Industry sign banking alaska medical history mobile
well let me get going here again I'm John Hsu Garion and I'm the executive chairman of Eri and when we started Eri about eighteen years ago recycling electronics was and and and destroying hardware and in a responsible way was all about the environment it was all about keeping our old electronics out of landfills or from being shipped to China India or Africa where would pollute the environments there but as time has gone on and we've evolved the word cybersecurity has been become part of our vernacular not only in the United States but around the world and we're going to chat today and discuss the ramifications that the rise of cybersecurity and the rise of the needs for more privacy and hardware data destruction in combined with the Internet of Things and the 4G to 5g revolution that's coming and all has already started affects all of us and especially impacts the healthcare industry as a whole as a little bit of history the word cybersecurity is typically typically I'm surrounded by software solutions such as Palantir and the 15 other unicorns that exist or so out there solving cybersecurity issues on the software side but the hardware side which gets very little media attention or discussion is really like solving if you solve the software side of the healthcare equation but don't take care of the hardware the right way or miss appropriate by accident lack of knowledge data contained therein all of the hardware exposes everyone to all sorts of historic regulations and new regulations that are coming down we're going to get into that now I have a bunch of articles that I pull the recent times I'm going to walk everybody through these articles and then I'm going to walk everybody through the trends of legislation both in Europe which is called GDP are and what come to America now as well let's start with the slides the first slide is from May 11 2008 een it's from healthcare IT News says when medical devices get hacked hospitals often don't know it the threat to medical devices is real and happening now and it's a patient safety issue much more than one of HIPAA compliance which we're going to get into later on medical devices are one tool that can directly put patients at risk if a breach or software failure were to occur so for instance want to cry the legacy systems at the UK National Health System service and they weren't the initial target the attack hinder the ability to provide care and with medical devices those impacted are the critical groups of patients so there are cases where these small medical devices are being hacked and the heck isn't always coming through software the hacks can come from gaps that exist in the hardware of these hospital systems give access the bad actors let's go to the next slide this slide is a little more recent from health IT security December 17th 2019 the title of the slide is the RSA keys found in IOT Internet of Things medical devices implants prone to attack this sounds horrific and it is than when these attacks do come so let's go through this key factor researchers discovered a vulnerability in the RSA keys and certificates used by lightweight IOT devices including medical devices and implants which puts them at risk of cyber attack and the net of this slide will go down to the last paragraph is that the findings are particularly troubling for the healthcare sector it ends where 82% of the internet of things devices of providers and vendors have been targeted by cybertek's these attacks I could tell you from our experience here at Eri these attacks are real and they're happening and just for a little context we've had this company now for 18 years I've co-founder and run it and for years health care wasn't part of our coverage not because we didn't one health care but because sustainability wasn't really a core subject matter at leadership levels like it is at other organizations or governmental entities but with the rise of cybersecurity needs and the regulations surrounding it the opportunities for cyberattacks through software and for this discussion purposes through hardware is massive and it's literally created such a volume of healthcare companies from across the United States and in some cases even the world and push them into our arms because gdpr is real and has been enacted in Europe and as we're going to get into later similar legislations coming down in America that goes way beyond hip up on a national basis and on a state-by-state basis let's go to the next slide now this is from April 8th 2019 experts say hackers deliberately target hospitals we know this to be true not only from headlines like this but from our company's perspective and the people we have to work with we know that this has become a big thing and a real thing and here's the text of this slide the net-net of this slide hospitals in the healthcare industry are being deliberately targeted by hackers cyber criminals and spies seeking a treasure trove of personal and financial information a business consultancy has warned for instance the theft of personal details of 1.5 million people from a Singaporean health database including that of the Prime Minister by a state-sponsored espionage group has highlighted the threat said the BBL and here's the unfortunate part and the bottom line of the importance of this slide Hospitals and Clinics are also often poorly defended compared to banks or government institutions despite representing a honeypot of valuable information said Garrett Gregory Garrett the head of the international cybersecurity at the firm BVL so we know this to be a fact that you're AI given that we had many more government clients and financial institution clients before hospitals and healthcare came to us looking for legitimate credible and responsible ways to destroy the data that's contained in their hardware