Healthcare Organizations Under Attack: Protecting PHI and PII

Transcription

1 December 5-7, 2016 Westin Boston Waterfront Healthcare Organizations Under Attack: Protecting PHI and PII Jonathan Cohen Synchronoss Technologies boston.healthprivacyforum.com #hitprivacy

2 AGENDA 1. PHI and PII Overview 2. Why PHI is an Appealing Target 3. Platform Overview 4. Use Cases 5. Next Steps

3 PHI AND PII OVERVIEW Types of PHI and other Patient PII that must be protected by Providers and Clinicians, e.g. Pa#ent Encounter Forms Electronic Medical Record Con#nuity of Care Document

4 THREATS TO PATIENT INFORMATION Rich set of personal data extremely valuable to cybercriminals for Identity Theft Often contains payment card information and bank account data that can be used for theft and fraud Perhaps the most valuable records to steal (street value >$300 per record) This information is often inadequately protected on mobile devices Yet, for productivity and improved patient care, clinicians need to embrace mobility Source: FireEye & Synchronoss Analysis

5 26 61% Accounts That Require Username & Password Users Reuse Passwords Among Websites TO FUTHER COMPLICATE THINGS 63% Confirmed Breaches Involved Weak Or Stolen Credentials

6 Of the 5,000+ largest successful attacks in the last 10 years, 82% exploited weak or stolen passwords Only TWO involved 2-factor authentication!

7 How do we meet the needs? Key Elements of a Secure Enterprise Platform

8 KEY ELEMENTS OF A SECURE ENTERPRISE PLATFORM SECURE EXTERNAL COLLABORATION COLLABORATION MOBILITY SECURE MOBILE CONTAINER + PRODUCTIVITY APPS DESCRIPTIVE, PREDICTIVE & PRESCRIPTIVE ANALYTICS SERVICES ANALYTICS IDENTITY MULTI FACTOR AUTHENTICATION, PROOFING & CERTIFICATES

9 FOCUS ON IDENTITY MANAGEMENT AND AUTHENTICATION ISSUES CREDENTIALS MANAGED ATTRIBUTES VERIFIES IDENTITIES AUTHENTICATES USERS

10 REPRESENTATIVE USE CASES

11 PRACTICAL APPLICATIONS USE CASES MOBILITY IDENTITY & ANALYTICS COLLABORATION LIFE SCIENCES Field access to CTMS & EDC apps on BYOD Dynamic provisioning/ de-provisioning access to regulatory submission content R&D CollaboraDon Workspace for Pharma, Biotech & Academia HEALTHCARE Secure EMR access on clinician BYOD Prescriber verificadon for controlled substances CollaboraDve care workspace for distributed medical teams

12 BRINGING IT ALL TOGETHER SECURE ENTERPRISE PLATFORM FOR HEALTHCARE ID UNIVERSAL + Basic Research Chemical registration Compound management and analysis LAGOON & ORBIT Orbit Suite in Container on Devices SECURE PRODUCTIVITY Mobility Box, O365 DCTM, SharePoint UNIFIED IDENTITY Frictionless Access Collaboration Workspace Collaboration Gateway DATA CONNECTORS Policy & Controls ectd, CMC, EHR LIMS, ELN, KB CONTEXTUAL AUTHORIZATION Pre Clinical Science Early stage analysis and performance Innovative research (e.g. Biomarkers, Genomics) Clinical Trials Trials management with CROs Electronic data capture & submission management Monitoring & auditing Commercialization Manufacturing quality & process controls Supply chain & logistics management

13 FROM STATIC MOBILE APPS THAT PROVIDE MINIMAL VALUE Legend Workflow interruption Compliance violation Clinical investigator (CI) opens Patient Encounter Form mobile app on BYO tablet Patient Encounter Form (epef) app may not be available on BYO device or adequately secured CI completes capture of patient info, including mobile contact info and saves work Additional clarifying information is captured and then appended to the CRF Next day the CI is reviewing the CRFs from prior day and notices a concerning test result The CI opens native messaging app on her tablet and connects with the patient Record of chat session with patent manually transcribed to Patient Encounter Form PHI not secured on personal device

14 TO MOBILE APPS SECURELY ENABLED WITH WORKFLOWS Clinical investigator (CI) opens epef mobile app on BYO tablet CI completes capture of patient info, including mobile contact info and saves work Next day the CI is reviewing the CRFs from prior day and notices a concerning test result Conversation recorded and securely appended to epef Additional clarifying information is captured and then appended to the epef The CI opens native messaging app on her tablet and connects with the patient Conversation recorded and securely appended to epef HIPAA compliant messaging app launched from epef mobile app

15 PLUGINS INNOVATIVE APPLICATION FOR INTERNET OF THINGS Sensitive IoT data secured within the container Mobile apps secured in container interact with IoT devices Gateway secures transmission, placed as cloud service or on-customer premises Plugin architecture enables interaction with back-end services GATEWAY CONTAINER SENSOR ANALYTICS IDENTITY DATA Private and Public Cloud Plugins POLICY Integrate with any API MEDICAL DEVICE PRIVATE API PUBLIC API DRONE Synchronoss. All Rights Reserved. 2016

16 KEY TAKEAWAYS Strong mobile security framework and authentication is required to enable secure external collaboration, to secure PHI and PII Container-based security is best to secure mobile apps on BYO devices that contain and/or transmit PHI or PII IoT transmitting PHI or PII is no different and requires that data must be protected at rest and in motion

17 Jonathan Cohen Synchronoss Technologies