Future IT Workers Would Sell Patient Data

Budding IT insiders can be corrupted into giving up protected health information, say university researchers who also found a correlation between an interest in white hat hacking and a propensity for conducting illegal breaches.

See Also: AI Tool Data Exposure Risks Drive Need for Stronger Controls

A survey of 523 information systems management and data analytics students by the State University of New York at Buffalo found that nearly 60% of respondents said they would leak information about a very famous patient in exchange for amounts ranging from less than $10,000 to more than $10 million, depending on the perceived probability of getting caught and the salary level of the employee.

Students were told to imagine themselves having post-college financial difficulty and a friend who works at a media company. Roughly six out of every 10 students said they would give up the data of the famous patient. The amount required varied on the scenario, with students told to imagine a greater salary needing a bigger payoff.

Students with a self-professed interest in white hat hacking had a statistically significant need for less money to cough up the famous patient’s data, researchers said.

The research also found correlations between interest in white hat hacking and willingness to engage in black hat or gray hat activities, so long as students received assurances that they wouldn’t be caught.

Researchers didn’t assess whether students possessed the skills necessary to illegally hack, telling them to assume that they do. They defined a black hat as someone willing to digitally steal money and a gray hat as someone who might hack a company that supports a political candidate the student doesn’t like or hacking the social media account of an extremist.

“Insider cybersecurity threats are driven as much by economic and behavioral factors as by technology,” said Lawrence Sanders, a professor emeritus at the University of Buffalo’s department of management science and systems, and one of the researchers involved in the study.

The research builds upon a 2020 study involving 523 students with an average age of 21 who were about to enter the workforce. That earlier survey found 46% of respondents would accept a certain amount of money in exchange for violating HIPAA, also depending upon the circumstances.

In that study, 79% of respondents said they would hand over a politician’s medical records to a media outlet in exchange for $100,000 in order to pay for an experimental medical treatment for their mother that was not being covered by insurance.

Some experts called the research findings unsettling.

“On a macro level, it shows two disturbing items: a lack of respect for another person’s sensitive information; and a moral compass that is off-track,” said regulatory attorney Rachel Rose.

“From a bioethics perspective, patient autonomy and the related right to privacy are very valued and a cornerstone of trust in the medical system,” she said.

Sanders advised medical practices to conduct background screenings. “Controls and monitoring can also help,” he said.

Background checks on prospective workers only go so far, Rose said. Healthcare entities must take measures – including technical, administrative and physical to help prevent the likelihood of these types of insider incidents, Rose said.

Workforce training that illustrates potential consequences of malicious behavior is critical, she said. “Emphasize criminal penalties and provide actual examples as part of training and throughout the year as part of continuing security and privacy awareness,” she suggested.

Sanders encouraged employers “to work closely with employees and support them when they have financial difficulties or are under stress for whatever reason,” to help mitigate potential insider breaches.