Emerging Cybersecurity Threats in Healthcare Insurance: What You Need to Know

Question: How do leading insurance companies adapt their risk management strategies to these emerging cyber threats?

Jeff Shipley: There’s more investment in developing robust cybersecurity programs around the end point in the network and encryption of data at rest and in transit.

Data used to live inside the four walls of your data center. Now it’s all over the world and a whole bunch of different data centers. So again, the threat landscape has expanded significantly over the last five to 10 years.

Part of having a sophisticated cybersecurity program is enhanced employee training and awareness and making that mandatory. Having more internal phishing tests makes sure employees understand cybersecurity, because the weakest link is the person on the other end of the keyboard. Security always starts and ends with people.

There’s also more focus on monitoring and control. Internal and external audits have ramped up, where you used to do them every two years. Now you’re doing them multiple times a year.

You’re still leveraging similar types of technology, protecting the data at rest, protecting it in transit, protecting the endpoints, doing your virus scans, those kinds of things. But the biggest change may be where accountability now lies.

It used to be someone in IT was accountable, and that was their challenge. Now that accountability rests solely on the CEO’s desk. It’s coming from top down, instead of bottom up.

Question: How is digital transformation shaping the future of insurance, and how does this change the cybersecurity landscape?

Jeff Shipley: Digital transformation takes many forms. The expectations of the end consumer have dramatically increased, which is impacting insurance companies.

Healthcare insurance companies are under a tremendous amount of pressure to behave like ecommerce. Digital transformation now needs to take place at the digital front door—in your data, analytics, and omnichannel strategy.

Often insurance companies rely on vendors to enable digital transformation—think of all the third-party platforms you use in your day-to-day job. You’re relying on them to make sure that the data and the applications they provide are secure. And if those applications are running in the cloud, ensuring that those cloud infrastructures are secure and locked down.

Some of the biggest breaches that we’ve seen over the last five years haven’t necessarily been the fault of the major companies that are spending millions of dollars on their security. What’s happening is they rely on third-party vendors, which are often smaller organizations, and these vendors are getting breached and then the bad actors are traversing through the network.

The hackers ultimately get to the big prize, which in healthcare insurance would be the big company with lots of personal health information (PHI) or personally identifiable information (PII).

Question: If you had one piece of advice for insurance companies on cybersecurity protection, what would it be?

Jeff Shipley: I would advise companies to give importance to cybersecurity in their budgets, educate their employees, involve the board in cybersecurity discussions, and invest in protection.

It’s very difficult to keep up with how quickly technology is changing right now, especially if you’re not in the business of technology. And a healthcare insurance company is in the business of providing insurance or providing care, not cybersecurity. While it’s crucial to ensure your team is informed about the latest threats, it’s equally imperative to collaborate with a dedicated cybersecurity firm. Such partners are in the best position to understand real-time threats as they emerge in the wild.

A breach can instantly erode trust, wiping out customer confidence in a brand, potentially forever. What follows often involves compliance and regulatory issues and fines. The lasting damage to your brand may be irreparable.

Looking to enhance your cybersecurity strategy and stay ahead of emerging threats? Protect yourself from the devastating effects of a data breach with our cybersecurity managed services.