Social media has taken the world by storm, but there are many instances when it has been used inappropriately to abuse privacy. Hospitals, especially, are in danger of this – the privacy levels required in a hospital are high and social media breaks down all barriers of privacy. Social websites like Facebook and Twitter, video websites like YouTube and even blogs have made it easy to pass on information, and since there is no one policing the information, boundaries are crossed easily. The HIPAA Security Rule can be easily broken. Social media security has become very important. Information Security policies are required for HIPAA risk requirements.
Imagine a situation where someone is ill and has to stay in the hospital for a few days. Or where someone is diagnosed with something that people treat as particularly embarrassing, or that holds the threat of death. All it takes is for one person to post a message or a picture taken in the hospital of the patient, and in minutes, the whole world will be able to access the information. If malicious things are said about this patient and they get to hear about it, it might harm their health further. A HIPAA security assessment would be required after such a data breach.
Hospital employees in particular need to be extra careful, because they can easily break the HIPAA Security Rules and get into legal trouble. Blogs where hospital employees meet are a great idea for them to discuss their work, but these same blogs can easily cross boundaries and find themselves discussing a particular patient. The hospital employee can be fired and sued. The hospital itself is in particular danger of being sued.
Social media has changed the way we communicate but we need to know when it’s appropriate and when it is not. In hospitals, in can be especially damaging if used in the wrong way. To stay out of trouble, hospitals need to have a clear policy on social media and how their employees use it and have consistent HIPAA risk assessments.
|Skirmish||Home users receiving spam and phishing attacks and scams||Corporate users seeing more phishing attacks, attackers going through Linkedin profiles|
|Protest Actions||Users might complain to attorney generals, or write nasty messages about Microsoft Adobe or Apple security weaknesses||The IT department is inundated with help desk calls. Companies have the ability to complain to ISPs or event countries about originating attacks.|
|Negotiations||There really isn’t anyone to negotiate with. Writing on your Facebook wall will not do a darn thing.||Companies definitely do not want to negotiate. But will see blackmail more and more.|
|Failed Negotiations||The home user is bascially screwed anyway.||Succumbing to blackmail will only lead down a bad path.|
|Declaration of War||This is a defacto state with the home user. They are at war whether they know it or not.||Companies have to take a proactive approach to security versus reactive. Anticipate the next types of attacks and have a budget to address it.|
|Launch Attacks and Defend||More defend, get your anti-spyware, antivirus, personal firewalls and encryption up to speed. But after that, understand how attackers use Social Media.||Spend massive amounts of money on understanding how so fight in the Social media landscape, security hardware and software are not enough.|
|Allies Join the War||The home user can only rely on the Social media companies for basic security.||Their will be more collaboration between companies and governments. Perhaps together they have a fighting chance. Regulations are also going to force changes.|
|Years of Conflict – Never Ending||Whats the next thing after Facebook and Twitter? Whatever it is will have its own security challenges. But by that time the home user will probably have given out every bit of personal information on all the Social Media venues anyway.||A company can only rely on the right process to secure their social media usage. As technologies change and new sites go live, a good process and social media security policy is all you can rely on.|
|Winner||The ISP, they get to sell bandwidth.||The VCs who fund companies like Facebook and Twitter.|