Latest / CareTalk: Healthcare. Unfiltered. / Cybersecurity Concerns in Healthcare

Transcript

Cybersecurity Concerns in Healthcare · CareTalk: Healthcare. Unfiltered.

• 0:00
  David: Like many in healthcare, UnitedHealthcare suffered a data breach recently when hackers broke into the mobile portal of some of its members.
• 0:08
  David: Company says hackers were able to view member information like demographics and claims information, but not social security numbers or driver's license data.
• 0:15
  David: Company forced password resets and bought identity theft protection for the effective members.
• 0:21
  David: Well, it's good that United figured out what happened, but it took them a couple months.
• 0:25
  David: There are still a lot of unanswered questions, including whether members have anything to worry about.
• 0:29
  David: What's the motive of the hackers and how companies can, and users can prevent something similar from happening again.
• 0:36
  David: Welcome to CareTalk America's home for incisive debate about healthcare, business, and policy.
• 0:41
  David: I'm David Williams, president of Health Business Group.
• 0:44
  John: And I'm John Driscoll, the president of Walgreens Health.
• 0:46
  John: Well, David, I wouldn't be giving United too hard a time.
• 0:49
  John: I mean, anthems been hacked.
• 0:51
  John: You've probably been hacked.
• 0:53
  John: A lot of health plans get hacked.
• 0:55
  John: Even banks every so often get hacked.
• 0:58
  John: Although banks are.
• 0:59
  John: Worried about other things these days.
• 1:02
  John: I mean, how are we to navigate this, uh, world where we're, where all these institutions are getting, getting hacked and, and, and whacked in the process?
• 1:12
  David: Well, John, you make a fair point.
• 1:13
  David: I, I saw an estimate recently, unofficial estimate that something like, uh, 30% of people have had their, uh, healthcare data hacked.
• 1:19
  David: So it is certainly, uh, not a unique one, but it's just the most recent one, which is, which is why I bring it up.
• 1:25
  David: And I think probably useful to understand kind of what actually happened.
• 1:29
  David: Uh, in this case, you know, there's some general.
• 1:31
  David: Things that, that people can follow and, you know, probably rules that people have have heard before, but maybe it makes some sense to, to, to understand what AC exactly occurred.
• 1:39
  David: My understanding is that, uh, there was some user information that was disclosed on the mobile app back in February.
• 1:45
  David: It was things like names, identification, number, you know, from the, the health plan, the birthday address, provider names.
• 1:51
  David: And claims information, and, uh, you know, the company figured it out a couple months later, they said what had happened is that the, uh, the hackers had used a, a, a technique called credential stuffing.
• 2:02
  David: You know what that is, John?
• 2:03
  John: No.
• 2:04
  John: What is I, I, I, I've heard of spoofing, but I haven't heard of stuffing.
• 2:07
  John: What's, what's that about?
• 2:09
  David: So, credential stuffing means basically, you know, getting usernames and then trying a bunch of different passwords.
• 2:14
  David: And seeing what will, what will work.
• 2:16
  David: Now, you know when you are, uh, going online and you, and you forget your password or you put the wrong password in, eventually it'll, it'll lock you out.
• 2:24
  David: However, um, the hackers are actually able to start with a good guess on the password.
• 2:29
  David: So there are these data breaches that have been out there from other places like Netflix.
• 2:33
  David: Uber doesn't have to do anything necessarily with a, with a health plan, and people tend to u reuse their usernames and passwords.
• 2:40
  David: So if we have John Driscoll out there and, and Netflix, uh, revealed that you, you used the password, Driscoll 2022, let's just say, how did you know that?
• 2:47
  David: I'm just, well, I don't know.
• 2:49
  David: But then what, what they could, you know, the hacker could then sign in.
• 2:52
  David: To the United or Anthem portal, any portal, and try that.
• 2:56
  David: And if 2022 doesn't work, 2023 might work.
• 2:59
  John: And they actually, and you can actually, you can actually write an algorithm where you check first name, last name, mother's maiden name, birthdate, kids' birthday, kids' names, kids' birthdays, family name and the, and my, my favorite one, which is Mark Zuckerberg's.