and I'll give you an example think of the two great companies Iron Mountain and shred it they've made their mark and their brands showing the data that's contained on paper at hospitals and healthcare agencies of course also at other type of businesses as well financial institutions government and even small and medium businesses since the data has been responsibly destroyed that's on paper think of what we're discussing today to be an ancillary opportunity to responsibly destroy the data that is contained in all the hardware in all the hospitals and healthcare agencies both large and small across the United States it's the hardware version of shredded what Iron Mountain does with paper and lift that will go to the next slide so from Gizmodo 19th 2019 well 145,000 rehab patients medical files leaked online says here some 145,000 patients have had their protected health information exposed what is only the latest of many major leaks of sensitive medical records in recent years according to the security researcher Justin pain who's a director of trust and safety at CloudFlare the records belong to patients on the Bronx Lebanon Hospital Center in New York were exposed by a third party medical IT company let me just pause on that this is a common problem we run into all the time many hospitals and health care agencies come to us for solutions and when we quote them the price to responsibly destroy their hardware and the data that's contained therein they bulk or they shop it and sometimes end up with a solution share this with us that's a local solution right down the street that's offered to pick up they're medical-related IT equipment for free let me share this with you there is no such thing three solution when it comes to responsible hardware data destruction old adages become old adages for good reasons and the old adage of these no such thing as a free lunch also applies to responsible hardware data destruction in any sector but today we're talking about healthcare and unfortunately many well-meaning facilities managers IT directors who are put on budgets choose a free or cheap solution much to the peril the organization that they would pass to represent this puts that organization and their patients massive risk both healthcare risks to the patients and regulatory risk both on a statewide basis a basis agencies that these people were TAS to represent so free is really a keyword for not responsible as we went along on this slide it goes on to say that some four point nine million documents were accessible to virtually anyone who knew where to look the files both identified the patients and the types of treatment they receive that's the third rail of a data breach when it comes to healthcare agencies it goes on to say additional informations about patience was easy to come by using Google for one randomly selected patient their age birthdate address in names of family members along with potential phone numbers and email addresses were posted quite a disaster that can be avoided both on the software side which is still very necessary as well but on the hardware side also on to the next slide this is from help IP security 23rd 2019 Oh IG finds ineffective data network security it says here the information security program of the Department of Health and Human Services including four operating divisions was determined to be not effective by the office of the inspector general we pause on that we cover big government little government our company local municipalities hundreds upon hundreds of cities across America and thousands companies both small/medium and many many large publicly traded companies it is not out of the realm understand that even big government that's tasked with protecting us as citizens as public servants are still not doing things the right way themselves and it's not because people want to do things maliciously there's just a tremendous void of information out there where people don't understand that disposing of their hardware inappropriately can lead to both regulatory disaster financial ruin and put patience in danger the article goes on here to discuss that the watchdog recently completed its annual federal Information Security Management Act FISMA audit of HHS the Food and Drug Administration Centers for Medicare and Medicaid Services and the National Institutes of Health Oh IG officials evaluated the operating divisions to determine compliance with the federal regulation determined and here's the net-net now while HHS FDA CMS and NIH continues to work for strengthening and security program the agencies security has weaknesses in its risk management configuration management Identity and Access Management and here it goes data protection and privacy security training continuous monitoring Incident Response and contingency planning so it's not a defense if a health care agency that you've been past one of your colleagues has been passed protect as an organization and as a fiduciary and steward for the patients that they serve to say that a we didn't know or be while the government's not doing it right either we've had many big government agencies come to us and we've gone over their previous practices it's shocking what was going on before we've had instances federal employees were putting their old electronics on Craigslist or Ebay we're using local recyclers in the Washington DC or Virginia areas to pick up the electronics for free again there's no such thing as a free lunch when it comes to recycling and destroying the data that's contained in the hardware of health care agencies and companies and governmental agencies across the United States let's go to the next slide Wall Street Journal November 12 2019 Google's project nightingale triggers federal inquiry Google's deal with asset the Ascension healthcare system aimed at improving patient care has created a