To Err is Human: Combating Human Error in Healthcare Cybersecurity

The talk argues that human error is the top driver of data breaches and that healthcare breaches carry the highest average cost of any industry. It presents breach statistics showing rising costs, per-record expenses for patient data, and how remote work has widened exposure. Audience polls are used throughout to gauge who has seen an organization breached.

To make this concrete, the speaker walks through a composite healthcare organization whose vendor's email account was compromised. Attackers used it to send phishing messages for months, reaching patient and employee records and spreading into other organizations. The cost breakdown covers investigation, notification, lost business and post-breach response. Error types range from misdirected emails and misconfigured cloud services to phishing, and emailed attachments act as an unmanaged file store. Shadow IT appears when security controls get in the way of daily work.

The main takeaway is that policies and tighter controls tend to create exceptions and workarounds, so the cycle repeats. The speaker recommends reducing the number of security decisions users must make, studying actual workflows to fix productivity gaps, offering safe options for remote work, and automating where possible. Existing tools such as multi-factor authentication and password managers are underused, and education should extend beyond phishing drills. Protection should assume that users will sometimes make mistakes.