A physician's No. 1 job is to look after his or her patients' health. HIPAA patient privacy laws add another layer to this mandate: Not only must the physician care for the patient, but also for the patient's privacy.
The first half of 2017 saw not one, but two major ransomware attacks against healthcare facilities. These online threats opened eyes around the world and highlighted the need for innovation and more vigilant data security practices. Data security should not be put on the back burner, since the U.S. Office of Civil Rights (OCR) enforces HIPAA regulations and can impose hefty fines for data breaches that compromise patient safety.
Understanding HIPAA, Patient Privacy and Security
HIPAA regulations are designed to accommodate businesses of different sizes. The government recognizes that small practices may not be able to afford the same security solutions as large organizations. However, the law does require all healthcare providers to take reasonable security measures to protect patient data.
In this age of online connectivity, any device that has access to a network represents a potential vulnerability. In a gynecology practice, networked equipment enhances productivity and makes it easier to transfer files to another provider, an insurance company or the practice's own electronic health records. This is also true of certain types of medical equipment, such as ultrasound systems.
But where do gynecologists start to understand the vulnerabilities that lurk within these systems and how to protect their patients' interests? Every practice should conduct a risk assessment to determine its most pressing data security needs. To safeguard personal health information (PHI), all facilities, large and small, must be able to answer the following questions:
- Where is the PHI? An informed practice must know where PHI is held. Data can be housed on servers, individual computers, pieces of equipment or in the cloud.
- How does the business access its PHI? A crucial piece of data security is understanding the various ways this information is accessed. Any equipment or device that is able to connect to the network is an access point. Cellphones, tablets, equipment and computers are all points of access that may require device-specific protection.
- Has the staff been trained properly? All employees within the practice must be aware of the HIPAA privacy rule and how it applies to a particular job. Staff members should be trained to avoid obvious risks, such as clicking malicious links within fraudulent emails or malware-laden ads that appear online. A business can deploy every security solution available, but uninformed employees will always create new risks.
Safeguard Your Systems With Multiple Layers of Protection
Practitioners cannot simply rely on one safeguard. Individual tools such as antivirus software are important, but a smartphone or tablet used to access the business's network could also be a vulnerability. Computers and networks should be secured with strong passwords, and access to critical systems should be restricted to prevent viruses from spreading throughout the network.
Ultrasound equipment, which is vital to most gynecology practices, must also be protected. Older pieces of equipment may lack sufficient network security capabilities, so these should be evaluated in the overall risk assessment. Modern equipment is designed with security in mind, with features such as administrator settings, hard drive encryption and whitelisting, but its safeguards may need updates just as computers do. Be sure to have a plan for updating systems and securing backups as part of the practice's security protocol.
Robust Data Security Drives Better Patient Care
New businesses, and even practices interested in re-evaluating their current security standards, need to know the proper questions to ask. To start, consult respected sources of information about network security. The New York Times, for example, recently published tips to help businesses protect their data from ransomware attacks.
While HIPAA applies to all healthcare organizations, data security is not a one-size-fits-all solution. The key is to understand how a breach might affect your organization, and where your equipment and systems are vulnerable. This makes for more resilient systems and, more importantly, better patient care.