goldmine of health data for google and what was discussed in this article is that the country's second-largest health system collected health information on 50 million American patients and they didn't know according to regulators and lawmakers whether the Google and Ascension Partnership was adequately adequately protecting patient data in this initiative called Project nightingale and in the net-net here is Ascension without notifying the patients or doctors has begun sharing their information with Google which include personally identifiable information on millions of patients such as names date of birth lab tests doctor's diagnosis medication hospitalization history and some billing claims and clinical records just because you're big brand doesn't mean the people that are passed with following the right security protocols both on a software basis and for this discussion a hardware basis know what they're doing unfortunately cybersecurity and protecting organizations from the bad guys that are out there around the world that are mounting attacks every day is a new industry still we're still on the top of the second inning so the reason why I participate in important webinars like the one that Catherine is putting on today is just to help disseminate information void of information in the marketplace today let's go to the next slide member 26 2019 over 38 million healthcare records explore exposing breaches in 2019 it goes on to say here the tally for health records exposed or lost to cyber incident this year in 2019 was pushing around 40 million throughout October the US Department of Health and Human Services Office for Civil Rights was notified in 52 data breaches breaches that impacted hundreds of thousands of health records the number of incidents is the highest logged in a month since January 2014 the count of exposed lost or stolen health records until the end of October this year passed the 38 million mark the HIPAA Journal reports this problem is only growing let me just say that it's not receiving it's going to continue to grow when you talk to all the best experts from around the world we say we get access to because of the specific nature our business they say over the next 10 years going to be an ongoing growing concern cause of the need for responsible hardware data destruction the rise of the Internet of Things talk about later the 4G to 5g revolution that's upon us let's go to the next slide very health data for startups this from TechCrunch December 2019 healthcare focus venture firms have now gotten together to secure health data some of the nation's nation's top health care focus venture capital firms now created a technology security certification provider called high trust a chai tea R Us T to create best practices for data security for startups developing digital health technologies the reason why they've gotten together and it says this in the last paragraph it makes startups more marketable or viable says the chief executive of high trust so this shows you from December of 2019 how new this topic still is when the VCS who are typically years ahead of everybody else on all sorts of new innovations are just now creating a security certification depository called high-trust it's just another example of how new the rise of cybersecurity truly is both in a software sense for this discussion in a hardware sense as well which is just as important as the software side let's go to the next slide 2019 as well modern healthcare healthcare breaches in November exposed 570 thousand patients data more than half a million people had that expose in healthcare breaches to the federal government just last month from December of course so let's just assume this was November and it goes on to say here providers health plans in their business associations in November 2019 reported 29 data breaches affecting five hundred and seventy thousand patients to the HH HHS office for civil rights the agency that's a federal agency that maintains the government's database of healthcare breaches again a growing problem that's going to get more and more media attention as the need and the rights as you could tell the civil right to protect your privacy and the federal legislation which we're going to get into later the international legislation which we're also going to talk about what I touched on earlier gdpr and the state by state legislation is only going to grow not only grow in terms of more of it but the noose is going to tighten as two regulatory practices and the liabilities that exist appropriation only going to expand go to n
xt slide number 17 2019 privacy breach at medical labs could affect millions this is not a problem that's just specific to the United States like I said Europe already has GDP our May of 2018 now Canada was hit and this article goes on to talk about the private information of millions of Canadians could be at risk after cyber attack was conducted against the computer systems of Life labs a laboratory testing company yes affected contained information belonging to about 15 million customers the information systems contain client data including names addresses emails customer logins and passwords health card numbers and lab tests again a nightmare for company like life labs a nightmare taury nightmare financial nightmare and the goodwill that erodes people that they're serving that they were entrusted to serve never be able to be back let's go to the next slide here Wall Street Journal December 2019 the Internet of Things protect Internet of Internet of Things data in the health ecosystem healthcare and life sciences organizations have a specific I have a special responsibility to keep data safe as I've been saying all along on its webinar yet they face unique challenges in a hyper-connected device driven world so for example a digitally enabled pacemaker could transmit a