The Breach Already Happened. Now What?
- Joan Ziegler
- 2 days ago
- 6 min read
ELEV8DATA | SECURITY PERSPECTIVE
Why healthcare organizations are rethinking data security from the ground up. What Elev8Secure does that encryption and firewalls never could.
It's 3 a.m. Your phone lights up. Your CISO is calling.
You already know what it means.
Somewhere in your network, an attacker has been quietly moving through your systems for weeks, maybe even months. They found a way in. They always do. And now they have what they came for: patient records. Millions of them. Names, addresses, diagnoses, Social Security numbers, insurance data. The full picture of the most private moments in people's lives.
By morning, you'll be on the phone with federal regulators, your legal team, and a crisis communications firm. You'll spend the next eighteen months managing the fallout - fines, litigation, remediation costs, and reputational damage that takes years to rebuild.
This isn't hypothetical. In 2024 alone, healthcare suffered more large data breaches than any other industry. Change Healthcare. Ascension. Kaiser. The names keep coming.
The question is no longer whether a breach will happen. It's how to make sure, when it does, there is no Protected Health Information for bad actors to find.
The Problem is ‘The Way It’s Always Been Done’
For decades, healthcare security has operated on a simple premise: build higher walls. Better firewalls. Stronger encryption. More layers of perimeter defense. Intrusion detection. Keep the attackers out, and the data stays safe.
That model is broken. Not because the tools are bad. They're not. Encryption is necessary. Firewalls are necessary. But they're not sufficient because encryption protects data at rest. The moment data is decrypted for use, whether it’s for analytics, in billing, or in a clinical workflow, the exposure window is wide open. And that is exactly when attackers strike.
The Change Healthcare breach didn't happen because UnitedHealth had a lazy security team. It happened because determined attackers had the time and patience to use stolen credentials. The data was right there, in the clear, fully readable, fully valuable to bad actors.
That last part is the part we need to talk about.
Cybersecurity has focused on keeping attackers out. Elev8Secure renders the question irrelevant.
This is the insight behind Elev8Secure. Stop trying to make your walls impenetrable. Start making certain there is nothing of value for bad actors to find in the clear, fully exposed, thus enabling them to perpetrate identity theft or blackmail.
Elev8Secure uses dynamic tokenization – a technique already proven at massive scale in the payments industry – to replace Protected Health Information at the field level with valueless tokens. What remains in your operational environment looks like patient data and functions like patient data in every legitimate workflow. But to any attacker, it's just meaningless tokens, blank or partial data fields. Absolutely no PHI. Nothing to arm them with data they can monetize.
Encryption locks the door.
Tokenization removes the valuables from the room.
Here's the critical distinction most people miss: tokenization is non-mathematical. Unlike encryption, which uses an algorithm that can theoretically be reversed with the right key, Elev8Secure tokens cannot be reverse engineered. There is no mathematical path from the token back to the original value. None.
Who Controls the Data? You Do.
Even better, Elev8Secure goes beyond simply protecting data. It gives you, the Data Owner, sovereign control over it.
Re-identifying a patient record - converting a token back to the original PHI - is not automatic. It requires explicit authorization, governed by a role-based permissions framework that only the Data Owner defines and controls. Not Elev8Data. You.
Think of it like this: an RCM employee needs to see certain patient identifiers like Insurance ID number, first and last name to process a claim. She doesn't need and should not have access to the patient's date of birth, address and social security number. With Elev8Secure, she gets exactly what her role requires, de-tokenized at the individual field level … and nothing more. A researcher working with de-identified cohort data never sees PHI at all. A clinician reviewing a patient chart sees the complete health record because their role permits it but never sees a patient’s social security number.
This is granular, field-level control over who can re-identify what and under specific permission. It's not a binary on/off switch. It's a precision instrument.
The data owner decides who sees what, when, and at what level of detail. Elev8Secure enforces it.
