Blogs

In exploring the most common causes of electronic personal health information (ePHI) data breaches recently, it was interesting to find that recent research into this topic reveals that while we tend to primarily focus on technological approaches to security, human error can actually be one of the biggest threats to ePHI.

This 2021 research paper, Human factor, a critical weak point in the information security of an organization's Internet of things (Hughes-Lartey et al.), laid the groundwork for exploring the potential impacts of human interactions on data security. It points out that "the strength of any good information security system is in the hands of those who use it," highlighting that breaches often stem from exploiting human resources. However, organizations tend to prioritize technological solutions, as they are generally easier to implement than addressing the human element of security.

There are a lot of good specific recommendations in the paper worth checking out. The main takeaway was that "Organizations need to have a consistent policy that focuses on having their employees trained or educated."  

In a subsequent 2022 research paper, Human Factors in Electronic Health Records Cybersecurity Breach: An Exploratory Analysis (Yeo and Banfield), the authors categorize breaches as either "unintentional" or "malicious" to better understand the type of human interaction that leads to a breach (see Table 2 for data). Their research found that 73.1% of all affected records were compromised due to unintentional factors, while 26.7% resulted from malicious actions. 

Their research also identified the most common causes of cyber breaches in healthcare organizations (HCOs):

• Carelessness and negligence – 382 incidents
• Theft – 222 incidents
• Phishing scams – 221 incidents, accounting for 40.7% of all non-malicious breaches

Some additional articles on this topic that may be of interest are listed below: 

• Inadequate Employee Training:
  Ten examples of how inadequate employee training can lead to data breach of ePHI - Business Solutions | Higher Profits | Improved ROI
• Mobile Devices:
  Ten examples of how unsecured mobile devices can cause data breach of ePHI - Business Solutions | Higher Profits | Improved ROI
• The Rise of AI:
  Rising Cyber Threats and Human Factors Increasing Breach Risks for Midsize Companies | Pondurance

Works Cited:

1. Hughes-Lartey, Kwesi, et al. “Human Factor, a Critical Weak Point in the Information Security of an Organization’s Internet of Things.” Heliyon, vol. 7, no. 3, Mar. 2021, https://www.sciencedirect.com/science/article/pii/S2405844021006253.
2. Yeo, Liu Hua, and James Banfield. “Human Factors in Electronic Health Records Cybersecurity Breach: An Exploratory Analysis.” Perspectives in Health Information Management, vol. 19, no. 2, 15 Mar. 2022, p. 1i, https://pmc.ncbi.nlm.nih.gov/articles/PMC9123525/.