admin

A recent report found breaches caused by healthcare system misconfiguration due to human error in cloud infrastructures increased by 424%. The idea of security breaches often brings to mind malicious attackers hacking into computer systems. However, past major health sector breaches have shown vulnerabilities are more often than not the result of healthcare system misconfiguration.

While such breaches cause significant reputational damages, HIPAA fines can add insult to injury, with the healthcare sector average fine of $6.45 million, leading all other sectors. This creates the double-edged sword of needing to adequately secure protected health information while also maintaining HIPAA compliance and avoiding lawsuits from clients whose records have been breached.

By mid-2019, healthcare cybersecurity breaches had doubled those in the entirety of 2018. In January 2019, Immediata Health Group discovered it had inadvertently exposed the information of approximately 1.56 million patients because, as their incident report indicated, “a webpage setting…permitted search engines to index internal webpages that are used for business operations.”

In February, the University of Washington Medicine announced it had exposed the information of approximately one million patients because of the accidental removal of website server protections, again exposing files to indexing by search engines.

These are not isolated experiences, as a 2017 IBM security report noted that breaches caused by healthcare system misconfiguration due to human error in cloud infrastructures had increased by 424%. Additionally, Gartner analyst Neil MacDonald estimated that by 2020, “80% of cloud breaches will be due to customer misconfiguration, mismanaged credentials or insider theft, not cloud provider vulnerabilities.”

[…]