Social Engineering Techniques, Password Selection, and Health Care Legislation: A Health Care Setting

Introduction

There are many threats to the privacy of a patient’s information, and one of the largest threats is social engineers or the act of social engineering. Social engineering is generally defined to include the use of trickery, personal relationships and trust to obtain information; more specifically, it is the art of deceiving people into giving confidential, private or privileged information or access to a hacker (Gragg, 2007).

Another threat to the privacy of security of patient’s information can be the employees themselves. Internal employees actually can pose the largest threat to the security and privacy of information as they can exploit the trust of their co-workers, and they generally are the individuals who have or have had authorized access to the health care organization’s network. As well, they are generally familiar with the internal policies and procedures of the organization. Additionally, internal employees can exploit that knowledge to facilitate attacks and even collude with external attackers (http://www.hhs.gov/news/facts/privacy.html). HIPAA regulations were enacted to protect the privacy and security of patients and their medical records; simply put, they make it illegal for unauthorized personnel to access or release information from someone's medical records.

Despite its legal requirements, however, HIPAA standards have been known to be difficult to implement and are not always followed. As required by HIPAA, healthcare institutions are required to provide security methods in order to protect patient’s information. One such method is through the authentication of the individual requesting access. Healthcare employees are generally subjected to some type of authentication process. Although there are different ways of authenticating employees, most systems are based on the use of a physical token (something one has), secret knowledge (something one knows) or biometrics (something one is) (Burnett & Kleiman, 2006).

Due to increased regulations and the increased opportunities for exploitation that exist in today’s digital world, it is even more important for healthcare providers to keep healthcare records and the information held within, safe and private. Governmental agencies have adopted initiatives that specifically address the issues and rights of healthcare patients. More specifically, the security and privacy of healthcare information is protected by the Health Insurance Portability and Accountability Act (HIPAA), requiring healthcare agencies to do everything possible to protect their information.