• 3:14
  John: Yeah.
• 3:15
  John: Facebook password.
• 3:17
  John: Which was password.
• 3:18
  David: Yeah.
• 3:18
  David: Or Facebook password is the most popular
• 3:20
  John: password actually.
• 3:21
  John: SS W O R D.
• 3:22
  John: Exactly.
• 3:23
  John: It's sort of like, One, and then you check 1, 2, 3, 4, 5.
• 3:26
  John: Like it's, people do very, really, uh, like you simple passwords.
• 3:31
  David: Yeah.
• 3:31
  David: So this is the reason why they say don't reuse passwords.
• 3:34
  David: It doesn't have to do with, uh, you know, where you used it.
• 3:38
  David: Password.
• 3:38
  David: One place.
• 3:39
  David: Could be found and used somewhere else.
• 3:42
  David: So that's credential stuffing.
• 3:44
  David: And if you've got millions of different, uh, you know, members of a health plan, you could try several thousand.
• 3:49
  David: Yeah, try two or three.
• 3:50
  David: And they get, they get locked out.
• 3:52
  David: Uh, big deal.
• 3:53
  David: You keep going until you find some, uh, that work.
• 3:57
  David: Well,
• 3:57
  John: the, the thing about, about software and bots is you can program the bot to do a couple of things.
• 4:02
  John: Once you've got ac, once a, any of your passwords or identities are hacked, they're usually available for sale in the dark web to be resold.
• 4:12
  John: Yeah.
• 4:12
  John: And people can even do derivations of your old passwords to try to crack, uh, a, a, a new, a new, a new source.
• 4:20
  John: I mean, the problem with healthcare is your.
• 4:23
  John: There's, there's obviously a lot of hacking to get personal information and to get credit card numbers and social security numbers, but healthcare data is worth three to five times as much as general data on the web, and so, Healthcare will continue to be a bigger target.
• 4:41
  John: The other thing is that healthcare institutions have a pretty good profile, in some cases, a very accurate and up-to-date profile of who you are and how healthy and what the risks are to, to you and tho and those are deeply intimate private items that everybody should care about being protected.
• 4:59
  John: John,
• 4:59
  David: let's talk about that data.
• 5:00
  David: So, you know what, what typically happens when there's a breach?
• 5:03
  David: A company may offer, say, credit monitoring, uh, for a couple years.
• 5:07
  David: And in fact, that's what the company's done in, in this case.
• 5:09
  David: Now, that is actually useful to prevent someone from opening a, a new credit card in your name, uh, for example.
• 5:15
  David: But there's other kinds of information now.
• 5:17
  David: In the past, maybe some of it was just em embarrassing.
• 5:20
  David: Let's say if you had, uh, rhinoplasty, for example, John, I'm not saying you did, um, or I had, and if my
• 5:25
  John: nose looks just fine, it was only broke.
• 5:27
  John: It was broken in a very consistent way.
• 5:29
  John: Good.
• 5:30
  David: But let's think about what's, let's think about what's going on now, and when you hear that claims information, for example, was released, let's tie that in with some of what's happening now.
• 5:38
  David: There's been concern about like apps that might collect on women's health information about.
• 5:43
  David: Their period, for example.
• 5:45
  David: Now imagine if you had a situation where this, this isn't too farfetched, right?
• 5:49
  David: Somebody living in a state where abortion is not allowed.
• 5:52
  David: It's like Texas, and they travel to a neighboring state like Arizona and have an abortion.
• 5:57
  David: Now that.
• 5:57
  David: Is something that's maybe a covered benefit might be in there.
• 6:01
  David: There's bounty hunters.
• 6:02
  David: Uh, it's allowed in the law in Texas to go from somebody who's aiding and abetting an abortion.
• 6:06
  David: You can get $10,000 for that.
• 6:08
  David: So they could, might even actually have a financial motive to go after that.
• 6:11
  David: You could imagine gender affirming care, which is being outlawed in some places.
• 6:15
  David: And then on.
• 6:15
  David: This is not just a, uh, a left wing, you know, liberal woke thing.
