The impact of healthcare cybersecurity on SAUDI ARABIAN consumers Accenture 2017 Consumer Survey on Healthcare Cybersecurity and Digital Trust
2 Saudi trust in digital health data security depends on who s guarding it. Saudi consumers trust healthcare organisations to protect their digital data but not tech companies or staff, and certainly not non-medical staff at care facilities. Per an Accenture survey, healthcare consumers believe that healthcare providers are taking measures to protect their digital healthcare data, with half of Saudi consumers believing their healthcare provider has sufficient security and privacy protections. However, nearly nine out of ten Saudi consumers are worried about a breach of their health information and one-third are worried about a breach of their contact information. When it comes to their health data, consumers in Saudi have more confidence in their government (79 percent) than any other country surveyed. To better understand consumer attitudes toward healthcare data, ethics, digital trust, roles and responsibilities, data sharing and breaches, Accenture conducted a survey across seven countries. This report focuses on results from consumers in Saudi Arabia and on cybersecurity and digital trust for health records. By examining digital trust and the impact of breaches, the Saudi government and healthcare organisations can become better prepared to proactively manage risks when dealing with citizens healthcare data and the need to respond proactively in the event of a breach. DIGITAL HEALTHCARE DATA Personal health information that is stored electronically, such as in electronic health records maintained by a person s doctor or healthcare provider, wearable health devices, mobile apps or health insurance records. DIGITAL TRUST The confidence placed in an organisation to collect, store and use the digital information of others in a manner that benefits and protects those to whom the information pertains.
3 Who do Saudi consumers trust with their health data? A significant majority of consumers (79 percent) trust the government and hospitals (76 percent) to keep their digital healthcare data secure. In fact, 41 percent have a great deal of trust in the government with 32 percent trusting hospitals they visit. A high percentage of people trust their physician (75 percent), their pharmacy (74 percent) and labs that process their medical tests (71 percent). Far fewer trust urgent care or walk-in clinics (61 percent) or non-medical staff at their physician s or healthcare provider s office (52 percent) (Figure 1). FIGURE 1. Healthcare consumers have varying degrees of trust in healthcare providers. Government Hospitals I visit My physician(s) or other healthcare providers 7 % 7 % 6 % 14 % 18 % 18 % 37 % 44 % 45 % + 41 % 32 % 31 % 79% 76% 75% 79+F MOST TRUSTED 79 % The government My pharmacy Labs that process my medical tests IT support for my physician s office or other medical site 7 % 6 % 9 % 19 % 23 % 26 % 44 % 44 % 44 % 27 % 22 % 74% 71% 66% 100+F 100+F 52+F LEAST TRUSTED 52 % Non-medical staff at my physician s or healthcare provider s office Tech companies (i.e., for wearables/ health apps I use) Urgent care or walk-in retail clinics I visit 9 % 8 % 42 % 43 % 20 % 19 % 62% 61% Non-medical staff at my physician s or healthcare provider s office 16 % 32 % 38 % 14 % 52% Not at all Not vey much Somewhat A great deal
4 Despite security measures, health data is still being breached A significant minority of consumers have personally experienced a breach of their healthcare data. While breaches affect only a minority, it is a significant minority with breaches in Saudi Arabia almost three times higher (35 percent) than other countries surveyed. The three most common places for this to happen are the hospital (43 percent), physician s office (25 percent) and pharmacy (24 percent) (Figure 2). FIGURE 2. The most common places where healthcare breaches happen are at hospitals and physicians offices. Hospitals 43 % Physician's office 25 % Pharmacy 24 %
5 Most breaches involve medical info Medical information is far more commonly breached in Saudi than personal information, when it comes to healthcare data. Of those surveyed, some 75 percent of Saudis indicated that they have had their medical data breached, while just 32 percent indicated the same for personal data. Electronic medical records (25 percent), medical record numbers (25 percent) and health insurance ID numbers (24 percent) are the most commonly reported as having been breached (Figure 3). In terms of personal data, the main data being targeted is contact details 32 percent of consumers report that these have been illegitimately accessed. Stolen IDs were also used for other fraudulent activities that include fulfilling prescriptions, receiving medical care and purchasing items. FIGURE 3. More Saudi consumers have their medical data as opposed to their personal information breached. 25 % Electronic medical records 25 % Medical record numbers 24 % Health insurance ID numbers 23% Data from health/ medical condition tracking app 17% Biometric identifiers
