Cybersecurity Training in Medical Centers: Leveraging Every Opportunity to Convey the Message

Cyber security is a critical component of health information technology. As electronic health records (EHRs) become more widely adopted and as new payment models for health care require more data sharing and clinical care coordination with multiple external providers, it becomes evident that new challenges are arising. At the same time, cybercriminals are finding multiple uses for clinical data, from claims fraud to identity theft. Gangs of organized criminals are now harvesting medical data for fraud and identity theft purposes (1). Government regulators are scrutinizing every reported health data breach with organizations potentially facing civil and criminal penalties when data is not protected properly. In such an environment, one would expect a significant cyber training budget to be available — but this is often not the case. Many health care institutions spend relatively small proportions of their annual budgets on information technology in general (2), and often only a small proportion of that budget is devoted to cybersecurity training. This disparity becomes even more pronounced when the average cost of a data breach in a health care institution in 2013 was $1,973,895 (3).