Healthcare Payment Security Is Your Patient s Card Data Exposed? May 24, 2016

Transcription

1 Healthcare Payment Security Is Your Patient s Card Data Exposed? May 24, 2016

2 PRESENTER BIOS Michael Fidler Vice President Elavon Healthcare Payment Solutions Michael D. Fidler is Vice President, Healthcare Payment Solutions at Elavon. With over 17 years of business development experience in the payment industry, Mike has become a trusted advisor for healthcare providers and payers who are seeking ways to make payment processing more efficient and less costly. Leveraging his experience and knowledge of payment industry trends, leading-edge technology solutions and revenue cycle management, he helps clients to drive more payment volume - resulting in increasing revenues while reducing processing costs and expenses. Mike graduated from Iowa State University and currently lives in Colorado. 2

3 PRESENTER BIOS Kim O Connor Vice President Elavon Payment Security Solutions Kim is Vice President of Payment Security Solutions at Elavon, Inc. She has been in the payments industry for 20 years in product management, product marketing and market development roles. Kim has been at Elavon for over 3 years focused on new product innovation initiatives. She is currently responsible for product strategy for Elavon s Security Solutions and industry-leading gateway. During her tenure at Elavon she has led the successful launch of EMV terminals and accelerated the expansion of security products such as encryption and tokenization that help remove cardholder data from merchant systems. Kim holds an MBA from Florida Atlantic University in Boca Raton, FL and resides in South Florida. 3

4 PRESENTER BIOS Tony Hansen Senior Security Consultant Providence Health & Services Tony Hansen, Senior Security Consultant, is the Payment Card Industry Internal Security Assessor (PCI ISA) for Providence. He architects payment solutions to reduce PCI scope for diverse lines of business including hospitals, clinics, pharmacies, foundations, cafeterias, gift shops, child care centers, parking garages, CME registration and online bill pay systems. He also serves as the liaison to banks and card brands for PCI DSS compliance. Tony has over 15 years experience as a security practitioner and he is a Certified Information Systems Security Professional (CISSP), Project Management Professional (PMP) and Payment Card Industry Professional (PCIP). He graduated from Lewis & Clark College and resides in Oregon. 4

5 TODAY S AGENDA Payment Security: Prevention is the Answer Healthcare Payment Trends Healthcare Vulnerabilities PCI Compliance Layered approach to Security EMV Who s Liable and When Encryption and Tokenization Providence Health & Services Payment Strategy 5

6 BREACH IS A GROWING EPIDEMIC No healthcare organization is immune from data breach 45% 40% 35% 30% 25% 20% 15% 10% Healthcare Organizations Suffering a Breach in the last 24 months What are the Hackers After? 2014 Compromises by Data Type Other Monthly Statements Prescription Details Scheduling Details Payment Details Billing/Insurance Record 5% 0% Medical File 5+ Breaches 2-5 Breaches 1-2 Breaches No Breahces 0% 10% 20% 30% 40% 50% 60% Average cost of breach for healthcare organizations estimated $2.1 million or more. Ponemon Institute, 5 th Annual Benchmark Study on Privacy & Security of Healthcare Data,

7 ARE YOU PREPARED? 7

8 WHO ARE THE PERPETRATORS? The Culprits External Foreign Governments Activist/Hacktivist groups Organized crime Lone hackers Terrorists Internal Staff Contractors Vendors/Suppliers Ponemon Institute, 5 th Annual Benchmark Study on Privacy & Security of Healthcare Data, in 3 Predicted number of healthcare recipients who will fall victim of a healthcare data breach in

9 9 HEALTHCARE VULNERABILITIES

10 OVERVIEW OF VULNERABILITIES Around 80% of data breaches are perpetrated by external actors* Point of Sale (Care) Web Application Attacks Crimeware (Malware) 10 *Source: Verizon Data Breach Incident Report, 2015

11 CARD DATA VULNERABILITIES Not New and It Can Happen to You Any organization that accepts card payments via a Point of Sale (POS) device is a potential target. Card not present environments (e-commerce) under increased attack with the implementation of EMV. PCI DSS compliance may not be enough. Compliance is a baseline; it does not necessarily equal comprehensive security. PCI DSS - Payment Card Industry Data Security Standards Security standards for organizations that accept major credit cards including Visa, MasterCard, American Express, Discover, JCB and China Union Pay 11

12 LAYERED PAYMENT SECURITY SYSTEMS ARE THE BEST PROTECTION AGAINST SOPHISTICATED ATTACKS 12 12

13 13 PCI DSS

14 PCI IS BASELINE SECURITY And it is a continuous process It goes beyond technologies to include policies and procedures for: securing physical assets (laptops, mobile devices) securing physical environments (offices, vehicles) employee access (strong passwords, need to know) and more. 14

15 PCI PROVIDES A POLICY FRAMEWORK PCI DSS Requirements PCI DSS is a set of requirements that ALL organizations accepting payment cards must follow. PCI DSS encompasses EVERY aspect of an organization s cardholder data environment including employee training documented policies physical security online security PCI requirements provide a policy framework for securing card payments. PCI DSS Payment Card Industry Data Security Standards 15

