Healthcare data is vulnerable on more fronts than we ever thought. Take Molina Health's incredibly inconvenient discovery that their patient portal was exposing millions of records to breach risk.
In mid-2017, Molina began investigating weaknesses in its portal that exposed sensitive information and allowed unauthorized individuals to access medical claims without authentication. That little hole in their portal exposed data including names, addresses, dates of birth, medication, and medical procedure codes. Essentially, anyone who had a link to a medical claim could fiddle with the URL and get access to other medical claims easily.
Molina did shut down their portal until the issue was resolved, but there's a broader lesson here: Never underestimate the creativity of hackers. Vulnerability comes in many forms, and your content management system isn't exempt.
Content management systems and the healthcare threat landscape
Security is vital for most healthcare information systems, including your CMS, and the complexity of the environment itself breeds places for threat actors to exploit.
Mobile devices, printers, and even CT scanners and MRI machines can be points of vulnerability. The same is true for any device or system that accesses patient information, meaning that if your CMS allows patients to access records, submit personal information, or even just communicate with providers, it falls into the category of healthcare infrastructure technology that can be breached. That vulnerability not only costs the industry $6.2 billion each year, but also threatens the reputation of even the best providers and organizations.
While a CMS might not be a primary area of vulnerability in terms of theft, a weakly protected CMS can become a launching point for other attacks such as social engineering or outright theft of user credentials. It is common for security departments to be laser focused on internal assets containing PHI. But there a common strategy is to attack a weaker system to gain access to a stronger one. This happened in the now infamous breach of an air conditioning system which lead to the target credit card breach.
What's so concerning is that these attacks often go undetected, allowing for a compromised CMS to function for months while a malicious person calculates his or her next move.
Another growing style of attack is the DDoS (distributed denial of service) attack, which is increasingly used as a smokescreen or distraction for a ransomware attack. Aside from temporarily crippling your website, DDoS attacks leave vulnerabilities so hackers can slip past firewalls and other security infrastructure. An ideal CMS solution will scale to prevent these type of attacks, making your data more secure.
Why security matters for your CMS
Your current CMS likely isn't meeting the demands for a digital consumer experience, and you're probably looking for a new solution that offers new levels of personalization, diverse content, and a seamless consumer experience. Those features though, could also open the door to security concerns because of PHI stored on the web and the question of access restrictions.
This concern isn't exactly new. Whatever CMS you're considering for the future and even one you might be using now, it probably stores more sophisticated content than just images, text, and video. In healthcare, that means you're likely functioning in a HIPAA-compliant environment that requires encryption.
Choosing a CMS for healthcare means that you're going to need to understand which exactly hold up to HIPAA compliance standards. Patient privacy is an utmost concern and you should choose a system with strong security precautions such as encryption at rest and in transit, strong authentication and authorization rules, and auditing of any actions related to PHI. We would also recommend a vendor who complies with the administrative and physical controls in the HIPAA security rule.
Building security into your purchasing decisions
Make no mistake, choosing a CMS is a major purchasing decision meaning your evaluation process should start with some fundamental, security-oriented questions.
- How will updates be handled? Do you know who in your organization is in charge of CMS and security updates? Is the vendor providing them? How will they be tested?
- What security features are included, or what third-party applications will we need to run?
- How will upgrades be handled? Will our vendor supply them? Will someone on our marketing or IT team need to be responsible?
- How and where is data stored? Will it be in line with not only HIPAA standards but also our own internal requirements? How will we handle protected vs. non-protected health information
- How and when will we conduct penetration testing?
- How will you be notified of potential incidents?
Ultimately, a broader digital consumer experience isn't just about offering your patients and users more options. It comes down to providing them with a safe, fluid experience that enhances their care and cements you as trusted partner in achieving their healthcare goals.
Want to learn more about evaluating vendors for their security framework? Read our post on 3 Security Questions to Ask Your Website Vendor.