Healthcare workers compromising patient's data during remote sessions

Almost a third of clinicians have had their patients' data compromised when conducting remote telehealth sessions.

This is according to new global research from Kaspersky that states 30% of healthcare providers have experienced cases where their employees compromised customers personal information during remote consultations.

In addition to this, almost half of providers believe that their clinicians don't clearly understand how patients' data is protected.

However, 67% of them believe it is important for the healthcare sector to collect even more personal information to further industry development, the report finds.

Data breaches do not always occur as a result of adversaries actions, the researchers state. Quite often, information can be compromised by internal actors.

Medical organisations gather, process, and share an abundance of sensitive data and therefore have to pay the utmost attention to the safety of information they receive.

In addition, Kaspersky's research shows that only 17% of healthcare providers are sure that most of their clinicians that conduct remote sessions have clear insight into how their patients data is protected.

This is despite the fact that 70% of medical organisations have dedicated IT security awareness training. These figures can be seen as a sign that the majority of cybersecurity educational practices implemented don't correspond to reality and fail to cover topics that would be most useful for physicians' daily practices.

More than half (54%) of respondents admit that some of their clinicians conduct remote sessions using apps not specifically designed for telehealth, such as FaceTime, Facebook Messenger, WhatsApp, Zoom, and others.

Using non-specialised apps in a healthcare setting comes with a risk, as Dr. Peter Zeggel, CEO of arztkonsultation.de, a German telehealth provider, points out.

He says, "Telehealth applications are specifically designed and certified to safeguard sensitive personal data. Bypassing this high level of protection means risking loss of trust, disciplinary measures and heavy fines.

"Those who fail to put the right tools in place, could also violate billing requirements for telehealth and miss out on purpose-built telehealth features, such as integrations for patient records or the safe sharing of live data from remote devices."

Kaspersky Academy head, Denis Barinov, says, "The more complex and critical technology is, the more awareness it requires from people who work with it.

"This is particularly important for the healthcare industry entering the new digital stage and increasingly facing issues connected to privacy and security.

"But it's not only about awareness - for any security training to be effective, it should not only deliver up-to-date information but also inspire and motivate people to behave safely in practice."

Kaspersky states, to minimise the risk of internally caused incidents and provide new perspectives for the industry, healthcare organisations should adjust their cybersecurity policy and make it relevant to today's needs.

This includes clear guidelines on using external services and resources, a thoughtful access policy for corporate assets, and a robust password policy. Of course, all of those measures must be implemented in practice and supplemented by comprehensive security training.