16 WHERE IS YOUR CARD DATA IS LOCATED? 3 OUT OF 5 Card Data Environment improperly scoped contributing to compromises YOU MAY NOT REALIZE YOU STORE CARD DATA Most common places credit card data ( ) hides: EMPLOYEE MOBILE DEVICES NETWORK FINANCE CARD DATA ENVIRONMENT 61% 61% Scans revealing unencrypted card storage ADMINISTRATIVE MARKETING CUSTOMER SERVICE PATIENT ACCESS PATIENT BILLING *Source: SecurityMetrics, Intographic: The Danger of Storing Card Data,

17 WHAT IS YOUR CARD DATA ENVIRONMENT (CDE)? Any system that touches card data Terminals/Mobile payment devices Internal systems (e.g. servers, databases) Department End Users (e.g. Finance, Accounting, Billing, Customer Care, etc.) TRANSMIT TRANSMIT PROCESS AND/OR STORED STORED STORED 17

18 18 LAYERED APPROACH TO SECURITY

19 LAYERED APPROACH TO SECURITY 19

20 HOW CAN WE PROTECT PAYMENT DATA The Security Toolbox EMV Encryption Tokenization PCI DSS Compliance Your Security Foundation The toolbox must be accompanied by business practices and processes designed to reduce exposure and control risk. 20

21 21 EMV

22 EMV WHAT IT IS AND WHAT IT IS NOT EMV will: Prevent counterfeit fraud at the point of sale Protect against counterfeiting cards EMV will not: Protect against card-not-present fraud Prevent data breaches Create a different point-of-sale experience ( dip vs swipe ) Store cardholder data on a chip Require a new card with an embedded chip See growing adoption in the U.S. through 2016 and beyond Always require a PIN Be vulnerable to wireless interception of data Eliminate the need for magnetic stripe Be universally adopted in the U.S. for at least 3-4 years 22

23 EMV REDUCES CARD PRESENT FRAUD CARD AUTHENTICATION 23

24 ... BUT NOT CARD NOT PRESENT FRAUD Source: AITE Group, EMV: Lessons Learned and the U.S. Outlook, October 11,

25 WHO IS LIABLE WHEN? Provider Issuer Provider is Ready AND Issuer Issued Chip Card Provider is Not Ready AND Issuer Issued Chip Card Provider is Ready OR Not Ready AND Issuer Did Not Issue Chip Card 25 25

26 26 ENCRYPTION & TOKENIZATION

27 ENCRYPTION BENEFITS Protects Data In Transit Encrypts data before it enters POS/network Potentially reduces PCI scope Card data remains encrypted until it reaches the payment processor Encryption No POS or message format changes required EMV devices with encryption technology secure cardholder data at the point of swipe, tap or dip 27

28 TOKENIZATION BENEFITS Protects Data in Use & at Rest Eliminates need to store card data Potential liability greatly reduced Supports business processes Can be stored and used indefinitely Tokenization 28

29 ENCRYPTION/TOKENIZATION DATA FLOW Card Entry 1) Enter Original card number Secure Data Center and Token Vault 29

30 ENCRYPTION/TOKENIZATION DATA FLOW Encryption protection for data in-use and in-transit 1) Enter Original card number 2) Encrypt card number Secure Data Center and Token Vault 30

31 ENCRYPTION/TOKENIZATION DATA FLOW Tokenization protection for data at rest 1) Enter Original card number 2) Encrypt card number 3) Return Token number Secure Data Center and Token Vault 31

32 A COMPREHENSIVE SECURITY STRATEGY Business practices, security controls and processes designed to reduce exposure and control risk. EMV Encryption Tokenization PCI DSS Compliance Your Security Foundation 32

33 33 PROVIDENCE HEALTH & SERVICES

34 PROVIDENCE HEALTH & SERVICES Overview Third largest not-for-profit health system in the United States Providing care in 5 states Alaska, California, Montana, Oregon and Washington System office located in Renton, Washington Employs over 82,000 caregivers Facilities include hospitals, physician clinics, long-term care facilities, hospice & home health care services and retail operations A tradition of caring for over 160 years 34

35 PAYMENT SECURITY STRATEGY Goals & Requirements Fewer banking relationships Payment solution that integrates with EHR system Secure and compliant solutions Positive consumer payment experience Reduced scope of card data environment 35

36 INTEGRATED EHR AND PAYMENT SYSTEMS Reducing compliance through integration Epic selected as EHR system in 2009 Card acceptance via a payment solution that integrated with Epic Keeps card data out of EHR system Removed nearly 3000 workstations from scope 36 Internal Use Only

37 OUR PAYMENT SOLUTION Simplifies and secures payments Implemented point-to-point encryption solution Eliminates card data from ever entering or crossing our network Eliminates card data from ever being stored on our network Helps reduces PCI scope, saving millions in investment for network segmentation Fully PCI compliant solution 37

38 Payment security EMV AND NFC Upgrading devices Use risk based modeling to guide planning Focus on higher risk retail operations first Least susceptible Ensure EMV devices include encryption technology Consider EMV devices with NFC capabilities Most susceptible 38

39 QUESTIONS Contact Us Michael Fidler Tony Hansen 39