Written by Todd Bennett, Director of Marketing Planning, Health Care, LexisNexis Risk Solutions
The most important question for health care security professionals is not, “Who are you?,” but rather, “What do we need to know about you in order to insure safety, integrity and trust?” And nowhere is the answer to that question more critical than in health care, where inadequate systems and processes can not only threaten business integrity and success, but jeopardize lives, as well.
With identity fraud claiming the dubious honor of being the fastest growing crime in the United States, identity management in health care is no longer a luxury, but a necessity. Today, medical identity fraud is the fastest growing type of identity theft. The Ponemon Institute estimates the annual economic impact of medical identity theft to be nearly $31 billion.
Even with recent hacking-related events, health care consumers will, and should, expect their data to be secure at all times in order to protect their financial and physical well-being. Health care stakeholders will demand solutions that ensure they are dealing with the right person, at the right time, for the right transaction, thereby minimizing risk and negative impact on their health care delivery decisions, the health of their patients and overall business performance. Identity management is rapidly evolving to encompass the new scale of emerging risks, application variability and patient and stakeholder concerns.
However, merely extending an organization’s existing enterprise identity management will not work. Instead, established organizations can layer new identity management capabilities onto existing systems in the form of services that overcome the shortcomings of internal solutions which are capable of managing only one type of access to internal networks. The challenges start arising when you have to intelligently manage internal and external access. First, you usually know much less about external users than you do about your own people, who have gone through extensive vetting, often including background screening. That said, more in-depth information on staff is also critical in health care, as medical identity theft often has an “inside” element, such as an employee providing protected information to organized crime rings. Second, it is nearly impossible to mandate that health care consumers use a specific method, such as smart cards or tokens. If you try to mandate a method that doesn’t feel comfortable or convenient to the end user, they may choose to take their business elsewhere.
This is just one example of the far-reaching business ramifications of identity validation, verification and authentication, as their execution directly impacts interactions with patients, payers, providers and other stakeholders. While compliance standards are obviously important, it is critical health care entities implement identity management in a way that addresses the unique needs of your organization. There is no “one size fits all” solution to medical identity management. Effective identity management should balance the security need to reduce risk by restricting access with health care service’s mandate to raise consumer satisfaction by increasing access and ease. Health care organizations should be able to identify the informational components that are absolutely necessary so that they can make targeted requests while eliminating extraneous requests for unneeded information.
Because health care exists in a space shaped by constantly evolving threats and compliance demands, many organizations are turning to hosted services. These services often have massive data banks that tap billions of public records from thousands of diverse data sources and are able to verify the identities of hundreds of millions of individuals. The differentiating factor is how effective those services are able to leverage their data stores through the use of intelligent data-linking to locate, match and standardize any relevant data. Hosted services also provide significant value by quantifying identity risk through analytics-infused scoring and identify when multifactor authentication methods are needed.
As the number of identity-reliant transactions continue to increase, it is critical that organizations ask themselves: “What do we need to know about you?” This question is the starting place for all other questions in identity management and should be resolved up front for any health care organization looking to maximize the benefits of modern health care systems while minimizing associated risk factors.