Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint //

Privacy

3/21/2019
10:30 AM
Connect Directly
Twitter
RSS
E-Mail vvv
100%
0%

What the Transition to Smart Cards Can Teach the US Healthcare Industry

Healthcare information security suffers from the inherent weakness of using passwords to guard information. Chip-based smart cards could change that.

Given the copious amounts of sensitive data coursing through the US healthcare system, strong information security remains a high-stakes requirement for all players in the industry. Among the most obvious problem areas, healthcare information security currently suffers from the inherent weakness of using passwords to guard information access. Passwords remain an easy attack vector because humans pick easy-to-remember — and therefore hackable — words or phrases.

However, hope is on the horizon. Technology vendors and organizations are collaborating toward making a password-less future. But meanwhile, industries that store and share personally identifiable information can activate multifactor authentication (MFA) to buttress password protection. Given the successful rollout of chip-based cards for US consumer payments in the past few years, this form factor might be the best candidate for implementing MFA in healthcare.

Chip-based "smart" cards have become ubiquitous in the US since the middle of 2015, when they were distributed by payments issuers to combat the spike in data breaches and the resulting credit card fraud. This transition has reduced fraud, proved the sector can self-regulate and adapt to new systems, and demonstrated that American consumers will incorporate this form factor into routine practice. With three years' evidence, it's time we apply the lessons learned from financial services' smart card implementation to secure access to medical records and other sensitive information of high interest to cybercriminals.

Reduce fraud: In the US healthcare sector, fraud, waste, and abuse are persistent problems. This begins with patient enrollment and continues with subsequent redundant information entry that is sometimes complicated by language barriers and improper patient identification. The adoption of a chip-based system for healthcare services provides an avenue to make things more efficient. For instance, a chip-based system would greatly improve the accuracy of data capture. In addition, the chip can ensure HIPAA compliance and increase the difficulty for medical identity theft to take place in a physical setting in which care is being provided. This will also lead to an accurate view of consumption.

Invite self-regulation: Financial services and healthcare are among the most regulated industries in the US, with a combination of governmental and self-regulating organizations (SROs). The Federal Financial Institutions Examination Council, the Federal Deposit Insurance Corporation, and the Consumer Financial Protection Bureau are examples of government regulators, while Financial Industry Regulatory Authority and the Payment Card Industry Security Standards Council are influential SROs. Healthcare, currently regulated primarily by government bodies, could accelerate stronger security practices by incorporating industry bodies that have a financial and ethical responsibility to protect access to sensitive information, including patient data, research results, and other proprietary information. Giving hospitals, insurance providers, and other medical players a stake in industry practices could speed implementation and result in a better outcome in the long run.

Change industry relationships: Like the tension between merchants and card providers in the payments industry, a similar tension exists in the US healthcare system. While employers and the government bear much of the costs, the actual "payment" is typically processed through insurance companies. Financial services implemented changes by reversing previous policies regarding how fraud liability was handled; under the new chip-card way of working, card issuers covered fraudulent charges in situations in which merchants had adopted point-of-sale technology that allowed chip-based cards to be used. Healthcare could similarly drive change by mandating providers integrate point-of-care terminals or otherwise looking for a parallel from the financial services industry. When insurers negotiate prices with healthcare providers, they could expedite payments for those using chip-based cards or add fees for those providers not implementing chip-based cards.

Change consumer habits: The way that hundreds of millions of US consumers relatively quickly adopted to the move to chip-based cards holds promise for the US healthcare industry. Moreover, many American consumers now understand that the chip provides a stronger level of both security and fraud prevention than previously existed. This prepares the way for the healthcare sector to adopt chip-based cards. As a way to implement stronger identity protection, portability, and tracking, the equivalent chip for our health data could become a reality via our insurance cards in a manner that moves patient data with greater veracity and velocity.

Chip-based cards hold the potential to solve many of the ongoing problems in the US healthcare sector, and consumers are already accustomed to using this technology as result of implementation in the payments industry. The time is right to bring smart chip cards into the healthcare security equation.

Related Content:

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Joram Borenstein, General Manager of Microsoft's Cybersecurity Solutions Group Joram Borenstein is the General Manager of Microsoft's Cybersecurity Solutions Group, holds CISSP and CISA certifications. He has been on the Advisory Board of numerous cybersecurity startups, ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Yenrab
50%
50%
Yenrab,
User Rank: Strategist
3/24/2019 | 9:12:13 AM
So NOW we think this is a good idea
If memory serves, was not Microsoft (not always security wizards) reccomending smart card usage back in 2000?  The Win2K training manuals for Server suggested using them that long ago.  Nice to see that their advice is finaly being heeded.
Why Cyber-Risk Is a C-Suite Issue
Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
Unreasonable Security Best Practices vs. Good Risk Management
Jack Freund, Director, Risk Science at RiskLens,  11/13/2019
6 Small-Business Password Managers
Curtis Franklin Jr., Senior Editor at Dark Reading,  11/8/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-11931
PUBLISHED: 2019-11-14
A stack-based buffer overflow could be triggered in WhatsApp by sending a specially crafted MP4 file to a WhatsApp user. The issue was present in parsing the elementary stream metadata of an MP4 file and could result in a DoS or RCE. This affects Android versions prior to 2.19.274, iOS versions prio...
CVE-2019-18980
PUBLISHED: 2019-11-14
On Signify Philips Taolight Smart Wi-Fi Wiz Connected LED Bulb 9290022656 devices, an unprotected API lets remote users control the bulb's operation. Anyone can turn the bulb on or off, or change its color or brightness remotely. There is no authentication or encryption to use the control API. The o...
CVE-2019-17391
PUBLISHED: 2019-11-14
An issue was discovered in the Espressif ESP32 mask ROM code 2016-06-08 0 through 2. Lack of anti-glitch mitigations in the first stage bootloader of the ESP32 chip allows an attacker (with physical access to the device) to read the contents of read-protected eFuses, such as flash encryption and sec...
CVE-2019-18651
PUBLISHED: 2019-11-14
A cross-site request forgery (CSRF) vulnerability in 3xLogic Infinias Access Control through 6.6.9586.0 allows remote attackers to execute malicious and unauthorized actions (e.g., delete application users) by sending a crafted HTML document to a user that the website trusts. The user needs to have ...
CVE-2019-18978
PUBLISHED: 2019-11-14
An issue was discovered in the rack-cors (aka Rack CORS Middleware) gem before 1.0.4 for Ruby. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format.