Cybersecurity company Aware recently introduced an advanced Risk Assessment Calculator for collaboration platforms, utilizing AI to help organizations quantify and mitigate data risks. On the heels of the launch, Chris Plescia, chief technology evangelist at Aware, sat down with 24×7 to discuss how healthcare organizations can help protect data in an increasingly connected world.
24×7: How does the integration of medical devices with collaboration platforms like Slack, Microsoft Teams, or Workplace from Meta impact the cybersecurity posture of healthcare organizations, especially in terms of data security and privacy?
Chris Plescia: The first priority is data privacy and protection. It is critical to ensure that robust policies, controls and monitoring mechanisms are in place to safeguard data, including contextual understanding, recovery, OCR, holds and retention, while maintaining HIPAA compliance. At Aware, we consistently partner with customers to establish the necessary controls and automated detection and mitigation procedures that identify and mitigate any unauthorized sharing of sensitive information.
In a world where many devices incorporate cameras, the ability to understand and protect the information contained within visual content such as images, screenshots, and attachments is indispensable. Information security and compliance teams should demand image recognition and OCR capabilities that enforce compliance and provide a comprehensive understanding of, as well as control over, this unstructured and unrestricted flow of information.
24×7: Given the increase in insider threat exposure within collaboration platforms, what strategies and tools can healthcare institutions implement to proactively detect and mitigate potential breaches involving sensitive patient data, such as PHI (Protected Health Information) and PII (Personally Identifiable Information)?
Plescia: With constant communication and information exchange among employees, organizations need to be proactive in identifying and mitigating insider threats and protecting corporate sensitive assets. To achieve this, a strategic approach is crucial.
To get started, it is essential to grasp that collaboration data is unstructured and unique, creating gaps and blind spots for traditional monitoring and listening tools. Failing to understand these distinctions and manage with the appropriate monitoring and data management functionality will introduce more risk to your organization.
It is also important to recognize that not all insider threats are born out of malicious intent. Often, employees unknowingly compromise security by sharing personal information, passwords, or other data to enhance job performance or provide exceptional customer service. The collaborative nature of work today means that these actions happen in the moment, and that moment happens 24/7. Again, implement purpose-built solutions — meaning they understand the unstructured and multifaceted nature of collaboration communications — solutions with active monitoring and automated actions
Ensure your monitoring strategy is sensitive and able to recognize unusual patterns and behavioral anomalies. With proper monitoring, teams can quickly detect irregularities such as unauthorized sharing of information such as PHI or PII, IDs and passwords, code or other intellectual property, and even corporate-sensitive information like projects, earnings, and organization changes. Having the right solutions in place plays a pivotal role in early threat detection, allowing for immediate action when anomalies are identified. Actions should include data deletion, quarantining of suspicious messages/files, and the prompt notification of relevant personnel.
24×7: With the proliferation of customer data on collaboration platforms, including PII and PHI, what specific challenges and security measures should healthcare providers consider to ensure compliance with healthcare regulations like HIPAA while using these platforms for communication and collaboration?
Plescia: We continue to see significant growth in collaboration conversations, and within them, a surge in the sharing of sensitive and noncompliant data leaving organizations exposed with elevating risk. Employees spend approximately 50% of their day using collaboration tools and platforms such as Slack, Teams, and Zoom, and sent over 18 trillion messages in 2022 according to findings from our 2023 Risk Assessment Report.
We at Aware constantly interact with Information Security, Compliance and IT leaders seeking to get more control over their collaboration data. Modern risk solutions should have rich AI capabilities and detection models to detect things like PII/PCI/PHI sensitive data, user sentiment, toxicity, passwords, and even source code. They also must be able to understand the nuances of these conversations. At the same time, these solutions need to adapt and learn each organization’s cultural and business processing nuances. Coupled with the right rules and governance, you will be able to significantly improve your risk posture and compliance adherence.
24×7: Considering the evolving landscape of cybersecurity threats in the healthcare sector, what role can AI-powered solutions like Aware play in enhancing the overall security posture of medical devices and collaboration platforms used in healthcare settings? What specific features or capabilities does Aware offer to address the unique challenges of securing digital healthcare environments?
Plescia: The integration of collaborative capabilities, conversation and devices brings about amazing advances across the healthcare industry. At the same time, we must consider the fact that more devices mean more data, more cameras, and more risk of personal and sensitive information getting out. To balance this, Aware implements numerous advanced AI listening and interpretation models with over seven years of highly targeted collaboration and unstructured communication/data training. Our Signal solution allows organizations to leverage the pre-built models we provide to analyze messages for sensitive data sharing, passwords, behavior patterns, sentiment, and toxicity, with rules aligning to each individual organizational policies and regulations. This is our strength, and we have enabled multiple risk, compliance and efficiency gains/savings across many healthcare and heavily regulated customers.
With our open API, the AwareIQ platform ingests, normalizes, and enriches unstructured workplace conversations from all sources including survey and help desk verbatims. This unlocks visibility and value for leaders and helps protect corporate assets and harness real time employee feedback and voice. You would be shocked at all the locations that sensitive data shows up.
24×7: With the increasing use of telemedicine and remote monitoring devices, how can healthcare organizations safeguard the confidentiality of patient data transmitted over the internet, and what encryption and authentication measures are recommended for securing these remote healthcare interactions?
Plescia: While this is not a place where Aware focuses directly, providers should always make sure they have strong processes and tooling in place to verify and trust who they are talking to, as well as having encrypted two-way communication technology between parties during a telehealth call.
Additionally, any images, PHI, PCI, or PII that are transmitted before, during and after the call need to be handled with utmost care and protection across the networks during transmission and at rest.
Having strong security education programs and enforcement policies and procedures are another area to focus on. People are always the front line of defense, and we need to support them and give them the necessary training and tooling to be successful and protect those sensitive assets.
