Malicious Insider – The malicious insider is dangerous and has ill intentions. They may be a disgruntled or angry employee seeking to cause damage or harm your company via insider sabotage. This insider causes direct harm to your organization, and they may delete or transfer EPHI off-site to leak. 55% of malicious insiders are looking to monetize sensitive data, as found by CIO Insight.

Real case example:


● UCLA Health System experienced a breach when a fired surgeon accessed their medical record database on over 300 occasions. The ex-surgeon illegally accessed and viewed EHR of coworkers, supervisors, and celebrities as well.

Professional Insider – This insider may be an employee, but took the job to simply exploit data. This individual makes a living off of exploiting companies, stealing and selling sensitive data. The professional insider is calculated and may have stolen data from an organization before.

Real case example:

● A hospital employee was arrested and fined in 2014 for illegally accessing and disclosing EPHI and EHR. The employee convicted of this crime had the intent of selling this information for personal profit.


How to prevent insider threat and HIPAA violation
The digitization of healthcare data is both a blessing and a curse. Adopting a proactive, forward-thinking approach through awareness, policies, and technology enables your healthcare entity to actively monitor and prevent the insider threat. Successfully preventing and detecting each insider threat may not be possible, but executing data security efforts is necessary for HIPAA compliance. OCR further stresses appropriate access to data, creating and managing end user accounts to protect against the insider threat and maintain HIPAA. The examples stated in this article are everyday opportunities for an insider threat to interact with and exploit HIPAA-regulated information.


Isaac Kohen is the founder and CEO of Teramind, an employee monitoring and insider threat prevention platform that detects, records, and prevents, malicious user behavior, in addition to helping teams to drive productivity and efficiency.

Back to HCB News

Health IT Homepage