eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
From monitoring access to weapons of mass destruction to safeguarding medical data, Mac McMillan has done it all as far as security is concerned.
A former director of security at two Defense Department agencies in charge of overseeing inspection of WMDs, McMillan was also an intelligence officer who oversaw the implementation of international arms control agreements between the United States and other countries. In addition, he led programs to provide humanitarian aid to suffering nations of the former Soviet Union, including Azerbaijan and Turkmenistan.
McMillan is currently CEO of CynergisTek, a health care security firm founded in 2003, and chairman of the Privacy and Steering Committee for HIMSS (Health Care Information and Management Systems Society), where he educates companies on data breaches and provides recommendations to the government on how to deal with them.
Recently eWEEK spoke with McMillan to get his take on what causes data breaches and how health care companies can better secure their data.
eWEEK: What trends are you seeing as far as medical identity theft?
McMillan: Probably the main trend in medical identity theft is still fraud as it relates to people getting access to someone else’s medical information to put in a false claim and defraud the system. That is still probably the largest or biggest type of event that you see in medical identity theft. When you look at that, unfortunately the bulk of it is done by insiders.
Fraud is the No. 1 reason, and insiders are the No. 1 cause. People who have legitimate access to information who then do something wrong with that knowledge. Probably the No. 2 cause after insider abuse is physical theft or physical loss-stealing computers, stealing tapes, loss of tapes, loss of a laptop, etc. As long as information has value, as long as somebody thinks there’s a way to make money by misusing information, there’s going to be a risk to that.
Patient safety is probably the biggest risk associated with medical identity theft. And there are cases of medical identity theft where someone has used someone else’s information for the purpose of getting treatment. It’s still minor compared to the fraud side of it, but it’s a serious issue. Whether it is just the fraud aspect of it or more importantly the patient safety aspect.
eWEEK: How might a data breach such as that of Health Net have been prevented? How can health care companies avoid data breaches in the future?
McMillan: We have a tremendous amount of health information that is in unstructured files, Excel spreadsheets, Access databases, PowerPoint presentations, Word files, you name it, that live outside of those application databases that are resident on laptops, thumb drives and desktops.
So the first thing we need to do is manage our data better. We need to determine where that data needs to be and how it needs to be presented so that we can limit the amount of exposure we have and clean up some of this data that is spread all over the place that maybe shouldn’t be in a lot of the places it is.
Second, we need to become more information aware. What I mean is understanding what is going on in our environment. Most of our hospitals today are still not auditing or monitoring in a real-time fashion. It’s still very much reactive.
Thirdly, we need to do a better job of monitoring our controls. When you look at the Health Net case and you look at a lot of other cases that have occurred, in many cases they occurred because of a lack of control or a lax control. We need to do real-time monitoring of controls. HIPAA requires that you have automated time-outs set on all of your systems. So that when a system is inactive for some period of time or a user has not been in a file for some period of time, the system is supposed to automatically log them out. In many organizations, we’re not actively monitoring that control to make sure that nobody has disabled it.
No. 4 is we really need to step up education of our users and our patients. Organizations cannot afford to be responsible for everything. They need to educate their employees, their staff, their volunteers that are organizing their patient information and make sure they really understand what they’re supposed to be doing, what their responsibilities are and that they’re paying attention to what’s going on around them as well. Then educate our patients, because really patients are going to be your No. 1 method of identifying when something’s not right-in terms of identity theft, reviewing their credit report, reviewing their medical bill, reviewing their insurance claims, making sure what’s on those claims is really what happened to them while they’re in the hospital, questioning things that they don’t recognize because often that’s how we end up catching it.
eWEEK: How can health care companies keep patient information secure in the age of electronic health records?
McMillan: The first thing is obviously to acquire a certified EHR or EMR. The nice thing that the federal government has done for us today is that for an electronic health record system to be certified, it has to have basic security functionality. What that means is if I buy a certified EHR or EMR, I’m going to have the basic functionality in that application to implement or protect the data properly.
We need to quit buying systems that can’t protect the information. We need to buy systems that have that capability.
The next thing is you need to implement that functionality. I can’t tell you how many assessments we’ve performed in health care where somebody has had an application, or even an EHR with all the functionality, and still hasn’t implemented it.
Have somebody else look at your system that’s not involved in the day-to-day running of that system that will look at it with an objective third-party eye and validate it that it makes sense and identify the areas you need to mitigate.
Risk assessment is required under meaningful use, under HIPAA, yet we still have a lot of organizations that have not conducted a risk assessment or are still conducting what I would call less-than-adequate risk assessments-or doing them themselves. Even though that’s permitted, it is always best to have an independent tester to deal with security.
eWEEK: From a security perspective, what’s your take on the potential of EHRs and HIEs [health information exchanges]?
McMillan: If they’re done correctly and implemented properly, if the functionality is enabled, if the system is managed properly, they’ve got great potential to enhance or improve security-at least around the information contained in that EHR.
That still doesn’t answer the question of all the unstructured data (network and share files), that still needs to be addressed. But from an EHR perspective, organizations now have what they need to do a better job of managing privacy and security in that environment. The EHR environment that provides more awareness to both the patient and the provider equals better care.