HIPAA Compliance for Medical Practices
83.7K views | +20 today
Follow
HIPAA Compliance for Medical Practices
HIPAA Compliance and HIPAA Risk management Articles, Tips and Updates for Medical Practices and Physicians
Your new post is loading...
Your new post is loading...
Scoop.it!

Cyber-Insurance: How Much Is Enough?

Cyber-Insurance: How Much Is Enough? | HIPAA Compliance for Medical Practices | Scoop.it

Mega-breaches, including the recent hacking attack on Anthem Inc., always result in an uptick of interest in cyber-insurance; but determining how much coverage to buy is an ongoing challenge, says data privacy attorney Marc Voses.

"Every single industry after an event like this sees an uptick in the interest in purchasing cyber- insurance," says Voses, a partner at law firm Kaufman Dolowich & Voluck, LLP. "Over the years since cyber-insurance has been made available, the limits [for dollar value of coverage] ... are increasing at an exponential rate."


After the Target data breach, "the retail industry went streaming into the brokers wanting to find out more about the products and shift more risk onto the insurance carriers in the event of a data breach," Voses says.

Organizations considering cyber-insurance need to ponder how much is enough to offset the potential costs involved not only with breach response expenses, such as notification, but also potential lawsuits and government fines, he says in an interview with Information Security Media Group.

In the aftermath of the Anthem incident, several class action lawsuits already have been filed, including a suit seeking $5 billion that was filed in California just one day after Anthem announced the breach, he notes.

For Home Depot, breach-related expenses are estimated at about $70 million so far, while the company reportedly had cyber-insurance coverage for $100 million, Voses says. In the Target breach, expenses are estimated at about $150 million, which apparently exceeds the company's cyber-insurance coverage, which was reportedly only $40 million, he notes.

In this interview, Voses also discusses:

  • Possible regulatory investigations and other government actions that might result from the Anthem breach;
  • What the HIPAA security rule says about the use of data encryption to prevent breaches;
  • The key privacy and other lessons that are emerging from the Anthem breach so far.

Voses is a partner at the New York City office of national law firm Kaufman Dolowich & Voluck, representing domestic and international insurers and reinsurers, and their insureds, in coverage and liability disputes. He is a litigator who has been called upon to address complex coverage and liability issues involving cyber, data and privacy exposures, management and professional liabilities, environmental liabilities and commercial general liability matters.


No comment yet.
Scoop.it!

Is healthcare prepared for data-sharing's security risks?

Is healthcare prepared for data-sharing's security risks? | HIPAA Compliance for Medical Practices | Scoop.it

The data-sharing requirements for the Meaningful Use program and the Affordable Care Act pose significant security challenges to healthcare organizations, and Erik Devine, chief security officer at Riverside Medical Center, predicts organizations will learn this year just how prepared they are.

In an interview with HealthcareInfoSecurity, Devine says his 370-bed hospital in Kankakee, Illinois, will focus on employee training, making sure systems are patched and third-party review--"making sure we're doing what our policies say we're doing."

He foresees more persistent threats in 2015, such as the Sony hack and other breaches seen last year.

"I think healthcare is going to see a lot of attacks in ransomware," Devine says. "Employees leaking data unknowingly is a big threat to healthcare systems. Hackers are going to take advantage of that and look for the monetary value in return."

Health information exchanges will pose particular challenges, he adds.

"Are we prepared to manage all the information that's flowing in and out of the system? ... Trying to get information for the patient out there in the real world so they have better experiences at any hospital they visit will obviously will carry significant risks. Is healthcare ready for that change? That's what we're going to determine in 2015 and further."

In its 2015 Data Breach Industry Forecast, Experian called healthcare "a vulnerable and attractive target for cybercriminals." However, it noted that employees remain the leading cause of compromises, but receive the least attention from their employers.

Security experts foresee phishing and ransomware attacks posing particular challenges to healthcare organizations in the coming year.

To help protect against threats like those, the healthcare industry should make use of cyberthreat intelligence, according to Jeff Bell, HIMSS privacy and security committee chair.

Entities such as the U.S. Computer Emergency Readiness Team, the U.S. Department of Homeland Security National Cybersecurity and Communications Integration Center and the National Cyber-Forensics & Training Alliance provide information on threats, malware and vulnerabilities that organizations can use to increase their security systems, Bell says. Vendors of security products also often have their own intelligence feeds.

No comment yet.