• 6:19
  David: Imagine mental health.
• 6:20
  David: That's what we hear about as a reason to take somebody's, uh, second Amendment.
• 6:24
  David: Rights and concerned about, you know, what ha might happen with their, uh, you know, with their firearms.
• 6:29
  David: So claims information is something you're not gonna protect, uh, by giving somebody LifeLock for a couple years.
• 6:35
  David: This very, uh, serious John.
• 6:38
  David: Well, I think,
• 6:39
  John: I think what, what, you know, first of all, I think it's really hard for healthcare institutions in a world where everybody's getting hacked to be perfect.
• 6:47
  John: And we should get into what people as individuals can do to protect themselves because the risks, as you say, are quite serious.
• 6:55
  John: Um, they're with the disputes and, um, and potential denial of access to women's health and the, the, the.
• 7:05
  John: Poisoning of the dialogue and the criminalization of basic access to, to healthcare services that varies dramatically state by state access.
• 7:15
  John: In one state, you're a criminal, another.
• 7:18
  John: That information becomes really dangerous.
• 7:21
  John: Um, and then you've got the risk profile of someone who, you know, may have a very different view of, of same sex, uh, relationships or be judgemental about particular healthcare conditions.
• 7:34
  John: Um, the, the, the, the most vulnerable probably are those with mental health issues.
• 7:40
  John: Were just at the point in a, in American society when I think we're making some progress at taking away that stigma.
• 7:47
  John: Uh, the fear that could be associated with the sharing of the information might actually prevent people from getting the help they need.
• 7:53
  John: So protecting this healthcare information is absolutely essential.
• 7:57
  John: David and I, I think that the, the challenge is in a world where it's far more profitable and there's, there's, there's sort of, uh, an industry associated with hacking, collecting, and selling this information.
• 8:11
  John: I think it's not just the companies are obviously under a lot of pressure.
• 8:16
  John: To protect and defend, but we as individuals have to be kind of clever about how we make it harder for folks to access our own personal health information.
• 8:25
  John: Do you, perhaps you wanna talk a little bit about that because, you know, you, you, you and your team have actually thought a lot about cyber, cyber defenses and, and basic, but, but let's maybe start with the basics as a, as a patient or a caregiver.
• 8:39
  John: Or just an individual who, who's healthy then may interact with the healthcare system.
• 8:43
  John: How do you think about protecting yourself in this environment where your information's worth a lot more to somebody else than it is to you, but if they have it, it could be dangerous for you and your family.
• 8:53
  David: Fair enough, John, I'll, I'll talk about what individuals can do and then I think it's true that we can't expect, uh, data to be unhackable.
• 9:01
  David: And on the other hand, there are a lot of things the companies should do too, and that we should expect.
• 9:04
  David: Of them, but I'll start with the individuals.
• 9:06
  David: So one thing is that, you know, you heard about two-factor authentication, right?
• 9:09
  David: So that means you, you not just have your password, but you have something else.
• 9:13
  David: Most often it's actually a text message, uh, that, that you received.
• 9:17
  David: Now, two-factor authentication is sometimes an optional thing.
• 9:20
  David: You can turn it off.
• 9:20
  David: You say you're safe on this device.
• 9:22
  David: But I would say actually, but,
• 9:23
  John: but to slow down there, David, what is, for someone who does, hasn't thought about it and may be a little intimidated by.
• 9:29
  John: Two factor, what does that actually mean?
• 9:31
  David: So the factors are just the number of, of different types of items you have to have in order to validate your, your, your account.
• 9:37
  David: So one factor authentication would be just your password, so you have your username and password.
• 9:43
  David: So that's like a sort of standard one factor.
• 9:45
  David: Now a second factor is going to be, uh, some other information.
• 9:50
  David: It's usually not a second password, it's some other information coming in through a kind of an, an out of band approach.
• 9:55
  David: So they send you an email or they send you.
• 9:58
  David: Send a text message and that's the second factor.
• 10:01
  David: So you'll get a code that you can put in.
• 10:03
  David: Now that's, so what I would say is usually two-factor authentication is offered and you, you should accept it.
