percent of those suffering intrusions had notified authorities, and most respondents did not have a written policy for network intrusions. A recent estimate by the Defense Information Systems Agency indicated that Pentagon computers suffered 250,000 attacks by intruders in 1995; that this number is doubling each year; and that in about 65 percent of these attacks, intruders were able to gain entry to a computer network.4 A RAND Corporation study of information warfare scenarios in 19955 suggests that terrorists using hacker technologies could wreak havoc in computer-based systems underlying 911 emergency telephone services, electric power distribution networks, banking and securities systems, train services, pipeline systems, information broadcast channels, and other parts of our information infrastructure.

While not specifically describing threats to health care organizations, these reports indicate the growing vulnerability of information systems connected to public infrastructure such as the Internet. As such, they suggest that the drive for increased use of electronic health information (e.g., digital patient records) linked together by modern networking technologies could expose sensitive health information to a variety of threats that will need to be appropriately addressed.

General Taxonomy of Organizational Threats

Organizational threats assume many forms, from employees who access data even though they have no legitimate need to know, to outside attackers who infiltrate an organization's information systems in order to steal data or destroy the system. Each type of threat is characterized by different motives, resources, avenues of accessing information systems, and technical capability. They therefore pose different degrees of risk to an organization and can be addressed with differing types of controls.

Factors Accounting for Differences Among Threats

Motive. Both economic and noneconomic factors can motivate attacks on health information. Patient health records have economic value to insurers, employers, and journalists. Noneconomic motives can include curiosity about the health status of friends, potential romantic involvements,


General Accounting Office. 1996. Information Security: Computer Attacks at Department of Defense Pose Increasing Risks. General Accounting Office, Washington, D.C., May.


Molander, Roger C., Andrew S. Riddile, and Peter A. Wilson. 1996. Strategic Information Warfare: A New Face of War, RAND Report MR-601. RAND Corporation, Santa Monica, Calif.

The National Academies | 500 Fifth St. N.W. | Washington, D.C. 20001
Copyright © National Academy of Sciences. All rights reserved.
Terms of Use and Privacy Statement