In light of the above, it is clear that the introduction of technology to the Nigerian health care sector, has greatly aided the sector’s growth by ensuring the ease of access to healthcare, lowering the cost of receiving healthcare and improving health care delivery services. However, this innovation is fraught with data security implications, as it has been statistically proven that as the use of broadband internet and mobile devices becomes ubiquitous, so also will the need to protect the data of the people who use it.
Data Security Implications Of Telemedicine
Telemedicine systems have become high-value targets for cyberattacks because they store a wealth of patients’ protected health information, and interface with a variety of networks and technologies, often with no centralized security policy or control.
According to reports in 2021, there are three major types of attacks against telemedicine systems:
- Compromise of Confidentiality:
Confidentiality refers to the protection of sensitive information from unauthorized access and misuse. As a result, healthcare patients expect and demand that healthcare providers protect their privacy.
Particularly, Rule 8 of the Rules of Professional Conduct for Medical and Dental Practitioners establishes the obligation of a health practitioner, to ensure the confidentiality of a patient’s personal health information, unless consent to release the information is provided by the patient, or on any other recognized legal basis. However, with Telemedicine, the concept of confidentiality is a little broader because it affects providers and claims processors as well as health practitioners.
Telemedicine is typically carried out over an electronic network, such as a website or a smartphone app. With the addition of features such as electronic health records and filing systems, as well as physician-patient virtual conversations, the need to double-protect patients’ health information from unauthorized third parties becomes critical, as there is a significant risk that such information will be attacked by threat vectors. The vectors worthy of discuss include:
This involves the use of emails, text messages and links to primarily trick a recipient into revealing sensitive information. Since many Telemedicine appointments begin with the patient clicking on a link or joining a call from an unverified source, it presents a new opportunity to take advantage of patients while they’re vulnerable.
When healthcare providers use common, unsecured video conferencing platforms to conduct appointments, there is no way for patients to verify their identity. Attackers, may use phishing messages to send patients legitimate-looking links to a fake appointment or web page, and convince them to divulge sensitive information.
Misconfiguration is an incorrect configuration of a system (Networks, and applications), that may lead to vulnerabilities.
A misconfiguration will occur on a Telemedicine platform if the setup pages are enabled, or a user utilizes default usernames and passwords, leading to a breach as the hacker can determine hidden flaws, and thus, access sensitive information. Misconfigured devices and apps present an easy entry point for an attacker to exploit.
In 2018, Hova Health, a Telemedicine company based in Mexico, reported the online exposure of the personal data of about 2,373,764 of its patients, after the misconfiguration of its MongoDB database. The database was publicly available and could be accessed or changed by anyone, even without a password. The database allegedly contained patient names, personal ID codes for Mexican citizens and residents, insurance policy numbers and expiration dates, dates of birth, and addresses. There also were flags noting migrant status or disabilities.
The above goes to show that Misconfiguration issues are far too common for the healthcare sector, which already is being walloped by cyberattacks. One wrong click and tens of thousands to millions of patient records can be breached.
Other threat vectors include; Credential harvesting, data exfiltration, emailing sensitive information to the wrong recipient, publishing private data to public web servers, and leaving confidential information displayed on an unattended computer monitor etcetera.
- Compromise of Integrity
The term “integrity” is the safeguarding of data against unauthorized modification. It refers to the assurance of data accuracy and completeness. Data that is stored on systems as well as data that is transmitted across systems, such as an email between the physicians and patients, must be protected.
A breach in the integrity of a patient’s data is said to have occurred where the initial data of a patient is accessed and altered, so that the patient’s information does not reflect the original position as given by the patient, and this may be due to the following factors: unintended transfer errors, compromised hardware, human error, etcetera.
In maintaining integrity, it is not only necessary to control access at the system level, but to further ensure that system users are only able to alter information that they are legitimately authorized to alter.
- Compromise of Availability
Availability guarantees that systems, applications and data are available to its owners when they need them. The most common attack that impacts availability is denial-of-service, in which the attacker interrupts access to information, system, devices or other network resources. A denial-of-service in an internal vehicular network could result in a server not being able to access the information needed to operate, and the server could become non-operational or even worse, bring the system to an unsafe state. An example is the ransomware attack.
To avoid availability problems, it is necessary to include redundancy paths and failover strategies in the design stage, as well as to include intrusion prevention systems that can monitor network traffic pattern, to determine if there is an anomaly and to block network traffic when needed.