You may think security is up to your IT department or your anti-virus software, but if you’re an employee, you are the first line of defense against cyber attacks. Your practice may have comprehensive cybersecurity policies for its employees (if so, congrats on being one of the few!), but even with these sorts of protections, you have to remain on guard to ensure that you’re protecting patient data and keeping your network secure.
While hackers and hijackers often make the news for attacks on hospitals and other larger organizations, smaller clinics are often even more at risk. Cybercriminals often see smaller practices as easier targets with less security and laxer protocols. And unfortunately, this is often true.
The last thing you want is a patient data security breach–it puts your patients’ information and identities at risk, erodes trust in your practice, and puts you in danger of hefty HIPAA violation fines and citations. Teach your employees how to protect patient data effectively with a few tips and tricks from the best managed IT service providers in Little Rock!
1. Learn to Recognize Sensitive Data
Protecting patient data starts with learning how to recognize its presence. This sounds rudimentary, but when you deal with sensitive information day in and day out, it starts to feel commonplace and eventually your employees stop noticing it altogether.
That chart with a patient’s social security number on it is just another day’s paperwork, and your front-desk assistant may think nothing of setting it down on the counter for a moment–in plain view of any passerby. The same goes for sending emails with sensitive patient information without using encryption, leaving computer screens unlocked while you leave your desk, or sharing pictures with whiteboards or computer screens in the background. When our security protocols are based on comfort and habit, they’re extremely easy to overcome.
An easy way to fix these types of human-error shaped holes in your network security is to create protocols and procedures for your employees to follow. The initial switch can be painful at first, but soon the new rules will become just as habitual and commonplace as the old ones. Hold regular refresher meetings to keep it top of mind and remind your employees that they are handling sensitive, personal information.
Making sure employees have unique usernames and passwords, requiring complex passwords and frequent password changes, requiring encryption on emails with patient PHI, enforcing a locked screen when you’re away from your desk–these are small changes that can mean the difference between a patient data security breach and business as usual.
2. Enable Firewall Protection At Work and At Home
Good managed IT service providers will always recommend the use of firewalls in your practice. After your employees, a firewall is your first line of defense against cyberattacks. Firewalls keep unauthorized users from gaining access to your website, your mail services, your social media accounts, and your internal patient databases that can be accessed through the internet.
And if you or your employees tend to work from home, you should have a firewall installed on your home network as well. Protecting patient data means thinking about how and where you access that data outside of the office and taking steps to protect those spaces.
Offer firewall software to your employees who work remotely and require that anyone without special permissions be on the premises to access PHI. And remember, the cost of providing a firewall for your employees’ homes is minimal compared to the cost of recovering from a data breach.
3. Install Updates and Backup Frequently
Comprehensive HIPAA compliance solutions should include frequent updates and backups. Your security software, web browsers, operating systems, and practice software all release regular updates for a reason–often they include patches and fixes for security holes, weak code, or to prevent the most recent form of cyberattacks.
Staying updated is the easiest way to deflect low-level attacks. This is true for both your work and personal devices–especially if you get work email on your smartphone. Require your employees to update their work phones regularly, or don’t allow access to sensitive information and systems from unauthorized devices.
You should also back up your data and systems on a set, regular schedule. Depending on your practice’s needs and systems, your IT provider may suggest that you back up to an external hard drive, in the cloud, or to an onsite, offline server.
Having a separate backup of all your data can protect you from the damage caused by malware attacks and ransomware attacks. Malware can corrupt your data while ransomware can hold it hostage until you pay the demanded ransom–usually upwards of $1,000. These threats lose some of their effectiveness if you have your own, easily accessible backup.
After the threat is neutralized, you can recover the most recent backup and move on from there. It’s best to have your systems backed up every hour to minimize the data you may lose in the face of a cyberattack. If you are a large organization or you have a constant stream of patient information being updated, you may want to consider even more frequent updates–every half hour or fifteen minutes.
4. Make Your HIPAA Compliance Checklist Medical Office Specific
HIPAA compliance has universal requirements, but they are often implemented differently depending on the setting. An insurance company will have different protocols and procedures than a clinic or other medical office. Here is a six-step checklist to get you started:
- Map your data and identify where your HIPAA protected files live
- Determine who has access to HIPAA protected information and implement a “least privilege required” model of access
- Monitor all file access to PHI and ePHI
- Set up alerts for any HIPAA data that is accessed
- Protect data with physical and technical measures
- Monitor activity on your physical and technological perimeters and add threat models to your data security analytics
If you have any questions about how to accomplish anything on this checklist, or about protecting patient data in general, contact Scale Technology at 501-213-3814. We’re happy to provide your practice with a free HIPAA compliance assessment and make recommendations about how to better protect your patient data.