• 10:09
  David: It takes a little bit longer, but there's a, there's a good reason for that.
• 10:12
  David: Going.
• 10:12
  David: A step beyond that, um, you know, is, is related to, well, gf, I'm being paranoid or just being careful.
• 10:20
  David: If my second factor is that I'm gonna get a text, And that information on my cell phone is actually available in that same, uh, record that a hacker might have.
• 10:30
  David: You know, they can actually do something.
• 10:32
  David: They can do some diverting and actually something called sim swapping.
• 10:35
  David: Um, and actually take your phone number too.
• 10:37
  David: So that's why you'll see things like authenticators that are offered by Google and Microsoft and by others like afi.
• 10:43
  David: That's another way of having a second factor.
• 10:45
  David: You get a code and that's a safer way to do it.
• 10:46
  David: So that's one thing.
• 10:47
  David: Another is just on the passwords.
• 10:49
  David: You know, we mentioned before the good example of why not to use the same passwords.
• 10:53
  David: It's hard not to, right?
• 10:54
  David: Because you'd have to write them down.
• 10:55
  David: They're all different.
• 10:56
  David: You're gonna lose them all the time.
• 10:58
  David: Password manager, if you use the right one.
• 11:01
  David: Uh, they can help you to have unique passwords that are long and and complicated, and you should actually have long and complicated passwords if you're using passwords.
• 11:08
  David: Uh, If you're using passwords at all, because, uh, even if they're encrypted, they're pretty easy to crack with the modern, uh, computing.
• 11:16
  David: And then the other thing is don't ignore security warnings.
• 11:18
  David: If you get, uh, an email that says, Hey, somebody tried to log in, go back and uh, and actually don't just delete that.
• 11:25
  David: Go and check it out and do what they do what they say and, uh, change your password there.
• 11:28
  David: So that's what you can do as an an individual.
• 11:30
  John: I wanna, I wanna.
• 11:31
  John: Play that back to you, David, because for me the two factors very helpful because what that that says is that a person could be entering, trying to get access to your information through a.
• 11:42
  John: One digital means typically a computer or an iPad, um, or a, a phone.
• 11:47
  John: And the two factor just simply means they, they send the, the, the p the, the, the group or the institution that's being, that says is, is asked to share your information with the password, then needs to verify you through an iden, through a, a tech, through some form of technology.
• 12:06
  John: Typically, your cell phone.
• 12:08
  John: That identifies you as you by sending a unique code to that phone.
• 12:13
  John: And once it's set up, it's actually pretty straightforward.
• 12:16
  John: I've always been a little bit skeptical of the password managers, but as all of us have more and more passwords and, um, I think it's a really interesting idea.
• 12:25
  John: Um, and then the, the, the, the, the other thing I'd add is definitely pay attention to the security warnings of your bank or your health plan.
• 12:34
  John: Or any institution saying, Hey, this, this is a, this notifying you and making sure that when it notifies you, it really was you or an unauthorized user.
• 12:44
  John: And the fourth thing I'd say is you gotta keep updating whenever there's a patch or an update to an operating system.
• 12:51
  John: It's not typically the operating system that's being updated.
• 12:53
  John: It's a security patch.
• 12:55
  John: And don't, please don't get behind on that.
• 12:58
  John: All of that starts to help the individual get defense in depth.
• 13:02
  John: And why that's important is because hackers are lazy.
• 13:06
  John: While they're technically very sophisticated, you know, it's a, it's a mass versus target typical attack, which is to say the more data they have, the better.
• 13:14
  John: If you make it just a little bit harder each step of the way for hackers to access your personal data, it's gonna be much better protected, and they are going to vacuum up the information from others and then use that and sell that.
• 13:27
  David: So, John, let me, uh, at the risk of being too technical on this podcast, let me explain why that, uh, the importance of doing the patch and then I'll end with, uh, what companies should be doing.
• 13:36
  David: So when you have a patch that's a security issue, and let's say you make the patch and now it's, now it's patched, I.
• 13:43
  David: Um, what a hacker can do, even an un relatively unsophisticated one, is they can compare the patched version with the unpatched version, and the delta between those actually shows you where the vulnerability is, right?
