In recent years, exposure of healthcare data pertaining to minors has increasingly been brought to light due to the recent public disclosure of the Physicians to Children and Adolescents Data Breach. While healthcare data breaches continue to become more commonplace, breaches involving providers who treat minors will have a much more extensive impact than just short-term financial crimes, or disruptions to their business operations.

Children's Health Care Data Has An Extended Period Of Vulnerability

Compared to adults, pediatric healthcare data typically contains some of the longest-lasting types of personal data on the market. The nature of the healthcare data relating to a minor means that, for the foreseeable future, many of these children will not have any financial relationships with banks, credit reporting agencies, or insurance companies. The personal identifiers and history of the child may remain in storage from their date of birth. The potential to misuse this type of information may continue well into the child's adult years.

The medical records created for a minor will often contain an SSN, medical insurance ID, a diagnostic/prognostic history, and often a history of treatments/medical procedures performed and/or imaging results produced during the treatment of the minor. Because there are typically no mechanisms for the affected individual to monitor the use of this medical data, misuse may go unnoticed for quite a significant amount of time, thereby increasing the risk of long-term damage to the child because of this information.

Reasons for Targeting Pediatric Clinics

Although they may not seem like a target for cyber-attacks, pediatric clinics can be viewed as a high-value target for hackers. Many small healthcare facilities also lack the necessary cybersecurity resources (many have older electronic record systems) and have a less rigorous internal structure than larger hospital networks.

Hackers look for opportunities to take advantage of weaknesses in current security procedures, such as:

• Lack of restrictions on how employees access sensitive information;
• Risk of unintentional access through phishing attacks via employee email accounts;
• Use of third-party vendors who provide services to the clinic; and
• Limited monitoring of security breaches resulting in empty shelves.

All this results in a environment where sensitive personal data may be supported by a system and infrastructure that do not lend themselves to being able to withstand many of today’s threats to security.

Privacy Issues Beyond Identity Theft

Identity theft may be the most talked-about effect of a data breach, but many other privacy issues arise when paediatric healthcare is compromised. When patient confidentiality has been compromised, it means that information contained within a patient's medical record could include behavioural health concerns, assessments about developmental stages, prescribing information, and even family history. Once this information is disclosed to an outside party, it cannot be changed or deleted.

As the child reaches adulthood, compromised medical records may affect the way that medical insurance is obtained, how employment screening is conducted, and how they may or may not choose to disclose their medical history to future employers, potential partners, etc. Thus, when a breach occurs, it may represent not just a breach of security, but also a permanent loss of the individual's right to the privacy of their medical information.

Oversight and Gaps in Regulations

Healthcare providers are subject to federal and state laws that protect patient data (PHI) from being disclosed to others except for very specific purposes and with consent from the patient (or guardian for patients under 18 years of age). Due to the fact that minors are the patients being served, paediatric healthcare providers tend to come under stricter regulatory scrutiny than adults.

However, compliance with regulations does not inherently result in the prevention of incidents of breaches/incidents/accidents. Although many breaches occur despite the presence of formal policies and training requirements, the contributing factors are often overlooked, whether it is a result of a vulnerable information system or a human error. The majority of regulatory action taken is retrospective and, thus, does not address the lack of prevention and accountability associated with breaches.

Legal Issues and Consumer Education

Families whose children have been affected by cybersecurity breaches experienced while using their pediatric health information are looking for answers regarding what they could have done differently as well as what will happen next.

Need for Increased Preventative Measures

Cybersecurity experts are in agreement about the need for stronger levels of protection for pediatric healthcare organizations due to the sensitivity and longevity of data stored by such organizations (e.g., electronic health records). As time passes, organizations must evolve their cyber defenses to meet the demands of this ever-changing environment. At this point, it is widely accepted within the industry that pediatric healthcare organizations must implement adequate security controls as well as develop a culture of cybersecurity.

In the end, protecting the privacy of a child's medical information requires more than simply performing the minimum necessary for regulatory compliance. In addition, organizations must recognize that any type of breach involving a minor has a significant long-term impact on that child.