fraud – RISC Management and Consulting

The White House has been in the news over the past two weeks in reports from USA Today, CNN, NBC News, and many more sources. Officials informed NBC News (Mitchell, 2015 April) that it is believed the Russians accessed the system through State Department computers which contained private unpublished schedule of President Obama. While attribution usually takes weeks or months for the FBI’s Cyber Division to determine and publish, the sources of the attacks are less important than the objective. The objective is similar across all of these attacks; to retrieve classified information. According to former FBI official Shawn Henry and the president and CSO of CrowdStrike Services cyber-attacks occur because countries such as China and Russia have the need to look at U.S. polices, how policies are created, new initiatives that are under consideration, basically anything that these foreign countries can get that will provide them with some advantage at the next level of trade talks and collect intelligence against the US for personal gains.

Healthcare organizations need to understand the criticality, reasoning, and determination for these attacks as well. When VIPs such as political or military leaders are seen or treated by their facility, or by a facility they are affiliated or networked with, their systems, networks, and data become a high priority target for foreign threat actors. Healthcare organizations often fail to realize how important their health information data repositories are for reasons entirely Unrelated to identity theft or medical billing fraud. Basic healthcare information about a head of state, a state department official involved in a negotiations process, senior leadership in the military or a congressional committee is incredibly important to both Nation-State actors and Terrorist organizations. Healthcare providers have no idea that cyber-bullets are flying by their ears in this electronic war!

On April 1^st, 2015, President Barack Obama sent out an Executive Order titled “Blocking the Property of Certain Persons Engaging in Significant Malicious Cyber-Enabled activities”. Here’s a short excerpt from the Executive Order:

Only a few months ago on January 13th, President Obama announced a legislative National Data Breach Notification standard and miscellaneous cybersecurity legislative proposals and efforts. The Executive Order should provide the U.S. government the tools needed to combat the expanding malicious cyber activities. The Executive Order enables the Treasury Department along with the Attorney General and the Secretary of State to impose sanctions on the unlawful actions created by hackers. The goal would be to freeze targets’ assets when operating in the U.S. financial system and prohibiting them from having transaction with American companies.

Both Public and Government sectors must pay immediate and substantial attention to this existing and evolving threat!

References

Henry.S. (2014, November 17). Cyber attacks hit State department email, web. Retrieved from http://www.cnn.com/videos/bestoftv/2014/11/17/lead-intv-henry-state-department-hacking.cnn

Hollywood Reporter. (2015, April 1). Obama creates federal sanctions to deal with cyber attacks. Retrieved from https://www.youtube.com/watch?v=dNFdUphnU18

Mitchell, A.(2015, April). Russia hacked White House last year, U.S. officials says. Retrieved from http://www.nbcnews.com/news/us-news/russia-hacked-white-house-last-year-u-s-officials-say-n337521

Whitehouse.gov. (2015, April 1). The White House: Executive order. Retrieved from https://www.whitehouse.gov/the-press-office/2015/04/01/executive-order-blocking-property-certain-persons-engaging-significant-m

Medical identity theft is the act of using someone else’s identity to obtain medical services, prescription medications and/or goods. This theft often includes fraudulent billing.

A Medical Record is a perpetual record that contains identifiable medical information, and is intended for use in decision making relevant to a patient’s health coverage, diagnosis and treatment. It contains a written account of a patient’s examination and treatment with medical history, patient complaints, physician’s findings, lab results, procedure results, medications, and other therapeutic measures. When stored on an information system it is often referred to as an Electronic Medical Record (EMR) or Electronic Health Record (EHR).

According to a research sponsored by the Medical Identity Fraud Alliance (MIFA), the increasing costs of resolving the problem of medical fraud influenced the Affordable Care Act to address medical identity theft. “Sixty-five percent of medical identity theft victims in our study had to pay an average of $13,500 to resolve the crime” and “victims learn about the theft of their credentials more than three months following the crime and 30 percent do not know when they became a victim” according to the Fifth Annual Study on Medical Identity Theft. In addition, only 3 percent of an average healthcare organization’s IT budget were being used for data protection.

Percent IT budget

One of the most striking results from the research was the answers to the following questions:

How did the medical identity theft happen? The number of people increased from 4 percent from 2012 to 12 percent in 2014 who provided their personal information to a fake email or spoofed website. With the amount of information online and in the news on how to prevent identity theft, it is still surprising that we as a society are not changing the culture by building awareness within your organization from policies/procedures to education.
How did the medical identity theft happen? Healthcare provider or insurer-experienced a data breach increased from 6 percent in 2012 to 10 percent in 2014. It is RISC’s position that this is probably due to increased awareness, however, thereby an increased number of complaints filed. Greater deployment of security technologies, and increased security training quite often result in statistical jumps like these as more events are recognized, not necessarily occurring.
How did the medical identity theft incident affect your reputation? 89 percent said that embarrassment due to disclosure of sensitive personal health condition affected them while loss of career opportunities was identified by a surprising 19 percent.
How did you resolve the medical identity theft? In 2012, a shocking 45 percent reported to paying the healthcare provider for services that the thief incurred. Last year, only 24 percent of those who experienced medical identity theft carefully reviewed their credit reports and only 15 percent said their contacted the credit bureaus to fix errors in their credit report.

A good example of dealing with medical identity theft begins from page five of an article from the Attorney General Kamala D. Harris of California which mentions prevention, detection and mitigation (California Department of Justice, 2013 October).

If you find your organization has experienced a security incident or suspects a data breach, know that there is help available. If you are a consumer who suspects medical identity theft, there is a great deal of help available to you. As taxpayers, we should all be concerned about this issue even if we do not personally experience it at work or as healthcare consumers!

RISC and VA in HIMSS15

References

California Dep. Of Justice. (2013, October). Medical identity theft: Recommendations for the age of electronic medical records. Retrieved from http://medidfraud.org/wp-content/uploads/2014/07/Medical-ID-Theft-Recommendations-FINAL.pdf

Fifth Annual Study on Medical Identity Theft. (2015, February). Retrieved from http://medidfraud.org/wp-content/uploads/2015/02/2014_Medical_ID_Theft_Study1.pdf