Discussing data security and telehealth during the COVID-19 pandemic

In a recent correspondence, the researcher highlighted the outsized role of online tools in promoting public health, especially during this time of the pandemic.¹ Despite the various policies from the government in a bid to contain the virus, many health care industries in the developing world have been disrupted.

One of the sectors that have grown in response to this global health crisis is the telehealth industry. The World Health Organization considers telehealth as synonymous with telemedicine. The role of the delivery of health care services through health care professions utilizes the information technologies to diagnose, treat and prevent a myriad of diseases, educating health care providers and advancing individual and community health.² Its role in decreasing infection by facilitating physical distancing and the ‘forced’ adoption of various telehealth measures have made the discussion on its present and future role much more important for public health.

Given the worrying trend of increasing ransomware attacks on the health care sector, the adoption of telehealth must be cautious. Tenable, one of the biggest cybersecurity firms in the world, disclosed in its January–October 2020 report that more than 22 billion records have been exposed to 700 publicly disclosed data breaches. As the health care sector is the most affected, health infrastructure has a much critical role to play. The greater demand in health care services, especially remote ones, created multiple entry points like contact-tracing apps, providing medical data to research facilities and improve medical manufacturing for malicious actors to disrupt.³

These hackers begin to increase their attacks on the health care sector for a variety of reasons: one, the lucrative black market selling of personal health information (PHI). This is defined as data, such as medical identification numbers, health insurance, mental health records and admission and discharge dates, that are more specific and cannot be changed.⁴ Second, the personally identifiable information (PII). This includes credit cards and government ID numbers that can sell for $1–2, while PHI can sell for $363. These are used by criminals to defraud and scam victims. They produce counterfeit insurance claims and illegally obtain access to medicines that they otherwise would not get.⁵ IBM Security already has reported that the health care industry has the highest average cost of $7.13 million data breach in 2020 that increases more than that of the global average⁶ and was believed to continue to rise in the future.⁷

In the Philippines context, analysis from cybersecurity firm Kaspersky in 2019 shows that the country ‘had the most number of infected medical devices in Southeast Asia’.⁸ This shows the severity of the issue, and the Philippines government has attempted to address by allocating more than P1 billion for cybersecurity for 2021.⁹ The local data showed no rise in the average percentage of IT budgets spent on the cybersecurity, from local firms.¹⁰ A multi-sectoral framework could be proposed to mitigate cybersecurity risk, especially for health care firms, and establishing a culture of security should be the first step for health care companies seeking to protect their data from malicious actors.¹¹

John Christopher M. Camarines, Alumnus

Conflict of Interest

The author declares no conflict of interest in this paper.