- Cybersecurity continues to be major problem, with a quarter of healthcare organizations and a third of organizations across industries admitting they suffered a mobile-related compromise in the past year, up from 27% the year before, Verizon's Mobile Security Index 2019 report shows.
- Healthcare organizations were more likely than other businesses to have been notified of a breach by a customer or partner — 53% versus an average of 38% across all industries.
- Among all respondents, 83% said their organization was at risk of mobile threats and 29% described the risk as "significant." Two-thirds (67%) felt less confident about security of mobile devices than other types of devices.
With mobile devices becoming ubiquitous at all levels of healthcare and hospitals and practices considering how to regulate use of personal devices, cybersecurity is more important than ever.
A 2018 Spy Glass Consulting survey found nine in 10 hospitals are investing in smartphones and secure mobile communications to drive clinical transformation. In a 2017 Spõk survey, 71% of clinicians reported their hospital permits some type of bring-your-own-device use, up from 58% the previous year. In the same survey, 65% of doctors and 41% of nurses admitted they use personal devices despite explicit policy prohibiting such use.
But ensuring the security of personal health information and other data on mobile devices can be tricky, particularly if there is not a rigorous enterprise-wide governance program on their use.
Health records are a lucrative target for cybercriminals, and employee negligence is a key way records are compromised. According to a recent Bitglass report, healthcare organizations reported 290 breaches in 2018, down from 294 the prior year, but the number of records compromised ballooned from 4.7 million to 11.5 million. The leading cause was hacking and IT incidents at 45.9%, followed by unauthorized access and disclosure (35.9%), loss or theft (15.5%) and other incidents (2.8%).
The National Institute of Standards and Technology last year issued a “how-to" guide aimed at helping healthcare providers secure EHRs on mobile devices. The guide — which provides a simulated scenario with interactions among mobile devices and an EHR system that is supported by an organization's IT infrastructure — is meant to serve as a model for implementing standards and best practices for cybersecurity and HIPAA compliance.
Across all industries, 48% of Verizon respondents said their organization had sacrificed mobile security in the past year to "get the job done," up from 32% the prior 12 months. Of those, 46% experienced a compromise and 62% described the event as "major." Two-fifths (41%) said the repercussions were ongoing.
"Companies are increasingly reliant on mobility as the backbone of their business operations so there needs to be a priority on securing those devices," T.J. Fox, senior vice president and president of business markets at Verizon, said in a statement. "The applications on these devices now manage things like supply chain systems, point of sale systems, or customer facing apps. The lack of robust security measures could potentially expose corporate assets, and possibly customer data, to malicious actors."
Among respondents, 76% felt IoT devices pose the greatest cybersecurity threat. But loss and theft are also major risks. Fewer than a third (31%) of organizations reporting using whole disk encryption and about 5% of devices lack lock screen configurations.
Meanwhile, 81% of respondents overall and 80% of those responsible for securing mobile devices admitted using public Wi-Fi even when their organization prohibited it.
The European Union's adoption of strict data security rules in 2018 has help to prod some organizations to up their cybersecurity game. More than three-fourths (78%) of U.S. organizations surveyed said they had increased spend on IT security policies as a result of the General Data Protection Regulation.
At the same time, businesses need to do more. Roughly two-thirds (67%) of respondents said they are less confident about their mobile assets than other devices, and 21% felt strongly so.
Investment in cybersecurity is growing, though, with 64% of organizations reporting that spend increased in the past year and 69% predicting further rise in the year ahead. Just 24% expected no uptick in cybersecurity spending in the two-year period.