Saudis take action when faced with a health data breach 6 In response to the breach of their healthcare data, nearly nine out of ten Saudis surveyed (89 percent) took action to protect their data. Changing passwords or other credentials (30 percent) and getting legal help (30 percent) were the two most common steps. Involving the police (19 percent) and subscribing to an identity protection service (18 percent) were the next most popular responses to healthcare data breaches (Figure 4). In addition, more than nine out of ten (92 percent) Saudis surveyed indicated that the organisation involved took steps to address the data breach. FIGURE 4. Saudi consumers react to data breaches in various ways. 89 % of Saudi consumers took steps in response to a breach CHANGED HEALTHCARE PROVIDERS Got legal help Changed passwords or other credentials 19 % 18 % 17 % 16 % 15 % 11 % Involved police Subscribed to identity protection service Added security software to my computer 5 % Other Reported it to the organisation holding my data None of these
7 Overall breaches cause significant loss of trust Of those that experienced a breach over half of the consumers in Saudi Arabia (55 percent) felt the breach was handled very or somewhat well. The consequence of the breach varied. Overall, Saudis lost more trust in their healthcare organisation than they gained. 42 percent said they had a little less or much less trust in the organisation, 26 percent said their level of trust remained unchanged and 32 percent said they gained additional trust in their healthcare organisations (Figure 5). FIGURE 5. After a breach, consumers report how it impacted their trust in the organisation. 13 % Much less A little less 13+19+26+29+13 13 % Much more 19 % A little more 26 % About as much as before
8 Improving cybersecurity is the first step in building digital trust Breaches are inevitable. Healthcare providers can try to protect against them and they should establish digital trust with consumers early on to build a foundation that helps consumers to weather the storm of a breach. Now is the time for healthcare providers and other organisations to strengthen cybersecurity capabilities, improve their defences, build resilience and better manage breaches. Most importantly, they can give consumers the confidence that their data is in trusted hands. KEY ACTIONS TO BETTER SERVE SAUDI CONSUMERS: IMPROVE RESPONSE CAPABILITIES Along with improving detection, handle breaches quickly and efficiently, in a way that limits damage. VALIDATE DOWNTIME PROCEDURES Strive to reduce recovery time to minimise impact on patient care and business operations. SHARE THREAT INFORMATION Act on learnings and share them with others. Communicate to consumers the actions you have taken. RE-BOOT YOUR APPROACH Embrace an end-to-end cyber defence that recognises a spectrum of threats, minimises exposure, and identifies and protects high-priority assets. MANAGE YOUR RISKS Make targeted cybersecurity investments that will deliver measurable returns and help you build digital trust with healthcare consumers who are increasingly security-aware.
For more information Dr. Majid Altuwaijri majid.altuwaijri@accenture.com Follow us on Twitter @AccentureHealth Accenture Health Accenture 2017 Consumer Survey on Healthcare Cybersecurity and Digital Trust Accenture commissioned a seven-country survey of 7,580 consumers aged 18+ to assess their attitudes toward healthcare data, digital trust, roles and responsibilities, data sharing and breaches. The online survey included consumers across seven countries: Australia (1,000), Brazil (1,000), England (1,000), Norway (800), Saudi Arabia (850), Singapore (930) and the United States (2,000). The survey was conducted by Nielsen on behalf of Accenture between November 2016 and January 2017. The analysis provided comparisons by country, sector, age and use. About Accenture Accenture is a leading global professional services company, providing a broad range of services and solutions in strategy, consulting, digital, technology and operations. Combining unmatched experience and specialized skills across more than 40 industries and all business functions underpinned by the world s largest delivery network Accenture works at the intersection of business and technology to help clients improve their performance and create sustainable value for their stakeholders. With approximately 411,000 people serving clients in more than 120 countries, Accenture drives innovation to improve the way the world works and lives. Visit us at www.accenture.com. About Accenture Insight Driven Health Insight driven health is the foundation of more effective, efficient and affordable healthcare. That s why the world s leading healthcare providers and health plans choose Accenture for a wide range of insight driven health services that help them use knowledge in new ways from the back office to the doctor s office. Our committed professionals combine real-world experience, business and clinical insights and innovative technologies to deliver the power of insight driven health. For more information, visit: www.accenture.com/insightdrivenhealth. Copyright 2017 Accenture All rights reserved. Accenture, its logo, and High Performance Delivered are trademarks of Accenture.