This blog post is a writing assignment for HIMT 1250: Health Record Content & Structure, part of the Health Information Management Technology (HI13) Associate of Applied Science Degree program at Georgia Northwestern Technical College.
The Office of the National Coordinator for Health Information Technology’s published a cybersecurity checklist for small healthcare organizations to protect their EHR systems and PHI. Some practices the ONC included in the checklist are using strong passwords and changing them often, using anti-virus software, using a firewall, limiting access to protected health information (PHI), and controlling access to and safeguarding physical devices (Office of the National Coordinator for Health Information Technology, 2010, p. 3).
Small healthcare organizations should use strong passwords and change them often. “Passwords are the first line of defense in preventing unauthorized access to any computer” (ONC, 2010, p. 8). Passwords should contain an eight-character minimum, including a number and a special character. They should also include both uppercase and lowercase letters and should not have words or personal data. A strong password will easily eliminate casual internal wrongdoing and deter and slow automated attacks (ONC, 2010, p. 8).
Small healthcare organizations should use anti-virus software to protect against threats that have already entered the EHR system. Viruses and malware are the main methods attackers use to acquire access to healthcare computers and data. Organizations can eliminate these by the installation and use of anti-virus software. The organization should continue to maintain and update the software to have up-to-date protection against the newest exploits (ONC, 2010, p. 10).
Small healthcare organizations should use a firewall to protect against outside threats. A hardware firewall is the more complicated option and is the best option for larger practices with a LAN. An organization that uses a hardware firewall option needs a specialist to set-up the hardware. However, firewall software is easy to install and maintain. Firewalls often come packaged with anti-virus software or included in computer operating systems (ONC, 2010, p. 11).
Small healthcare organizations should limit access to protected health information (PHI). A facility can control access by assigning employees username permissions and rights. These permissions grant employees only the access they need to do their jobs. Access control maintains confidentiality and prevents unnecessary viewing or use of patient information even among employees. These controls not only protect patient data but keep a facility operating legally and HIPAA compliant (ONC, 2010, p. 12).
Small healthcare organizations should control access to and safeguard physical devices, including desktops, laptops, tablets, portable storage, back-ups, and servers. Lost devices account for the majority of compromised PHI. The consequences could be the same, regardless of accidental loss or theft. Devices need access controls, including locking them in rooms, requiring a physical key, and not allowing employees to remove devices from an area (ONC, 2010, p. 14).
References
Office of the National Coordinator for Health Information Technology. (2010, Nov.). CYBERSECURITY: The protection of data and systems in networks that connect to the Internet — 10 Best Practices for the Small Healthcare Environment. https://drive.google.com/file/d/16Vk9itmrIN_VlS9pLrrflBMb9sAp5nPA/view
Featured Image: Stock Photo, Photo Source: 123RF PLUS
