Brian Lapidus is a seasoned expert in security and risk mitigation who focuses on the increasing challenges faced by the public and private sectors in protecting sensitive data and personal information from loss, theft and fraud.
The chief architect of product development at Kroll’s Fraud Solutions group, Lapidus sets direction for the company’s continued success in identity theft discovery, investigation and restoration. Lapidus is particularly knowledgeable about the security gaps – physical, procedural and electronic – common to many U.S. companies and organizations, as well as the criminal landscape where stolen identities are bought, sold and used.
He is frequently quoted on the types of data breaches being experienced by thousands of organizations, and what steps can be taken to better protect confidential data and to recover should a data breach occur. He oversees a highly-skilled team that includes veteran licensed investigators who specialize in supporting breach victims and restoring individuals’ identities to pre-theft status.
The fact of the matter is that patients – and
the law – demand that healthcare companies protect highly sensitive information
from every possible threat. But in-house security options just can’t keep pace
with rapidly growing risks. After all, anti-virus software won’t stop someone
from taking medical records. A firewall can’t help retrieve a stolen
laptop. Below, I answer several questions that every healthcare
organization should know.
Q: Why are healthcare organizations particularly vulnerable to data breaches? A: There are several factors that make healthcare organizations particularly vulnerable to data breaches. Some of these factors include:
I. Sensitivity of data – The healthcare industry is responsible for maintaining its patients’ most sensitive Personal Health Information. PHI is a treasure-trove for identity thieves.
II. Immense Data flow (masses of data flowing in and out) – A primary reason healthcare data security breaches occur is because facilities do not know where all instances of their patients’ sensitive or confidential information resides within the network. Moreover, the danger does not stop at the hospital perimeter, but includes vendors that share or receive the data, as well as employees’ and contractors’ laptop computers and other portable storage devices.
III. Portability/Usage of EPHI (Electronic Protected Health Information) storage devices – Improvements in technology and the portability of patient data come at a cost to security. Devices used to store and access PHI include laptops; home-based personal computers; Personal Digital Assistants (PDAs) and Smart Phones; USB Flash Drives and Memory Cards; floppy disks; CDs; DVDs; backup media; Email; Smart cards; and Remote Access; not to mention hotel, library or other public workstations and Wireless Access Points (WAPs).