Finding PHI at rest or in movement is a need unmet. There are also limited ways to actively sense and continuously monitor hidden IT system vulnerabilities, such as unencrypted files, unauthorized permissions, unpatched devices, and unknown applications.

The HIPAA Security Rules suspension will soon be lifted. Given the breadth and depth of the requirements to better protect PHI, hospitals will be ill-prepared to protect PHI@Risk.

Healthcare has put in place a multitude of data security software tools and strategies, such as “defense in depth”, but they continue to fall short in addressing the unique and highly complex data privacy and security requirements within healthcare. Largely adopted from other industries, cybersecurity methods are focused primarily on identifying network devices, traffic, and defending against perimeter attacks – not managing PHI@Risk

The COVID-19 outbreak unleashed years of pent-up decentralized healthcare IT innovation and has forced the health care community to leap forward three to five years in the span of a few months. The pandemic created a new virtual, remote, and work from home care model, that puts PHI at even greater risk of being exposed, altered, or stolen.

Digital health IoT devices are now ubiquitous, and new kinds of Class II medical devices are entering the market relatively easily as “wellness” products. Without the conventional FDA regulatory approval or oversight required for “diagnostic” medical devices, more stringent safety and security standards are also compromised. This megatrend opens the door to increased PHI exposure and vulnerability, both across decentralized healthcare and within vendor managed private clouds.

The explosion of endpoints due to telehealth and M.D.’s working from home further compounds the problem of PHI@Risk. As one hospital CIO recently stated; “Ensuring that conversations with protected health information, especially diagnosis information, is contained to healthcare works in the home only, and not their relatives and friends, can be risky, especially during a video conference. Additionally, written and digital documentation in eyeshot of nonclinical individuals in a home is a huge risk.”