What the Transition to Smart Cards Can Teach the US Healthcare Industry

Given the copious amounts of sensitive data coursing through the US healthcare system, strong information security remains a high-stakes requirement for all players in the industry. Among the most obvious problem areas, healthcare information security currently suffers from the inherent weakness of using passwords to guard information access. Passwords remain an easy attack vector because humans pick easy-to-remember — and therefore hackable — words or phrases.

However, hope is on the horizon. Technology vendors and organizations are collaborating toward making a password-less future. But meanwhile, industries that store and share personally identifiable information can activate multifactor authentication (MFA) to buttress password protection. Given the successful rollout of chip-based cards for US consumer payments in the past few years, this form factor might be the best candidate for implementing MFA in healthcare.

Chip-based "smart" cards have become ubiquitous in the US since the middle of 2015, when they were distributed by payments issuers to combat the spike in data breaches and the resulting credit card fraud. This transition has reduced fraud, proved the sector can self-regulate and adapt to new systems, and demonstrated that American consumers will incorporate this form factor into routine practice. With three years' evidence, it's time we apply the lessons learned from financial services' smart card implementation to secure access to medical records and other sensitive information of high interest to cybercriminals.

Reduce fraud: In the US healthcare sector, fraud, waste, and abuse are persistent problems. This begins with patient enrollment and continues with subsequent redundant information entry that is sometimes complicated by language barriers and improper patient identification. The adoption of a chip-based system for healthcare services provides an avenue to make things more efficient. For instance, a chip-based system would greatly improve the accuracy of data capture. In addition, the chip can ensure HIPAA compliance and increase the difficulty for medical identity theft to take place in a physical setting in which care is being provided. This will also lead to an accurate view of consumption.

Invite self-regulation: Financial services and healthcare are among the most regulated industries in the US, with a combination of governmental and self-regulating organizations (SROs). The Federal Financial Institutions Examination Council, the Federal Deposit Insurance Corporation, and the Consumer Financial Protection Bureau are examples of government regulators, while Financial Industry Regulatory Authority and the Payment Card Industry Security Standards Council are influential SROs. Healthcare, currently regulated primarily by government bodies, could accelerate stronger security practices by incorporating industry bodies that have a financial and ethical responsibility to protect access to sensitive information, including patient data, research results, and other proprietary information. Giving hospitals, insurance providers, and other medical players a stake in industry practices could speed implementation and result in a better outcome in the long run.

Change industry relationships: Like the tension between merchants and card providers in the payments industry, a similar tension exists in the US healthcare system. While employers and the government bear much of the costs, the actual "payment" is typically processed through insurance companies. Financial services implemented changes by reversing previous policies regarding how fraud liability was handled; under the new chip-card way of working, card issuers covered fraudulent charges in situations in which merchants had adopted point-of-sale technology that allowed chip-based cards to be used. Healthcare could similarly drive change by mandating providers integrate point-of-care terminals or otherwise looking for a parallel from the financial services industry. When insurers negotiate prices with healthcare providers, they could expedite payments for those using chip-based cards or add fees for those providers not implementing chip-based cards.

Change consumer habits: The way that hundreds of millions of US consumers relatively quickly adopted to the move to chip-based cards holds promise for the US healthcare industry. Moreover, many American consumers now understand that the chip provides a stronger level of both security and fraud prevention than previously existed. This prepares the way for the healthcare sector to adopt chip-based cards. As a way to implement stronger identity protection, portability, and tracking, the equivalent chip for our health data could become a reality via our insurance cards in a manner that moves patient data with greater veracity and velocity.

Chip-based cards hold the potential to solve many of the ongoing problems in the US healthcare sector, and consumers are already accustomed to using this technology as result of implementation in the payments industry. The time is right to bring smart chip cards into the healthcare security equation.

Related Content:

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.