 2015. Want to know more? Just drop me a line.
 

Tip #3: Keep Eyes Open for Scammers 

Data trafficking is now more lucrative than drug trafficking! So it's no wonder crooks and opportunists are everywhere trying to get access to your data. Following are a few of the latest tricks and traps getting unaware consumers into hot water.

Pizza delivery - Scammers place phony menus under car windshield wipers and wait for unsuspecting diners to call in. That's when they steal their full names, credit card information and home addresses.

Airline rewards - Hijacking air miles is a hot trend among criminals who access the accounts through stolen usernames and passwords (often obtained through third-party sites unrelated to the airlines). (Thanks to my friend Faith Heikkila for this tip.)

Lenovo computers - The Internet was a buzz last week with news that Chinese computer manufacturer Lenovo had built spyware into certain machines. Fortunately, you can find and remove it by following these instructions.