Healthcare

Safeguard PHI. Stop Ransomware. Educate in Real-time.

Safeguard PHI. Stop Ransomware. Educate in Real-time.

LEARN MORE

Why Threat Aware Data Protection for Healthcare

As the demand for patient data grows, so does the need for data security. According to PwC’s recent information security survey, the largest healthcare breaches in history were reported over the past year. This has lead payers and providers to rank data loss prevention their top security challenge. All healthcare organizations must comply with the stringent regulatory requirements of HIPAA and HITECH to safeguard patients’ Protected Health Information (PHI), Personally Identifiable Information (PII). Complicating these compliance efforts is the growing trend of migrating patient data to cloud storage and hosted applications such as Health Information Exchange systems. The cloud lowers costs and improves efficiency, but widens the attack surface for data breaches.

Key Challenges

Healthcare payers and providers must protect their data from a range of threats:

Insider Threats

Current or former employees, either by malice or mistake, can leak PHI to egress channels such as email, media, mobile devices, and cloud storage. 55% of all attacks originate with insiders, many of whom fall victim to email phishing attacks.

Ransomware

Attackers hold patient data hostage, forcing suspension of critical services and impeding communications until payment is extorted. This epidemic has hit hospitals particularly hard, and grew to 4,000 attacks per day in Q1 2016.

Third Party Infiltration

Cyber criminals compromise trusted partner providers, maintenance contractors and clients who lack adequate security controls -- gaining backdoor access to sensitive health data. Such attacks increased 56% in a single year.



How Digital Guardian Can Help

1

UNDERSTAND: WHAT DATA TO PROTECT

Digital Guardian with its deepest visibility into data, user and system events, can identify and tag sensitive data in real-time even before you develop formal policies. We accurately identify PHI using our Database Record Matching fingerprinting technology.

2

UNDERSTAND: WHEN DATA IS AT RISK

The Digital Guardian platform harnesses our deep visibility and real-time analytics to discover, monitor and control structured data such as PHI and PII as effectively as unstructured data such as clinical research data. Our solution monitors enterprise data wherever it lives and wherever it is shared – across networks, storage, endpoints, or in the cloud – performing equally across Windows, Apple or Linux platforms.

3

ENFORCE AND EDUCATE: FLEXIBLE & AUTOMATED CONTROLS

Our behavior-based rules automatically prompt users to prevent actions that violate policies and put data at risk. Users are educated in real-time with positive reinforcement on the appropriate handling of regulated data via display prompts that request justification. Illegal downloads or exfiltration can be blocked or contained before the data is gone.



DIGITAL GUARDIAN PROTECTS BOTH STRUCTURED AND UNSTRUCTURED SENSITIVE DATA

Hospitals

• Personal Health Information (PHI)

• Patient Financial Information

Healthcare IT

• Patient care data

• Personal Health Information (PHI)

• Personally Identifiable Information (PII)

Healthcare Analytics

• Claims & cost data

• Unstructured data such as R&D data, clinical data, patient behavior & sentiment data

Benefits Management & Insurance

• Personal Health Information (PHI)

• Claims data

• Patient Care Data



Purpose-Built For Healthcare Systems

FULL INTEGRATION WITH LEADING EHRs

Our solution accurately detects sensitive data by utilizing multiple sophisticated yet powerful content detection techniques. Content detection is based on actual patient data residing in your EHR system. Digital Guardian for healthcare is integrated and tested with the leading providers.




Case Studies

Securing PHI in the Cloud for Online Collaboration

Situation: A world-renowned hospital system wanted to use the cloud to quickly and easily – but securely – share PHI across its worldwide network.
Solution: They selected Digital Guardian for Cloud Data Protection and Box. Because Digital Guardian integrates directly with the Box API, the hospital could extend their DLP policies to the cloud in a way that was completely transparent to their care providers. No end-user training was required. No need for the care providers to log into a Cloud Access Security Broker. The healthcare institution’s multiple campuses, external care providers, research personnel and patients can now securely collaborate for patient care. Meanwhile, Cloud DLP ensures that PHI can’t be shared in any manner contrary to institutional policies.
Results: The hospital’s mandate for secure, compliant cloud sharing has been achieved. PHI is protected and not inappropriately shared. The solution improves collaborative workflow within the institution and beyond - from research to patient care delivery. The institution has adopted cloud storage without giving up visibility and regulatory control.



Plugging Data Leaks to Ensure HIPAA Compliance

Situation: The CIO of St. Charles Health System (SCHS) of Oregon ordered his IT department to complete a baseline security risk assessment. Digital Guardian’s appliance was run in passive mode to monitor network transmissions for sensitive data. They discovered that sensitive data was being transferred over unsecured channels such as email, leaving open a number of loopholes for PHI to be stolen.
Solution: SCHS decided to implement Digital Guardian’s compliance solution for on-going data discovery, monitoring and blocking. The appliances arrived preloaded with a wide range of HIPAA code set and healthcare EDI protocol identifiers, as well as preconfigured policies. The solution provides DLP protection for all SCHS facilities across 3 hospitals, 20 clinics and nearly 3,000 caregivers.
Results: Although SCHS already had policies in place regarding the handling of sensitive data, only after implementing Digital Guardian did they gain the ability to effectively enforce these regulations. Physicians, employees and partner providers are now educated about risky behaviors.



Protecting a Nationally Recognized Hospital from Ransomware

Situation: In July 2016, the U.S. Department of Health and Human Services issued its “Ransomware and HIPAA guideline” which categorized ransomware attacks as a data breach of the Health Insurance Portability and Accountability Act (HIPAA). Penalties for HIPAA violations can total up to $1.5 million per year, depending on the severity of the attack. This nationally recognized children’s hospital needed a security solution to protect it from ransomware to be HIPAA complaint.
Solution: The hospital selected Digital Guardian to deliver a combination of compliance and advanced threat protection (ATP) at all endpoints. ATP uses a combination of threat intelligence and behavior-based detection to stop ransomware. Our solution provides the deepest visibility into infection sequence and detects behaviors indicative of ransomware, stopping it before it can cripple operations.
Results: The hospital enjoys deep visibility into data movement across the network and all endpoints, along with insight into both insider and outsider threats, safeguarding PHI from leaving the organization.

Meeting Stringent HIPAA Regulations

Get this guide to learn how an appropriate DLP solutions can help you avoid hefty HIPAA violation fines.

Download Now

How a Renowned Healthcare Institution Protects Patient Data in the Cloud

Read this case study of a leading healthcare institution that implemented secure cloud storage to dramatically improve the sharing of patient information while remaining HIPAA compliant. 

Read how they did it 

Free Trial 2017 Gartner DLP MQ Contact Us