patient's data through a physician's office to guide treatment treatment decisions while a manufacturer might also collect and include the information in a database tapped by researchers or other stakeholders electronic health records can contain everything from demographic data to work history and financial information this can be worth a fortune on the black market throughout this webinar the cost of a breach can be felt for years in terms of fewer patients lost revenue and recovery costs ladies and gentlemen this is a real problem and it's only growing next slide here here it talks about the liability and the liability nationally in the United States and on the state-by-state basis is only expanding this this is from December 2019 victims consume ortho clinics if data have the Georgia Supreme Court has ruled that the victims of a data breach at an orthopedic clinic may sue the clinic for damages and by the way this is happening on a state-by-state basis the courts are getting much more liberal in allowing patience we've had a data breach or potential data breach in some states sooo healthcare agencies and other corporations by the way for damages let's go to the next slide of IT security December 2019 data of 15 million patients stolen retrieved in life lamps cyberattack this goes back to the life lab discussion we just had a couple slides back and it paid hackers that of 50 million customers after cybertek patience primarily resided in Canada actually the compromised data included names addresses emails login information and all sorts of other information that destroys the goodwill of the healthcare agency when they have a breach like this let's go to the next slide August 8 2018 HIPAA requires secure disposal of Eph i Laden devices the HIPAA Security Rule which we're going to talk about a little later in this webinar requires HIPAA covered entities and business associates which should be everybody on this call today on this webinar to implement policies and procedures regarding the secure disposal and reuse of electronic devices in media containing eph I so that Eph I cannot be retrieved Oh CR stressed that the improper disposal of electronic devices here's this is exactly what we're talking about today and media puts the Eph I stored on them at risk and could lead the data breaches one of the most important slides of all today that I'm going over with everybody because this is happening and clients are coming to us every week because they've had a breach some of them had a breach that hasn't made the cover of the Wall Street Journal some other credible and legitimate news agency and others I've already been all over the media come to us now looking for solution sometimes after they've suffered a huge loss this could cost the organization in terms of regulatory fines breach notification expenses lawsuits consultant and legal fees and loss of business this is happening paper film or other hardcopy media should be shredded or destroyed this is exactly what we do at Eri such that the pH I cannot be read or reconstruction reconstructed redaction is not a means of data destruction according to OCR electronic media should be cleared purged and destroyed consistent with NIST special publication 800-53 if someone you work with is pushing back and asking you free Ellucian for your hardware data is contained therein or might be contained therein show them this slide let's go to the next slide here's where we could get into data security laws this is important for everyone um I'm not going to read each one but the existing legislation that most of you are familiar with is on the left-hand side of this page we put this together as a cheat sheet for everybody on this call hip and high-tech at the top of the list back then fitrah FISMA the California consumer Privacy Act the FTC Act GLBA PCI DSS Coppa FERPA gdpr which we're going to talk about in a little bit other state laws etc new legislation that's coming we're going to get into this in the next slide but it's already been passed in the baton and enacted in Nevada in California you and already been past becoming effective in New York the shield back 21st of 2020 and in Maine July 1st of 2020 as well we act to protect the privacy of online consumer information in California the act is called the California Privacy Act Nevada is called SB to 220 220 ERI our company covers every zip code in this country including Hawaiian Alaska so it's our business to stay up on the business of regulation and educate our clients or potential clients as to the risks creation of data that's contained in their hardware let's go to the next slide again this is a very good cheat sheet map which will look I'll explain a little bit more of what happens so as I've mentioned throughout this conversation today in this webinar gdpr was enacted in Europe May 25th of 2018 and being that we are the United States of America we always want to do things bigger and better so seven thorough laws have currently been proposed to mimic or go beyond GDP our so federal legislation that looks like gdpr but is even more constraining and more punitive have been proposed I shared on the last light four states have already passed new legislation and at least 14 states have proposed legislation of enacted study bills and all the legislation on us on the right hand side for everyone to study and understand but it's my understanding from experts on a federal level and from the numerous states that we do business in the Federalist one version of the federal legislation to get passed in the coming year in every state in the coming two to three years to have their own legislation so beyond the traditional legislation which we went over back on slide 16 this new GDP are like privacy security legislation is coming down on a federal and on a state-by-state basis which will affect everybody on this webinar