• 13:52
  David: Because it's what's different between one version and another that just changes the security.
• 13:56
  David: Then you can see where the vulnerability is, and you can exploit that on one that's not patched.
• 13:59
  David: So please patch.
• 14:01
  David: Now, from the company standpoint, John, one thing is that it's kind of axiomatic that if the data's not there, it can't be breached, right?
• 14:08
  David: Mm-hmm.
• 14:09
  David: So all the time in healthcare we have.
• 14:11
  David: Providers, we have payers that ask for information that they don't need.
• 14:15
  David: Social security number, the second email address, uh, you know, all sorts of details that really are, are not helpful for them, but could be useful for, for a hacker, right?
• 14:25
  David: Because it's all, it's all sitting there, all the stuff that you need in order to do, do your second factor authentication, all that.
• 14:30
  David: So don't keep, don't gather that information.
• 14:32
  David: And then if you need it for a certain amount of time, you know, then get rid of it.
• 14:36
  David: It's interesting.
• 14:36
  David: This is actually the philosophy behind.
• 14:39
  David: Uh, like in Europe in particular, but also some in American states now, data privacy rules.
• 14:43
  David: So GDPR in Europe and there's five states in the US that have data privacy.
• 14:48
  David: Gdpr.
• 14:49
  John: Gdpr, is that the Germans, uh, security state kind of thing.
• 14:53
  John: What is, what is
• 14:53
  David: gdpr?
• 14:55
  David: It's the, uh, general data protection, uh, requirements that they have in, in Europe.
• 15:00
  David: And, and it basically, what does that mean?
• 15:02
  David: So there's a lot of different elements in it.
• 15:03
  David: The one that is the most known is sort of the right to be forgotten.
• 15:06
  David: Which means you've got data there.
• 15:08
  David: You say, I don't want anymore you trying to get me forever.
• 15:11
  David: Well, John, that's not your right.
• 15:12
  David: It's my pleasure to forget you.
• 15:13
  David: But the, uh, no, the, um, but for example, you know, rather than saying, Hey, I can collect all this information from the consumer wor while they're in the store.
• 15:22
  David: Maybe it'll be useful for marketing or something later.
• 15:24
  David: No, you, you collect a minimum amount of information that's required.
• 15:27
  David: That's what the organization, so
• 15:29
  John: the eu, the eu, the European Union has been much more aggressive.
• 15:33
  John: About protecting information in information is in many way the new oil of, of the, of the, of a data-driven economy.
• 15:42
  John: Data drives it and data is the new oil.
• 15:45
  John: The most valuable data to illegal for illegal use and potential dangerous use is healthcare data.
• 15:51
  John: But the.
• 15:54
  John: Europeans have been much more aggressive about articulating what the rights of individuals are regarding your personal data, which, you know, Google and Facebook and every mo many other internet retailers have decided should be free.
• 16:09
  John: And then they use, then they sell your data.
• 16:12
  John: And then leverage your data to actually sell you more stuff and, and charge for it.
• 16:16
  John: Um, that's created a free access to data.
• 16:19
  John: And so what I think David, you're talking about is let's at least limit.
• 16:25
  John: The stuff, the data we share with anyone, a retailer or a healthcare provider, so that we shrink if, if you have effectively our data footprint, we still have to protect ourselves because you have to share your healthcare data with your healthcare provider.
• 16:39
  John: But in general, the European Union has been much clearer about the fact that in addition to you owning your data, creating some protections around it, and that's what the G P D R, gdpr, whatever, whatever you're saying is gik.
• 16:55
  David: Yeah.
• 16:56
  David: Well, good, John.
• 16:56
  David: Well, that's it for yet another episode of CareTalk.
• 16:59
  David: We've been talking today about data breaches and what you can do about it as an individual and what the organizations should do as well.
• 17:06
  David: I'm David Williams, president of Health Business Group, and
• 17:09
  John: I'm John Driscoll, the president of Walgreens Health if you like what you heard or you didn't, please subscribe on your favorite service and remember to protect your data as best you can.