Is Your Lab Doing Enough to Protect Its Data? Or, Is Your Patients’ and Employees’ Personal Information Exposed?
Laboratory Consulting Team Lead – Timothy E. Allen | Former Special Agent (U.S. Secret Service & DOJ-OIG)
In today’s world, all laboratories need to have robust cybersecurity programs. This does not necessarily mean that your lab’s security protocols need to be on par with those of major companies or government agencies, but it does mean that your lab needs to take appropriate measures to ensure that its patients’ and employees’ personal information is secure.
But, how do you do this? How do you know if your laboratory’s cybersecurity program is lacking, and how do you know when enough is enough? These are not easy questions to answer, and answering them correctly requires the insights and expertise of experienced cybersecurity specialists.
Former Senior Federal Agents Specializing in Cybersecurity in the Health Care Sector
At Corporate Investigation Consulting, our cybersecurity specialists have decades of experience working in both the public and private sectors. This includes experience specifically working with laboratories and other healthcare entities. Our cybersecurity specialists previously served in senior positions with the U.S. Secret Service, Federal Bureau of Investigation (FBI), and other federal agencies, and this background affords the ability to provide deep insights and custom-tailored cybersecurity recommendations focused on both legal compliance and risk management.
No two laboratories’ cybersecurity needs are exactly alike. This is true from both the legal and practical perspectives. Generally speaking, laboratories (and other companies) must develop cybersecurity programs that are suited to their size, risks, and financial resources. As a result, while not all laboratories are necessarily held to the same standards, all laboratories must still do what they reasonably can in order to protect their patients’ and employees’ data.
While this provides flexibility, it also presents a challenge: What should your laboratory be doing in terms of cybersecurity. Since there is no single “right” answer, deciding what to do requires the advice and insights of experienced cybersecurity professionals.
Put our highly experienced team on your side
Roger Bach
Former Special Agent (OIG)
Timothy E. Allen
Former Senior Special Agent U.S. Secret Service
Chris J. Quick
Former Special Agent (FBI & IRS-CI)
Maura Kelley
Former Special Agent (FBI)
Ray Yuen
Former Supervisory Special Agent (FBI)
Michael S. Koslow
Former Supervisory Special Agent (DOD-OIG)
Marquis D. Pickett
Special Agent U.S. Secret Service (ret.)
We Develop Custom-Tailored Cybersecurity Programs for Labs of All Types and Sizes
Given that there is no one-size-fits all cybersecurity solution for laboratories, customization is extremely important. We take this into account when developing cybersecurity programs for our clients. We assess each laboratory’s specific needs and capabilities, and then we provide suitable and attainable cybersecurity recommendations that reflect our client’s risks, duties, and constraints.
An effective laboratory cybersecurity program will have many different facets, and it will address all potential sources of malicious intrusion. Some examples of the applications, protocols, policies, and procedures we help laboratories implement include:
- Firewalls
- Anti-spyware and malware applications
- Password security protocols
- Physical access controls
- Network security protections
- End-user (i.e. employee) compliance
- Penetration testing
In addition to these elements (among others), another key aspect of cybersecurity management and compliance is internal auditing. Internal audits can be used to both (i) assess the sufficiency of a laboratory’s cybersecurity program on an ongoing basis, and (ii) identify specific risks and respond to malicious attacks.
Beyond consulting with laboratories with regard to cybersecurity program development and implementation, we provide assistance with breach response and notification as well. If your laboratory’s firewall has been breached, we can guide you step-by-step through what you need to do in order to comply with the law and mitigate the risk of your lab facing civil lawsuits and/or law enforcement action.
FAQs: Cybersecurity in the Laboratory Setting
Q: How can I determine if my laboratory’s current cybersecurity program is adequate?
Assessing the adequacy of your laboratory’s current cybersecurity program requires a comprehensive internal audit. It will be necessary to examine not only the elements of the program itself, but also any areas that fall outside of the program’s current scope. Once you have a comprehensive understanding of the risks your lab needs to protect against, then you can determine whether (and to what extent) any updates to your lab’s cybersecurity program may be necessary.
Q: Why shouldn’t I just purchase an on-the-shelf cybersecurity solution for my laboratory?
Off-the-shelf cybersecurity solutions are not designed with any one company’s risks or needs in mind. As a result, they are insufficient in the vast majority of cases—and particularly for entities that store significant amounts of personal, financial, and health data. Laboratories need to adopt custom-tailored cybersecurity programs that address their particular risks, legal obligations, and financial capabilities.
Q: How can I make sure my laboratory’s cybersecurity protocols remain up-to-date and protect against new threats?
This is a key concern, as cybersecurity threats are constantly evolving. At Corporate Investigation Consulting, our specialists remain current on new developments in the cybersecurity field, and we advise our clients as to when program updates and modifications are necessary.
Q: What do I need to do if my laboratory’s computer system has been hacked?
If your laboratory has experienced a cybersecurity breach, you must take appropriate responsive action right away. Most immediately, this involves identifying the source of the intrusion and determining what data have been compromised. Your laboratory may have breach notification obligations as well, and you will need to ensure full legal compliance in order to mitigate your lab’s liability risk.
Q: Why should I choose Corporate Investigation Consulting for cybersecurity consulting and internal auditing?
At Corporate Investigation Consulting, we offer extensive experience not only in cybersecurity, but also in the health care sector. Our cybersecurity specialists and consultants have backgrounds including prior careers with the U.S. Secret Service, FBI, U.S. Department of Health and Human Services (DHHS), U.S. Department of Justice (DOJ), and other agencies. We understand laboratories’ obligations and risks from all angles, and we know what it takes for laboratories to protect their data and avoid federal scrutiny.
Schedule an Appointment with a Senior Cybersecurity Specialist Today
Do you have questions about laboratory cybersecurity? Has your laboratory experienced a cybersecurity breach? If so, we encourage you to speak with one of our senior cybersecurity specialists in confidence. To schedule an appointment at Corporate Investigation Consulting as soon as possible, please call 866-352-9324 or tell us what we can do to help online now.