Hi, I'm Mary Ann Kolpasek McGee, Executive Editor at Information Security Media Group, and I have the pleasure here of speaking to Lee Kim, who is Senior Principal of Cybersecurity and Privacy of the Healthcare Information Management and System Society. Hi, Lee. Hi, Mary Ann. How are you?
Good. So Lee, we're here with him. Tell us a little bit about some of the top surprises and most disturbing findings of the annual HIMS Cyber Survey that was just released. Sure.
So some of the most surprising things are that we are down in terms of ransomware. Listen, 12% of healthcare providers are getting hit by ransomware, and that's a good thing for us. Some of the disturbing things, of course, because there are always problems in terms of cyber security, is that even though, you know, if you healthcare providers haven't hit by ransomware, a lot of them have no idea what kind of variant hit them, which says to me they aren't doing their forensics to look into what exactly they have. So that probably compromises just a wee bit their recovery and their resilience for the future.
So when you say that ransomware attacks have gone down, are they going down? Are they maybe happening at other sort of entities that the foreword not hit? Right here also is that a lot of the attacks are going downstream to like smaller entities or to vendors that serve as a lot of clients. So it's one attack, but it affects many.
That's true. So there are a few answers to that. One is, since December 2013, after a big retailer breach was announced, we've had the supply chain attacks where, let's say, there's a big target, a large hospital system. Instead, you go through an affiliate, or you go through maybe a physician practice that's coupled through them, or you go through an HVAC vendor.
But that said, you know, so those things are common. What we've seen, though, is a change in the market. And that is, I think that we all know not naming names or incriminating anyone, shall we say? But essentially, crypto has been devalued, at least temporarily.
So we don't see as many targeted attacks. And also, these cyber liability insurance companies are demanding more of us if we want coverage. So it's a tougher nut to crack, you know? So these cyber attackers are saying, hey, in terms of economics, it doesn't quite make sense now, but for sure, the market is going to bore back, and of course they'll try to, just like a shark, sink in.
So what sort of trends are you seeing in terms of security, IT budgets, and workforce trends? Sure, in terms of workforce trends, the biggest obstacles are basically, we lack people, we lack qualified people, and we lack the budgets unfortunately to hire them. And also speaking in which, we also, in terms of that ongoing training, which we all desperately need it, because cyber security is changing so fast, as you know, individuals that are cyber security pros are getting trained typically once a year or even less than once a year, because budget, and of course time, doesn't allow that. So that's why we're a little bit behind the curve in terms of those that are getting less training and hence have less knowledge to determine, okay, what is it that we're actually seeing when we have a possible attack?
Is it something, or are people fooled by the smoke screen? So at the conference, obviously, generative AI tools like chat GPT is sort of a hot topic. What are some of your top privacy and security and perhaps legal worries concerning these tools and their use in healthcare? Yes, in terms of the evolution of chat GPT, and now we're on GPT4.
I, myself, am a subscriber, for example, and what we see with that, and it's fun, by the way, I would recommend everyone in healthcare, at least house and passing literacy, because it's going to change what we do, whether we're in cyber or something else. But nonetheless, the concerns that I have right now is that some of these technologies, at least, are a bit of a black box. We aren't quite sure exactly in terms of what goes into training these algorithms. We aren't sure if we input something, whether something will be incorporated.
But I could say that, positively, companies like OpenAI have been evolving their data usage policies. For example, since March 1st to 2023, they changed their model so that it's now opt-in for programmers, for example, that interface with GPT through an API to incorporate their information, their personal information, into the algorithm. You actually have to affirmatively opt-in. But something to keep aware of, though, is that if we're a consumer using chat GPT or Bing or something like that, then it's an opt-out.
We have to specifically opt-out of that kind of data collection. So beware, if you're inputting your intellectual property, if you're inputting secrets that you don't want anyone other than your dearest friends to know, or just your organization, then beware. Because unfortunately, we don't have that transparency yet. But I do believe that the markets, the FDC, the data protection authorities in Europe and others, I think that the market will correct itself.
And there will be, undoubtedly, some growing pains. But these people are very bright. And I know that they're very committed to ensuring that AI helps augment what we do. So I think that we will see enhancements and refinements.
What about healthcare organizations using these tools for patient protected health information? What sort of concerns are there with that? I would say the first thing, of course, is make sure that whomever is supplying that chatbot or GPT technology, be sure to get a business associate agreement. Because we know that that at least contains some administrative, safeguard, some technical safeguard, some written assurances that the data is going to be handled properly and that the information will be just held for an appropriate amount of time.
So I think that that's certainly a baseline consideration. Another thing, though, to keep in mind, currently with the chat GPT models is that if you log in, there's certainly a disclaimer that says no sense of information. This is experimental. Do heed that.
That's what I certainly would suggest. But on the other hand, if, for example, these providers provide something like a written business associate agreement, if, for example, they're willing to answer due diligence questionnaires about this situation. This questionnaires about the secure handling and private handling of patient information. I would say that's worthwhile gauging the risk.
Perhaps start first with lower risk information, such as public information, maybe information that has a low level of sensitivity. But ultimately, yes, I could see a time when we are essentially relying on AI-like technology to augment what we do. I mean, as we know, if we go in for mammograms, of course, it's AI-assisted. So AI is already present in healthcare, and it does wonders for those of us that are patients, and we all are.
So I don't think that this should be feared. And I do think that, again, that essentially with help of regulators in Congress and other oversight, that ultimately this technology will be essentially trustworthy. And I think that it's getting there. It's just simply, I think that we need to conservatively adopt technologies like GPT, again with perhaps less sensitive things.
And then ultimately, maybe see what your peers are doing, maybe see what others are doing in other industry and cautiously dip the toe in the water. And so Lee, what else are you keeping an eye on in terms of cybersecurity, privacy issues, and legal-related issues in healthcare this year, and why? Deep fakes. So since about, I'm going to say, 2019, the U.S.
government, including DHS, has had their eye in terms of deep fakes. And nowadays, we see deep fakes pretty much every day, right, on social media, hitting the entertainment industry pretty hard in other sectors. And in fact, unfortunately, people are getting scammed as a result of deep fakes. It's getting more and more real.
But rest assured, there are actually industry standards that are now out there against deep fakes. So that, for example, if you're putting together a video or a media for your company, you can essentially have a validated fingerprint with each phase, just like blockchain. You can validate each step where it's certified, so that you know that it's not, for example, an unauthenticated threat actor that's trying to interject that kind of poison content. So I think that's very important, because as our society becomes more decentralized, as we aren't essentially having these in-person meetings, and like what we're doing now, you know, we do need that out of band communication where we can pick up the phone or have some other channel to confirm something that would be like, is my family member really in trouble?
Does Dr. So-and-so really need this help? You know, if it's something that seems suspicious, I think that we have another, we need to have that communication plan, other mode of communication to verify something that seems suspicious. Well, I want to thank you very much, Lee.
I've been speaking to Lee Kim of HIMS. I'm Mary Ann Kolba, Second McGee of Information Security Media Group. Thanks for joining us.