Protected Health Information
Protected Health Information (PHI) is a core concept in cybersecurity, particularly in the healthcare sector. It refers to any individually identifiable health information that is created, received, stored, or transmitted by a HIPAA-covered entity or its business associate.
In the context of cybersecurity, PHI is a high-value target for threat actors because it contains a wide range of sensitive data. It is more than just medical records; it combines an individual's health information with their personally identifiable information (PII). This makes it valuable for identity theft, fraud, and extortion. For cybercriminals, PHI can be more beneficial than financial data.
The Health Insurance Portability and Accountability Act (HIPAA) and its Privacy and Security Rules mandate strict security measures to protect PHI, especially in its electronic form, known as ePHI. The goal is to ensure the confidentiality, integrity, and availability of this sensitive data.
What Constitutes Protected Health Information?
Protected Health Information is any information that relates to an individual's past, present, or future physical or mental health, the provision of healthcare to the individual, or the past, present, or future payment for healthcare. This information becomes PHI when it is tied to one of 18 specific identifiers.
These identifiers include, but are not limited to:
Demographic Information: Names, addresses, dates (like birthdate or admission date), phone numbers, and email addresses.
Medical Information: Medical record numbers, health plan beneficiary numbers, diagnoses, test results, and treatment records.
Other Identifiers: Social Security numbers, account numbers, license numbers, vehicle identifiers, device serial numbers, and biometric data (like fingerprints).
It is important to note that if any of this information is de-identified—meaning all 18 identifiers are removed so that it cannot be linked back to a specific person—it is no longer considered PHI and is not subject to HIPAA regulations.
The Cybersecurity Context
The HIPAA Security Rule defines the role of cybersecurity in protecting PHI. This rule requires covered entities and their business associates to implement administrative, physical, and technical safeguards to protect the confidentiality, integrity, and security of ePHI.
Confidentiality: Preventing unauthorized access or disclosure of ePHI. This often involves encryption, access controls, and multi-factor authentication.
Integrity: Ensuring that ePHI is not altered or destroyed in an unauthorized manner. Mechanisms such as data integrity checks and audit logs are crucial here.
Availability: Ensuring that authorized individuals can access ePHI when needed. This includes having robust backup and disaster recovery plans to recover data in the event of a security incident.
The cybersecurity challenge lies in protecting PHI across its entire lifecycle—from creation and storage to transmission and disposal—and across all devices, including on-premise servers, cloud environments, mobile devices, and wearables.
ThreatNG helps protect Protected Health Information (PHI) by focusing on external vulnerabilities that attackers can use to compromise healthcare systems. It achieves this through a multi-faceted approach that includes external discovery, detailed assessments, specialized investigation modules, continuous monitoring, and intelligence repositories. The platform is designed to provide a comprehensive view of an organization's security posture from an attacker's perspective, which is crucial for protecting PHI and achieving HIPAA compliance.
External Discovery and Assessment
ThreatNG performs a purely external, unauthenticated discovery, meaning it scans an organization’s digital footprint without needing any internal credentials or connectors. This process identifies assets and vulnerabilities, like how a real attacker would.
ThreatNG's External Assessment capabilities identify a range of vulnerabilities that could expose PHI and lead to HIPAA violations:
Subdomain Takeover Susceptibility: ThreatNG analyzes a website's subdomains, DNS records, and SSL certificate statuses to find vulnerabilities that could allow an attacker to hijack a domain. A subdomain takeover can be used to serve malicious content or impersonate an organization to steal credentials and compromise electronic protected health information (ePHI).
Web Application Hijack Susceptibility: ThreatNG analyzes parts of a web application that are accessible from the outside world to find potential entry points for attackers.
Data Leak Susceptibility: The platform assesses an organization's exposure to sources such as cloud and SaaS vulnerabilities, dark web presence, and lawsuits to determine its susceptibility to data leaks. This includes searching for exposed ePHI in open cloud buckets, which constitutes a direct violation of HIPAA access controls.
