Would you put a $ 10 fence around a $ 100 horse?
Does it make sense to put a $ 100 fence around a $ 10 horse?
For the right security, you need to know what your horse is worth.
The same concepts apply to protecting your data. What is your data worth?
Ask Cottage Health , which had two data breaches, totaling 55,000 records., and settled a $ 4.1 million lawsuit with patients, then paid a $ 2 million California penalty. They were sued by their insurer, which wanted the $ 4.1 million settlement money back, after it discovered Cottage Health had not consistently implemented the security controls it claimed on its insurance application. The $ 6.1 million in the settlement and penalty does not include its costs for legal fees, credit monitoring, notifying patients, public relations, or recovering the business lost from patients who moved to another provider.
One of our clients was audited for HIPAA compliance by the venture capital firm that wanted to invest in their company. Another client had us do a compliance assessment on a healthcare company they wanted to purchase. In both cases, HIPAA compliance was worth millions of dollars.
We asked a client how much the financial impact would be on their business if they lost the sensitive personal data they collected about business partners, and had to notify everyone. The owner said they would be out of business, costing millions of dollars.
Breaches result in lawsuits, with settlements in the millions. If you are a licensed or certified professional, you can lose your license or certification if you are breached.
Federal HIPAA penalties in 2014 – 2015 were $ 14 million. In 2016 – 2017 they tripled to $ 42 million. In 2018, they have already reached $ 7.9 million.
Data is worth more than gold.
Instead of words and images in a computer, think of your data as a pile of gold bars that is worth protecting.
When we work with our clients, we help you identify the types of data you have, where it is located, and how it is protected. We recently worked with a client that came to us for help protecting their patient information. They were shocked when we showed them that they had bigger risks related to the data they stored about workforce members, and job applicants they did not hire, than the people they served.
- What data do you have that is regulated, that you must protect to comply with laws and other regulations?
- What fines and lawsuit judgments might you face if your data is breached?
- Beyond HIPAA that protects patient information, do you know your state data breach laws that apply to employee data?
- Do you know the regulations that protect credit card data?
- Do you have enough of the right type of insurance to protect your finances if you are breached?
Everyone has unregulated data that is sensitive or proprietary, that could hurt your business if it is lost, stolen, or accessed by a competitor or someone who wants to hurt you? Salaries, trade secrets, employment records, pricing models, merger and acquisition plans, lawsuit files, have all been stolen.
As part of our assessments, we search the Dark Web (the criminal side of the Internet) to see if our clients have employee passwords for sale by hackers. Over 90% have had at least one employee’s credentials stolen and offered for sale.
Most of our clients start out not knowing the value of their risks. They hadn’t approved IT security purchases, because the costs were high, and they didn’t know if security was worth the investment.
So, how much should you invest in protecting your data?
The recently-released 2018 Cost of a Data Breach report shows, through research of actual breaches, that in 2017 the average cost to a breached organization for a single lost healthcare record was $408. Across all industries the cost was $ 233 per record. Only a third of the cost was for the direct response to the breach – notifying patients, hiring lawyers and IT security experts, and paying for credit monitoring. Two-thirds of the $ 408/record was the financial effect on the healthcare organizations, by losing patients after violating their trust.
Here is a calculation you can use to estimate the value of protecting your patient data.
Number of Patient Records x $ 408 (cost per record of a breach) = $ ________________ in risk.
Example: 25,000 records x $ 408 = $ 10.2 million. (If this number startles you, imagine if your costs were only 25% of the total, which is still $ 2.5 million.)
Other ways to put a dollar value on your risk
- How much would a breach affect the market value of your business?
- How much investment capital do you need for expansion?
- Personally, what will your retirement look like if you had to pay $ 1 million, $ 2 million, or more, to cover the costs of a breach?
- What would your life be like if you went out of business?
Know the value of your cyber security risk. Do the math.
Ask your IT department, or an outsourced independent IT security consultant, to assess your risks, and recommend what you need to be fully protected. Our assessments calculate your risks based on dollars, and provide ‘under the skin’ data about the current status of your security. Don’t settle for guesses.
Base your security investment on the value of your risks, not just the general idea that your data needs to be protected.
And, if you own a $ 100 horse, upgrade your $ 10 fence.
The horse analogy is interesting. I’d just revise it to say that most organizations have $100 horse and have spent $1 on their fence or less. I think we’d make some headway if they upgraded from the fence put together with leftover scraps and invested in the $10 fence.