While retailers have certainly had their fair share of headlines related to information breaches, they are not the only target. In the health industry, more than 29 million patients’ records have been compromised since 2009.
To understand what this means, take a look at this infographic created by the Health Information Trust Alliance (HITRUST) based on its 2012 study of the U.S. health industry. The study reveals nearly 500 breaches between 2009 and 2012, with an average of 43 thousand records being compromised at an average cost of more than 8 million dollars per incident.
And experts say that healthcare information breaches are on the rise, particularly since their financial value to criminals is two to five times greater than basic consumer credit data. That’s because health data can be used for medical and insurance fraud as well. In addition to the significant communication and credit monitoring costs, healthcare providers also are subject to severe financial penalties under federal patient privacy laws. And when I say penalties, I’m talking hefty fines of up to $1.5 million per incident. Ouch, Charlie, now that really hurt!
While the healthcare industry invests millions of dollars to protect patient data – as they should –in the event of a breach, how many of these organizations are prepared from a communications and reputation standpoint?
Below are five tips to help you prepare for an information breach or other crisis –while it may not mitigate all the costs associated with the issue, proactive crisis readiness can certainly defray some of the financial costs, and, more importantly, minimize the damage to your brand and reputation.
1. Identify the top five threats facing your organization (HINT: An information breach should be on your list! There –now only four more to go!). Take the time to actually write them down. Then use these threats to anticipate the questions you will be asked by your key stakeholders (customers, Board members, the media, etc.). Anticipating the questions you’ll need to answer often helps in developing your key messages, which leads to the next tip.
2. The rule of thumb is the rule of three. There is power in brevity. And in the first 24 hours of any crisis, there are three key messages you can always rely on. Of course you will need some proof points to back them up, but here’s your “first aid kit” in a crisis:
- Establish control and confidence. “We have a plan to address…..”
- Express compassion. “Our first priority is our patients’ safety/privacy/etc….”
- Demonstrate action. “We are doing everything possible to mitigate the damage/risk/etc. and taking steps to make sure it never happens again.”
3. Draft your standby statement before you need it. If you have followed tips #1 and 2, you will be in a great position to develop a fill-in-the-blank, pre-approved, stand-by statement. Once a crisis hits, time is of the essence. Having your statement prepared ahead of time will allow you to remain calm and stay in control of the situation and of your message. This is key to protecting your organization’s reputation.
4. Balance the court of law with the court of public opinion. The biggest challenge many leader’s face in a crisis is balancing their decisions based on these two courts. Both are important, but what works in one is not always wise to try in the other. When it comes to the court of public opinion, the most important question to ask yourself is this –what is the smartest thing I can do to protect my brand? Whether you win in the court of law will not necessarily correlate with the court of public opinion. Both are important and generally require different ways of thinking and communicating. The facts are the same but the strategies are not. Understand the differences and choose wisely.
5. Time is of the essence. Just pretend like you’re Jack Bauer –you have 24 hours, and the clock is ticking. Actually you have closer to 48 hours, but the point is that you have a short window of time to take control of the situation –of the conversation –of your brand, before someone else does it for you. Rather than fear it, leverage your social media properties as one tool in your arsenal to quickly, personally and publicly address the issue. If you have been regularly monitoring digital conversations and have engaged with your stakeholders over time, social media can be a powerful mechanism for containing your issue, and may be the difference between putting out a bonfire and struggling to contain a wildfire.
To learn more on this topic, join us at this year’s PRSA Health Academy in Washington, DC, where one of the sessions will focus on healthcare crisis communications in the digital age, revisting the 1980’s Tylenol scare and how it might be handled in 2014.
We’ve all seen crises that have been handled well and those that have been handled not so well. What company crises have you learned the most from with regard to what you wish to emulate or what you hope never to repeat? Please share your comments below.