Safety in Digital Healthcare: Kumar KV, Narayana Health’s 5 Tips to Prepare on Information Security

How important is water to life? This is how we can understand the importance of safety in digital healthcare. However, all is not hunky dory in achieving information security measures in place.

Assessing the importance and giving a clear picture of the entire scenario, Kumar KV, the group CIO of Narayana Health, said, "We are the guardians of data. This means that appropriate cybersecurity measures and privacy measures should be baked in at each and every stage of the process."

With an audience keenly aware of the ever-evolving digital landscape, Kumar KV recently delivered a compelling presentation on the critical role of information security in healthcare.

Kumar's insights at the recent DHN Forum in Mumbai, held on May 31, 2024, were timely and necessary. They highlighted the challenges and imperatives of safeguarding sensitive health data in an increasingly connected world.

The Imperative of Zero Error Tolerance in Healthcare

Kumar KV began his address by underscoring the unique pressures faced by healthcare providers. "We are in the business of saving lives, we are in life critical operations," he stated.

"It is very essential to ensure that there is no sort of breakdown when it comes to clinical operations. The margin of error is not even there; we cannot even have less than 1% also. There is absolutely no margin of error."

This stringent requirement for precision sets the healthcare sector apart, necessitating robust information security measures to protect patient data and ensure operational continuity.

The Rise of Digital Health Technologies

Kumar highlighted the significant uptake of digital health technologies, particularly in the wake of the COVID-19 pandemic.

He emphasized that as more healthcare providers integrate these technologies, the importance of security and privacy becomes paramount.

"Healthcare providers have actually assembled multiple toys that are actually there and are trying to make them speak," he observed. "But have they done it right? Have they ensured that there is security and privacy by design?"

This question forms the crux of the challenge facing modern healthcare institutions as they navigate the complexities of digital transformation.

Providing a comprehensive overview of the healthcare technology landscape, Kumar described the myriad systems and stakeholders involved.

From health information management systems and patient apps to ERP platforms and clinical research teams, the ecosystem is vast and intricate.

"We deal with a ton of systems over here; everything plays a specific part in clinical operations," he explained. The critical nature of the data managed by these systems—from patient-identifiable information to sensitive health records—requires meticulous attention to cybersecurity and data protection protocols.

Data Collection & Sensitivity in Healthcare

Kumar delved into the specifics of data collection in healthcare, noting the numerous points at which data is gathered and processed—from registration and billing to clinical interactions and sample collection.

He emphasized the responsibility of healthcare providers to protect this data, which is classified under the Digital Data Protection Bill as critical information.

The Rising Threat of Cyber Incidents

Highlighting the increasing frequency and sophistication of cyberattacks, Kumar referenced the Verizon Data Breach Information Report to illustrate the growing number of incidents in healthcare.

From denial-of-service attacks to basic web application breaches, the sector faces a constant barrage of threats. "Hackers are getting sophisticated by the day,"

Kumar warned, noting that healthcare data is particularly valuable on the dark web, with records potentially worth up to $400 each. This high value underscores the need for rigorous cybersecurity practices to protect patient data from exploitation.

In healthcare, the integrity of data is paramount. "Preserving integrity is very vital," Kumar stressed, highlighting the need for accurate and reliable data to ensure quality patient care.

The confidentiality, integrity, and availability triad are a foundational principle in cybersecurity, and its application is particularly crucial in healthcare where data errors can have dire consequences.

Stakeholders & Security Responsibilities

Kumar elaborated on the diverse range of stakeholders involved in healthcare data management, from doctors and nurses to paramedics and administrative staff.

Each stakeholder requires tailored access to data, necessitating strict controls and segregation of duties. "Ensuring that the disclosure is there, there is segregation of duties present at each level so that the need-to-know basis is adhered to," he explained.

This approach helps minimize the risk of data breaches and ensures that sensitive information is only accessible to those who need it.

The Threat Landscape & the Role of Advanced Persistent Threats

The threat landscape in healthcare is further complicated by advanced persistent threats (APTs) and nation-state actors. Kumar described these threats as highly organized and sophisticated, often with clear objectives and nation-specific targets.

"There is a periodic table for advanced persistent threats," he noted, referring to groups like Lazarus and Stone Panda. These actors employ various tactics to infiltrate systems and extract valuable data, posing significant challenges for healthcare providers.

One of the most disruptive threats facing healthcare providers is ransomware, which can cripple hospital operations and endanger patient safety.

Kumar emphasized the importance of having a robust incident response plan (IRP) in place to quickly and effectively address such incidents. "The ability to bounce back at a shorter time is what healthcare providers should focus on," he advised.

This resilience is crucial for maintaining continuity of care and minimizing the impact of cyberattacks on patient services.

Best Practices for Information Security in Healthcare

Kumar provided several best practices for managing information security risks in healthcare:

1. Governance and Policy Development: Establishing comprehensive policies and procedures tailored to the organization's specific needs is essential. "Do not copy-paste policies," he cautioned, emphasizing the need for bespoke standards.

2. Risk Management: Identifying and managing both enterprise and information risks is crucial. Organizations should understand their risk appetite and develop strategies to mitigate, accept, avoid, or transfer risks.

3. Program Development: Allocating appropriate resources and budgets for security initiatives is vital. Kumar recommended an "Architecture-driven approach," ensuring that security measures are integrated into the system architecture from the outset.

4. Incident Response: Regularly conducting drills and stress assessments helps organizations prepare for potential cyber incidents. "Prepare for the worst," he urged, advocating for ongoing vigilance and readiness.

5. Security by Design: Embedding security considerations into the design phase of any new project or system is essential for building robust and resilient healthcare infrastructure. "Security and privacy by design right from the stage of feasibility," Kumar advised.

Conclusion

As rightly articulated by KV, matching the dynamic nature of the healthcare industry, there is a growing need for cybersecurity measures. By adopting a proactive and comprehensive approach to data protection, healthcare providers can safeguard patient information, ensure operational continuity, and ultimately enhance the quality of care.

"Stay safe, stay happy," Kumar concluded, reminding the audience of the importance of vigilance and preparedness in the face of evolving cyber threats.