For businesses and health care institutions, the threat of cyberfraud is on the rise, unleashing fierce competition among law firms and consultants seeking to advise them.
Medical records are especially ripe targets because fraudsters can milk the full value of a health-insurance policy.
But, for all the high-tech and legal firepower available, some experts say the best protection may be better training of employees.
As the threat rises, so has the number of lawyers making it a specialty. Most large firms have practice groups devoted to data security, and so do many smaller ones, fueling the competition.
It has grown exponentially in the past five years, and the landscape has become quite competitive, said Scott Vernick, a partner at Fox Rothschild who focuses on privacy, data security, and litigation. When I started doing this 10 years ago, I had trouble convincing people that this was something to pay attention to.
Today, any self-respecting firm has a group.
A series of high-profile data breaches notably the huge loss of records by Target and the attack by North Korean hackers on Sony, exposing sensitive internal emails have raised awareness. Forty-seven states now have laws requiring that customers be notified when breaches occur, and setting standards to protect data.
Its easy to see why. California, with the nations toughest data-security laws, says about 49 million digital records in the state have been improperly accessed or disclosed since 2012.
The pace seems to be accelerating. Nearly half those data breaches occurred in 2015, according to state Attorney General Kamala Harris.
For any entity that stores confidential customer data, the cost of a breach can be enormous. Jordan Rand, a lawyer at Dilworth Paxson in Philadelphia who focuses on data breaches and related insurance disputes, estimates that companies pay on average $300 for every record compromised. Thats the cost of detection, notification of consumers, restoration of records, legal representation, and other actions.
That high cost has spawned a new market in insurance coverage for companies looking to protect themselves.
Rand works with Reclamere, a firm near State College, Pa., that helps companies protect their computer systems from breaches and gives assistance if hackers have gained access.
CEO Angie Singer Keating said she often focused on helping health care institutions secure sensitive patient data. Reclamere also works with such law firms as Dilworth when a data breach leads to litigation.
Health care records are particularly vulnerable because hospitals, physician practice groups, and other providers are not as far along as financial-services companies in securing data and because health-care records are so valuable, experts say. A typical patient file might include not only Social Security numbers, but also credit-card and health-insurance information, and confidential medical records.
Once I have your medical identity, I can do almost anything, Keating said. I can get prescription drugs in your name, if I am part of a fraudulent Medicare or Medicaid scheme. I can submit fraudulent claims, and I can sell your identity.
For patients, the consequences can be catastrophic. Fraudsters have used stolen health-insurance policies to pile on charges up to their lifetime caps.
Meanwhile, health records can be corrupted with the health information of a cyberthief, potentially endangering the real policyholder.
Breaches often involve sophisticated hacking techniques that, because they change frequently. are hard to stop. But Sandra Jeskie, a partner at Duane Morris, who focuses on litigation involving disputes over software and data breaches, said companies also are vulnerable to low-tech fraud.
Typical are computer criminals posing as bank executives or company leaders asking lower-level employees for sensitive data, such as credit card numbers.
All too often, she said, employees with legitimate access to the data are too willing to turn it over.
Many attacks start with phone calls. Employees can learn to report red flags, follow procedures, and avoid opening attachments that can introduce malware.
A lot of protection is actually training, said Jeskie, who worked as a computer scientist before obtaining her law degree. Its not just a matter of throwing money at a firewall.