Not All PHI Is the Same — Elev8Secure Treats It That Way
One of the most important things Elev8Secure does is recognize that different data elements carry different risk profiles and different clinical values. A one-size-fits-all approach either over-protects data to the point of destroying its utility or under-protects it by leaving exploitable identifiers intact.
Elev8Secure applies a surgical approach: Tokenize what can be tokenized. Mask what can be partially preserved to provide value to authorized users, but insufficient information for bad actors to do harm. Redact what has zero legitimate use and maximum fraud value to bad actors to monetize. All of this power is there to enable clinicians, researchers, and AI access to individual authentic data. At the same time, it ensures that sensitive PHI that bad actors seek is never “in the clear” for attackers to exploit.
PHI Element | Elev8Secure Action | Why It Matters |
Name | Tokenize | No clinical value; extremely high fraud value |
SSN | Redact | Zero clinical value; Biggest identity theft vector |
Date of Birth | Mask Month + Day | Birth year is essential; full DOB enables re-identification |
ZIP Code | Mask last 2 digits | ZIP3 supports population health; ZIP4-5 narrows to a neighborhood |
City / State | Tokenize or Redact | Prevents targeting of high-profile individuals |
MRN | Tokenize | High clinical value; low fraud value with tokenization |
Insurance # | Tokenize | Needed for billing; worthless without token map |
Driver's License | Redact or Tokenize | Identity theft vector with no clinical utility |
The result is data that retains its full clinical and analytical utility: authentic distributions, real correlations, actual rare events, but nothing for a fraudster to monetize.
This Isn't Theoretical. I've Done This Before.
I spent years building the dynamic authentication technology that now secures billions of tap-to-pay transactions worldwide. Every time you tap your phone to pay for coffee, that technology is quietly ensuring the transaction data crossing the wire can't be exploited by bad actors if intercepted.
Payment tokenization didn't make card networks hack-proof. It made breaches irrelevant. Stolen tokens are useless; they have no replay value for a bad actor. Elev8Secure brings that same proven architecture to healthcare. Same principle. Applied to the most sensitive, most targeted data in America.
What This Means When a Breach Happens
When Elev8Secure is in place, a breach of your EHR system, your billing platform, your claims database - any of it - doesn't trigger a HIPAA notification, because no PHI is exposed. No names, Data of Birth, address, social security numbers. They are not exposed because they reside in a remote token vault. Tokenized data is not Protected Health Information under HIPAA's breach notification rules. The regulatory clock doesn't start. The call at 3:00am doesn’t happen. The notification and remediation costs don’t pile up. The financial exposure of lawsuits doesn’t happen. The per-violation exposure doesn’t materialize. Peace of mind.
Your operations continue normally. Clinicians see patients. Claims get processed. The data flows exactly as it always has. The difference is invisible to everyone except the attacker, who comes away with nothing.
The Shift That's Coming
CISOs and CIOs who've lived through a breach will tell you the same thing: the worst part isn't the technical cleanup. It's explaining to patients that their most intimate health information--whether it’s their cancer diagnosis, their mental health history, or their HIV status--was exposed to strangers. There’s just no good version of that conversation.
Elev8Secure makes that conversation unnecessary.
The healthcare organizations that will lead the next decade aren't the ones with the most sophisticated firewalls. They're the ones who fundamentally rethought what security means – and built a posture where a breach is an inconvenience, not a catastrophe.
We don't replace your encryption. We complete it.
Ready to Talk?
If you're evaluating your data security posture, whether you've been through a breach or you're determined to make sure you never are, I'd like to have a direct conversation about what Elev8Secure can do for your organization.
Reach out at elev8data.com or connect with me directly on LinkedIn.
About the Author
Z is the Founder & CEO of Elev8Data, a healthcare AI and data security company. She previously invented dynamic authentication technology now embedded in billions of tap-to-pay transactions globally and has founded and scaled multiple technology companies with successful exits.