Customer Data Theft a Growing Threat to US Health Insurance Industry

The theft of customer data by cyber criminals is a growing threat to US health insurers and the related third parties with which they do business, according to Fitch Ratings.

The industry is facing growing cyber-security risks due to the increasingly sophisticated techniques used by cyber criminals amid the expansion of remote healthcare delivery and growing digitization of insurance transactions, clinical records, and billing, Fitch said in a Fitch Wire article titled "Cyber Theft of Customer Data a Growing Risk for US Health Insurers."

"Health insurers and related third parties that fail to inventory and protect sensitive customer information face increased financial, reputational, operational, and regulatory risks from cyber attacks," Fitch Ratings said in the June 29, 2021, article.

The sensitive data health insurers handle when processing benefit claims or uploading patient information is protected by various laws such as the US Health Insurance Portability and Accountability Act of 1996 (HIPAA), the rating agency noted. But the possession of that data makes insurers a popular target for phishing, ransomware, or man-in-the-middle attacks, Fitch said.

Provider networks are susceptible to breaches, with the risk increasing as more providers and their employees are working remotely, according to Fitch. While the pandemic-driven increase in the use of remote healthcare services has improved access to care, the increased reliance on technology has also heightened exposure to risks that might be associated with third-party software systems and vendors, the rating agency said.

Fitch noted that insurance claims related to ransomware attacks have increased significantly, prompting cyber insurers to raise premiums and change terms and conditions, including increasing deductibles and lowering coverage. Price increases for cyber coverage have accelerated over the past 2 years, Fitch said.