Because of the vast amount of sensitive PII and financial data it holds, the healthcare industry is a frequent victim of hackers and other threat actors, driving the average cost of a healthcare breach to $10.93 million.1 Yet, it is also one of the biggest adopters of Internet of Things (IoT) devices, many which directly impact patient health and well-being.
For these reasons and others, the healthcare sector is subject to special compliance and data security requirements. The World Economic Forum reported that the healthcare industry produces approximately 30% of all data worldwide and that number is not only increasing but rising faster than any other industry.2,3 Much of that data is unstructured, making it more difficult to categorize and standardize, and, in turn, making governance practices more difficult to deploy.4 Without good governance practices and policies, it doesn’t just open up risks for the network and data, it also negatively impacts business operations and patient care.
Data Governance Requirements of Healthcare
In the healthcare sector, data governance centers around safeguarding patient information. Requirements for this data protection include implementing policies, risk assessments, and access controls for the following:
- Health Insurance Portability and Accountability Act (HIPAA)—This is the best-known data compliance and governance mandate. Signed into law in 1996, its role is to protect sensitive health data and prevent disclosure to third parties without patient permission.
- Personally Identifiable Information (PII)—PII is not necessarily covered under HIPAA compliance unless it is directly linked to healthcare information. Therefore, setting up security around PII falls under the Privacy Act and other federal, state, and local data privacy dictates.5
- Patient safety—Data governance ensures that patient records are accurate and secure, which helps to reduce the risk of mistakes in patient care.
- Beyond the hospital—There are many facets to healthcare, and data is shared across many networks, both in and out of a single healthcare system. Urgent care clinics, primary care practices, long-term care, specialists, and hospitals all need to work together to create a governance structure that allows patient data to be shared securely.
The Rise of IoT and Edge Applications in Healthcare
The healthcare industry uses IoT and edge applications to improve overall patient care. Medical professionals can use these devices and applications to monitor patient vital statistics remotely or to manage medications and treatments.
However, the hyperconnectivity of IoT devices comes with greater risk. Because of the value of the data in the healthcare sector, threat actors see IoT devices as an easy way to gain access to a network. And threat actors are getting in: the weekly average attacks against the healthcare sector is more than 2,000, an increase of 32% over a year ago. Ransomware, DDoS attacks, and data breaches are the most common threats to healthcare via IoT devices.6
IoT devices are vulnerable for a variety of reasons that include:
- Outdated software, firmware, and operating systems
- Weak passwords or not changing the default password
- Lack of encryption across the device
- Shared devices
- Vulnerabilities built into the device or software
Best Practices for Data Governance and Data Security
To ensure healthcare data is safe and secure and that patients are able to get the best care, there are some best data governance practices to follow:
- Hold regular user awareness training around data security and IoT device security.
- Implement and enforce policies for a data governance framework.
- Stay up to date with device and software updates and patches.
- Deploy MFA and biometric authentication methods.
- Modernize networks and infrastructure.
Data governance in healthcare has to be practiced at every level, from the CEO to the medical staff to the front desk receptionist. Without proper governance, patient data and security of the organization will be at risk.
How Connection Can Help
Connection is your partner for data security solutions and services. From hardware and software to consulting and customized solutions, we’re leading the way in data governance and solutions.
Explore our Solutions and Services
Reach out to one of our security experts today: 1.800.998.0067
- IBM, Cost of a Data Breach Report 2024
- World Economic Forum, Data and trust: the two pillars of value-based healthcare
- IDC, The Digitization of the World from Edge to Core
- HealthTech, What Is the Role of Data Governance in Healthcare?
- U.S. General Services Administration, Rules and Policies – Protecting PII – Privacy Act
Industrial Cyber, CPR data reports 32% rise this year, as global healthcare sector faces surge in cyberattacks
Jennifer Johnson
Jennifer Johnson, Director Healthcare Strategy and Business Development, joined Connection in 2010 starting in field sales and joined the healthcare practice in 2015. Jennifer has more than 20 years in IT, including prior roles in distribution and manufacturing. Jennifer holds her Certified Digital Health Leader designation from the CHIME organization and is a member of HIMSS, where Connection is a diamond sponsor. Jen was named CRN Women of the Channel in 2023 and 2024 and holds certifications from NVIDIA (AI Advisor- Sales) and Dell Technologies (AI Champion- Partner Sales).
