We live in an increasingly digital world. Instead of picking up the phone, we type out a text. Instead of storing paper copies, we digitize PDFs. Instead of photo albums, we have Instagram feeds.
The healthcare space is no exception.
With the rise in popularity of online patient portals, telehealth, and EMR/EHR software, PHI has become increasingly digital (this electronic PHI is also referred to as ePHI – Electronic Protected Health Information). Digitizing comes with a lot of benefits, including making record keeping easier on staff and increasing patient payments by providing online payment portals, but it also puts information at risk of cyberattack and requires up-to-date cybersecurity measures to keep patient information safe.
In addition to protecting the privacy of your patients, proper cyber security also protects your healthcare organization. Recovering from a cyberattack takes time, and often means shutting down your practice for weeks while the attack is investigated. In addition, the reputational damage your practice can suffer after a cyberattack is immense.
Here are some of our favorite tips for protecting your digital PHI.
Also known as Two-Factor Authentication, this cybersecurity measure is becoming increasingly popular, and is now required by many websites, email platforms, software and more. Two-Factor Authentication links your accounts to either an email address, cell number, or standalone app. When a login is attempted, accounts with MFA enabled will require not only a password, but also confirmation through one of these other channels. This means that even if your username and password are compromised, you can block a login attempt through one of these confirmation methods.
Data loss can occur accidentally or maliciously and involves an employee sharing confidential information with unauthorized individuals or sites. Data loss detection security measures utilize software to log employee computer activity and send alerts when security threats or productivity issues are identified. Data loss detection also helps ensure that employees do not send confidential information outside of their work networks accidentally.
Make sure your employees understand what the risks are and how to avoid them. Regularly training your employees to recognize phishing emails, unsafe websites, and the latest cyber threats can protect your entire organization.
This is one of the simplest tips, but also one that feels very daunting. How many of us use the same password for all our online accounts because we cannot remember a unique password for every account we have? Or if we do create a unique password, how many of us write it on a sticky note and keep it taped to our monitor?
Creating strong, unique passwords, particularly for accounts used to access ePHI, is vital and can go a long way towards protecting your digital data. Best practices suggest using a different password for each online account you use, with each password containing 14 characters made up of numbers, letters, and special characters.
Password management tools might be a great fit for your healthcare organization. These tools work on a monthly subscription basis and will automatically generate unique passwords for your online accounts and store them for you. They also allow employers to terminate access across all websites for a specific employee if they are terminated. Check out an article from the HIPAA Journal on password management apps here.
Penetration testing attempts to defeat security threats and identify if unauthorized access of malicious activity is possible. Essentially, this is a hack attempt conducted by a third party aimed at identifying any potential weaknesses in your current cybersecurity setup. As the penetration tester moves through your system, they try to identify weaknesses and compromise your system’s security. Once they have found any potential vulnerabilities, they can then go into your security system and address any issues they discovered during their test.
Practice Management understands how important security is to our clients. As a billing company, we work with our client’s ePHI daily, and we are devoted to not just maximizing their revenue, but to doing it safely and securely.
If you are interested in learning more about our security measures, or getting a quote for billing services, contact us here!