BEC & Phishing Susceptibility: This capability utilizes domain, email, and dark web intelligence to identify risks, such as compromised credentials, which pose a direct threat to the confidentiality and integrity of ePHI and can lead to data breaches.
Cloud and SaaS Exposure: The platform evaluates cloud services and Software-as-a-Service (SaaS) solutions, and can discover open exposed cloud buckets that may contain ePHI. This is a critical risk vector that needs to be included in risk assessments.
Investigation Modules and Intelligence Repositories
ThreatNG's Investigation Modules and Intelligence Repositories provide the deep, contextual data needed to understand and address PHI-related risks.
Sensitive Code Exposure: This module discovers public code repositories and mobile apps that may contain sensitive data. For example, it can identify exposed AWS access keys or API tokens, which an attacker could exploit to gain unauthorized access to cloud environments containing ePHI. Finding sensitive information in public repositories is directly relevant to HIPAA's requirements for risk management, access control, and incident response. This may indicate a need for enhanced workforce security training.
Domain Intelligence: This module covers aspects such as certificates, subdomain headers, vulnerabilities, and exposed sensitive ports to assess cyber risk exposure. It can also identify domain name permutations that could be used for phishing attacks, which pose a risk to ePHI.
DarCache Dark Web: This repository tracks mentions of an organization, compromised credentials, and ransomware events on the dark web. The presence of compromised credentials poses a direct threat to ePHI, compromising access controls and necessitating an immediate incident response.
DarCache Ransomware: This repository tracks the activities and events of ransomware gangs. Ransomware events pose a critical threat to the confidentiality, integrity, and availability of ePHI, and their discovery triggers the need for a formal incident response plan.
DarCache Vulnerability: This repository provides intelligence on vulnerabilities that are actively being exploited (KEV) and the likelihood of future exploitation (EPSS). This helps organizations prioritize fixing critical vulnerabilities on subdomains that could be exploited to gain unauthorized access to systems, exfiltrate electronic protected health information (ePHI), or disrupt healthcare services.
Reporting and Continuous Monitoring
ThreatNG offers continuous monitoring of an organization’s external attack surface, digital risk, and security ratings. This is essential for HIPAA compliance, which mandates continuous risk management. The platform generates various reports, including an Executive Report, a Technical Report, and a Prioritized Report that categorizes findings as high, medium, low, or informational. It also produces an External GRC Assessment Mappings report, which directly aligns external findings with HIPAA Security Rule requirements. This helps organizations demonstrate their proactive security posture and readiness for audits.
Complementary Solutions
ThreatNG's external focus creates valuable synergies with internal security tools. The platform’s ability to discover external vulnerabilities provides actionable intelligence that complements other solutions, creating a more comprehensive security posture.
Security Information and Event Management (SIEM) Solutions: ThreatNG's discovery of high-consequence external risks, like exposed APIs or admin pages, provides critical context to a SIEM. Suppose the SIEM detects a suspicious login attempt on an exposed admin page. In that case, ThreatNG's data confirms that this entry point was externally visible, allowing security teams to investigate the threat with a complete understanding of the attack vector.
Firewalls: ThreatNG can identify exposed services on non-standard ports or misconfigured public cloud resources. This information can be used by an organization's firewall management solution to create a specific rule that blocks traffic to those ports or restricts access to cloud resources, effectively closing the external attack vector.
Identity and Access Management (IAM) Solutions: When ThreatNG’s DarCache Rupture repository finds compromised credentials on the dark web, this information can be used to automatically trigger a password reset for the affected user's account through the organization's IAM solution. This prevents an attacker from using the leaked credentials to gain unauthorized access to ePHI. The discovery of exposed VPNs also serves as an alert to an IAM solution to enforce stronger authentication, like Multi-Factor Authentication (MFA), for those specific endpoints.