in impactful way let's go to the next slide please doing things in an environmental and sustainable way or let us say in a circular economy way is important to most Board of Directors and c-suite executives in the world that we live in today both in the United States and around the world so I've added a slide here 16 that talks about types of laws that exists around responsibly disposing of your hardware that's for your study in use as well let's go to the next slide let's talk about the future a little bit Wall Street Journal cyber security Pro division of the Wall Street Journal December 2019 2020 is when cyber security gets even weirder this article talked about AI power defects ransomware internet of things in five G all mean that protecting your data is about to get a lot harder and that is true right there that sums up this page and it says on the in the last paragraph the security threats are weird and getting weirder and crooks are looking to extort you to access your own data from personal experience at Eri running your eye with my partners I could tell you this article was spot on let's look at the next slide six cybersecurity predictions for 2020 the first half of 2019 data breaches increased by 54% compared to the first six months of 2018 a study by the risk-based security it says here in terms of trends for 2020 and of course think about beyond data breaches will continue to increase not only in terms of volume but also in terms of severity misplace understanding of cloud security will increase risk because we handle a lot of cloud farms server farms I could tell you that's very true 2020 and Beyond will bring the rise of securing machine identities so this is another group of predictions let's go to the next slide ecosystems December 12 2009 themed ecosystems top six security trends for 2020 the reports of data breaches in data theft cyber security topped the list of concerns for Australian IT professionals I agree that this should be a pop issue with all IT professionals in the healthcare industry and with this report found that operational Technology Security is lagging and the volume of GDP are related prosecutions continue to rise which have been sharing throughout this webinar let's go to the next slide 5g points the way to life beyond the smartphone this more has to do with the 4G to 5g revolution which is upon us and that 5g will push consumers which is also patients in the healthcare world towards alternatives and smaller Internet of Things devices let's go to the next slide shift from 4G to 5g will change about everything June of 2018 this has become true telecom experts are talking about the arrival of 5g and for instance cars the car industry which never was a client of ours has become a client of ours because cars now become computers on wheels so just like health care was something that we didn't really cover that much we wanted to but when it was just all about keeping Hardware out of landfills wasn't a big deal when it came to data protection and cybersecurity car industry became a huge opportunity for us and has become huge clients of ours but these cars are just computers on wheels as has the LT healthcare industry let's shape let's go to the next slide a hackers paradise fund this is from the Financial Times October of last year Internet connected devices using fifth generation mobile networks offer prime targets for criminals which are these devices are known as Internet of Things and the number of Internet connected items will grow to 25 billion by 2021 a Gartner research company said criminals continue to exploit Internet of Things and internet of thing devices are proliferating throughout the healthcare and Hospital industries let's go to the next slide is our last slide and this is just ten things you could do are the safe disposal of data devices this is from actually 2018 but these are still extraordinarily relevant in a good summation a healthcare healthcare organizations as they continue to decommission information technology they're likely to contain patients financial or protected health information which all of you know and special care is needed in disposing of the devices which was the purpose of today's webinar so here's the cop 10 know which data and organization maintains and where it's stored make sure that data disposal plan is up-to-date number 3 remove asset tags and corporate identifying marks these are great suggestions let me tell you something this is a wonderful how-to number 4 identify an isolate all asset recovery controlled equipment and devices number 5 ensure outside entities handling data destruction are certified and that goes for Eri we're not only east stewards in r2 which is the environmental certifications we're the only company United States that has an aid certification in every one of our facilities the National Association of information destruction in your industry health and hospital and health care look for nade certification it was in it was a certification that was invented for the shredded sand Iron Mountain's of the world for data contained on paper but has now created certifications for data contained in hardware and we are the only company in the United States and actually in the world have eight facilities made certified specifically for hospital and healthcare and financial institutions number six certify the individuals handling the organization's data assets number seven understand the chain of custody for devices number eight determine if hard drive destruction should occur on site we do that as well and it is a very credible way of destroying data when people don't even want to take the risk of transporting their hardware that has that as data containing number nine managed equipment that will be disposed of and destroyed off-site and number ten ensure secure logistics and controls and moving equipment you
