The HITRUST Cyber Discovery Study intends to find out more about the threat hackers pose to the healthcare industry and get some much needed answers to important healthcare cybersecurity questions.
The healthcare industry may appear to be under attack from hackers, but without an assessment of the cybersecurity threat to the healthcare industry it is not possible to determine how real the danger is.
HITRUST – The Health Information Trust Alliance – has announced that it will be conducting an in depth study into just that. It aims to assess the risks faced by the healthcare industry and will attempt to quantify the actual threat level to insurers and healthcare providers. Is it all scaremongering or is the threat highly serious and in need of urgent attention? The HITRUST Cyber Discovery Study will attempt to answer those questions.
Healthcare Cybersecurity Questions to be Answered
The cybersecurity threat to the healthcare industry has been widely reported as being at critical levels; however HITRUST felt it important to accurately assess whether the industry should be at DEFCON5 or whether the risk has been overinflated or misreported.
The HITRUST Cyber Discovery Study will look closely at the threat from hackers; very closely in fact. This is not a series of questions asked of HIPAA compliance officers and healthcare professionals. Healthcare providers and insurer’s networks will be monitored in real time with the intention of seeing hackers in action.
Dan Nutkis, CEO of HITRUST, explained how this will be achieved. The company will be using the Trend Micro™ Threat Discovery Appliance on all participants systems which will monitor intrusion attempts, phishing and other unknown methods being used by hackers to try to infiltrate the networks of healthcare providers.
He described the software as being “Like a big sandbox that works in a passive mode and collects everything and tries to analyze everything that comes into the sandbox,” The study will collect a great deal of highly valuable data and should help researchers shed light on the methods hackers are using to try to obtain PHI. The volume of attacks will be monitored together with the number of times individuals’ attempt to gain access to networks to find out how long hackers persevere and when they move on to find easier targets.
Volunteers Required for the HITRUST Cyber Discovery Study
In order to monitor for intrusion attempts, HITRUST needs volunteers. It is hoping to attract hundreds of healthcare providers to the study; from individual physicians to clinics, hospitals, insurers and healthcare clearinghouses. The more organizations in the sample, the more accurate the survey will be.
The initial target is to sign up a wide range of organizations and to build the sample size up to 210. It is hoped that this will be sufficient, initially at least, to satisfy some of the aims of the study.
There are benefits for healthcare organizations willing to take part in the HITRUST Cyber Discovery Study. Volunteers will receive training on how to conduct a forensic analysis of their own systems and they will be shown how to monitor cybersecurity threats using Trend Micro’s product. At the end of the 90 day monitoring period, the organization will have data that should allow them to form a highly accurate picture of the threats they face. That information can then be used to develop an appropriate cybersecurity strategy.
However, in order to have security software installed on networks, healthcare organizations must be 100% sure that the data being recorded will be protected and that HIPAA Rules are not being violated. HITRUST has announced that it will be de-identifying all data so that participants can supply security information for the study without being identifiable from that data. The study ensures anonymity.