In 2020, Babylon Health, a telehealth app based in the United Kingdom, had
a breach. Patients using their general practitioner platform had access to
videos of other patients' appointments. A patient that used the app
announced on Twitter that he could view the videos of approximately 50
patients. The company reported that they found out about the issue shortly
before the patient made his announcement on Twitter. The company
reported that they found the issue and fixed it within 2 hours. They stated it
was a software error but did not provide the specific error. Babylon Health
reached out to the affected patients to inform them. Cybercriminals could
have easily accessed these videos and used the patients’ information. With
an increase in the use of telehealth apps since COVID began, this raises
security concerns. Companies must ensure that all aspects of their software
and platforms are secure (Davis, 2020). Appointments completed through a
telehealth platform are bound by HIPAA regulations. This situation violated
HIPAA regulations due to unauthorized individuals accessing patient
information.
The healthcare industry collects and stores valuable information, such as
birthdates, social security numbers, financial and health information, making
it vulnerable to cyber-attacks. Several technological tools assist healthcare
organizations in preventing breaches. One of the most critical steps is
regularly scheduled risk analyses of the current systems to check for
vulnerabilities. It is vital to implement access controls. Access to information
should be based on an employee’s role and functions. The employee must be
identified so the organization can track their activities. Audit trails can be
completed to check the information an employee has accessed, and any
changes made. There should be policies regarding logging on and off the
system. Networks can be segmented for specific users, like a sub-network
that patients and visitors would use separate from the healthcare personnel.
Encrypting data will ensure the integrity of the data and keep the
information secure. The Breach Notification Rule states that it is not
considered a breach if encrypted data is lost because it is secure (Sahoo,
2021).
Davis, J. (2020, June 11). Breach of telehealth app Babylon health raises
privacy concerns. Health IT Security.
https://healthitsecurity.com/news/breach-of-telehealth-app-babylon-
health-raises-privacy-concerns
Sahoo, N. (2021, June 30). How to prevent healthcare data breaches. Cyber
Security Intelligence.
https://www.cybersecurityintelligence.com/blog/how-to-prevent-
healthcare-data-breaches--5723.html
