I had an interesting conversation with a healthcare CISO at a recent event about what worries him the most. Even more than external malicious threats, he was most worried about employees abusing privileges and violating the trust they had been given by his organization. One of the most challenging aspects of information security is that the security perimeter keeps expanding, and now includes insider threats as well as external ones.

Recent healthcare breaches caused by insiders show that the CISO is justified in his concern. Last month, a former employee of a hospital was caught inappropriately accessing patient medical and financial records for nearly three and a half years causing a breach impacting nearly 700 records. Also last month, a different provider received a ransom demand made by an unknown party threatening to release protected health information unless payment was received. The ransom email contained evidence of PHI from the hospital. After an investigation by external forensic experts, an internal threat became suspected because it was determined that hospital servers had not been hacked and remain secure. Also recently, the FBI and the U.S. Department of Homeland Security (DHS) issued a warning about the increase in insider threats from disgruntled current and former employees.

These are all timely reminders about the serious risk from insider threats. External threats are already being addressed and generally understood today by security professionals, however, it’s the risk from internal threats that healthcare organizations may need to apply more focus.

The question then becomes how do you manage the trusted access you’ve already given to employees? Healthcare organizations can take control of the risk through a strong identity and access management (IAM) program. IAM is a solution that allows providers to give precise, role-based access to clinical applications that contain protected health information (PHI). That access can be granted or revoked in seconds, monitored, reported on and is easily available for audits. IAM is a fundamental component of a good security and HIPAA compliance program, which all healthcare organizations are required to have in place.

To learn more about how providers are effectively using IAM solutions, you can sign up to view the recording of a recent webinar we hosted with Duke University Health System who talked about how they evolved their use of IAM as their business needs evolved over time.