The medical field is constantly on the cusp of innovation when it comes to health technology. However, its cybersecurity practices seem to have trouble keeping up.
Electronic medical records allow multiple healthcare professionals to work on the same information for a patient from multiple locations. While this is certainly convenient for patients and providers, it also increases cyber risk. A malicious actor can gain digital access to sensitive patient data with a few keystrokes, without leaving his or her basement lair.
The breach threat for healthcare organizations has been growing in recent years. Medical information is valuable, with the price of a data breach in the healthcare sector potentially costing as much as $9.23 million. This is a 29% increase in cost between 2020 and 2021. Now more than ever, it is critical that healthcare entities take decisive steps to protect their patients’ data.
The Main Act
Everyone who has been in a doctor’s office in the United States in the past 25 years is probably aware of the Health Insurance Portability and Accountability Act (HIPAA). One key component of this 1996 Act is the Security Rule, which deals with the protection of “all individually identifiable health information a covered entity creates, receives, maintains or transmits in electronic form.” This information is referred to as Electronic Protected Health Information, or ePHI.
Entities that HIPAA applies to, including primary care offices, hospitals, and insurance companies, are required to to maintain appropriate safeguards to protect data physically, electronically, and administratively.
Protect Physically
With so many clinical tools and procedures now being digitized, the attack surface of an average medical office has increased to include laptops, desktops, phones, wireless printers, and clinical diagnostic tools that are connected to the network. Remote devices also present a security risk when administrative and support staff are handling patient ePHI outside of the physical hospital or clinic. As far as it is feasible, all of these machines must have strict access control. They should be used only for their intended purpose, and only by authorized personnel.
A good security protocol will include tools that allow IT professionals and business administrators to track the location of devices that contain confidential data. Guide remote staff to create a secure home office setting, complete with locking storage if possible. Consider installing a geo-fencing software on devices that contain ePHI to limit where employees can access it.
Defend Digitally
While convenience increases with telehealth and remote work, so does risk. As with any form of digital data, ePHI is at risk of unauthorized access and must be protected through a variety of cybersecurity tools. Healthcare organizations can, unfortunately, anticipate that there will be hacking attempts. This means that, to comply with HIPAA, these organizations must defend against these threats to patient privacy.
Medical records should always be encrypted to protect information from compromise. It is also important to have a software that can wipe patient data off of machines that are stolen or go missing to keep data from being breached and sold. One stolen laptop can put the ePHI of tens of thousands of patients at risk.
Engage Employees
When it comes to protecting ePHI and other sensitive data, training administrators, contractors, and healthcare providers is crucial. Employees need to be aware of the company’s security policy, and should understand HIPAA requirements and cybersecurity threats. For administrative or clinical support staff that work from home, help them secure their home office, and be clear in outlining the mobile device policies of the organization.
Do not ignore the risk of internal threats, as a disgruntled employee can do a lot of damage from within the company by accessing and selling records. Only allow employees access to what they need to complete their jobs. Be sure to perform HIPAA compliance checks often and provide regular training.
Ultimately, human error from within a company can do just as much damage as an outright cyber attack. The best way to protect against this is to train employees to recognize phishing attacks and to handle electronic data with sufficient care. Educating patients on digital privacy can empower them to make informed decisions about their ePHI as well. When healthcare providers, administrators, and clinical staff understand the risks associated with digital data, ePHI is in safer hands.
It is important that healthcare entities take action to protect patient privacy. Vigilance is needed, as well as the foresight to implement effective procedures and software.
About DriveStrike
DriveStrike provides data wiping, encryption integration, and geolocation services. DriveStrike’s HIPAA compliant device and data protection is an essential part of any robust cybersecurity program. Contact us with any questions and sign up for a free 30-day trial to start protecting your devices and data today! Your security is our priority.