As a Privacy Officer with more than 30 years experience working in both large and small healthcare organizations, I’ve experienced multiple privacy postures, ranging from manual reactive audits to proactive privacy monitoring that allowed us to get ahead of breaches to patient privacy before they became catastrophic for the organization or patients. After three decades of experience, I realized that there are three things that every Privacy Officer should know to ensure they are applying best practices for privacy within their organization.

In 2015 and 2016, Protenus found that the privacy of professional athletes’ medical records was violated equal to or more than any other VIP or celebrity category. The majority of these privacy violators were repeat offenders. Why? In many cases, Protenus found that football enthusiasts were looking for a competitive edge in their fantasy league by looking at the athlete's records to identify injuries or other types of vulnerabilities.  

The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule made many sweeping changes to the healthcare world. One of the most significant was the requirement that all healthcare organizations – no matter their size – designate a privacy officer whose primary duty is to protect the confidentially and privacy of patients’ protected health information (PHI).

It is no secret that electronic health records (EHRs) are incredibly valuable. One needs to only look at the number of cyber attacks that target healthcare organizations as proof that those records contain extremely valuable patient information.

The healthcare industry is under siege.

Health data breaches of patient information have become all too common, with both external and insider threats trying to gain access to patients’ electronic health records (EHRs), and it does not appear that the number of attacks will ease up anytime soon. But this begs the question: Why are EHRs so vulnerable to attack? And why do criminals target them in the first place?