# data[].attributes.headline
Confidentiality and Privacy in Healthcare:

# data[].attributes.subject
Confidentiality and Privacy in Healthcare:

# data[].attributes.body
Confidentiality in healthcare

Holding patients' information and record in confidence by professionals who have access to the information

Privacy in healthcare

The right of patients to make decisions on how their information can be shared with others

# data[].attributes.body
identify

protect

detect

respond

recover

# data[].attributes.attachment_link.readable_text
Overview

This learning module takes a deeper look at the Cybersecurity Framework's five Functions: Identify, Protect, Detect, Respond, and Recover. The information presented here builds upon the material introduced in the Components of the Framework module. This module explores the value of the Functions within the Framework, and what is included in each Function.

An Introduction to the Functions

The Functions are the highest level of abstraction included in the Framework. They act as the backbone of the Framework Core that all other elements are organized around.

These five Functions were selected because they represent the five primary pillars for a successful and holistic cybersecurity program. They aid organizations in easily expressing their management of cybersecurity risk at a high level and enabling risk management decisions.

Identify

The Identify Function assists in developing an organizational understanding to managing cybersecurity risk to systems, people, assets, data, and capabilities. Understanding the business context, the resources that support critical functions, and the related cybersecurity risks enables an organization to focus and prioritize its efforts, consistent with its risk management strategy and business needs.

Examples of outcome Categories within this Function include:

Identifying physical and software assets within the organization to establish the basis of an Asset Management program

Identifying the Business Environment the organization supports including the organization's role in the supply chain, and the organizations place in the critical infrastructure sector

Identifying cybersecurity policies established within the organization to define the Governance program as well as identifying legal and regulatory requirements regarding the cybersecurity capabilities of the organization

Identifying asset vulnerabilities, threats to internal and external organizational resources, and risk response activities as a basis for the organizations Risk Assessment

Identifying a Risk Management Strategy for the organization including establishing risk tolerances

Identifying a Supply Chain Risk Management strategy including priorities, constraints, risk tolerances, and assumptions used to support risk decisions associated with managing supply chain risks

Protect

The Protect Function outlines appropriate safeguards to ensure delivery of critical infrastructure services. The Protect Function supports the ability to limit or contain the impact of a potential cybersecurity event.

Examples of outcome Categories within this Function include:

Protections for Identity Management and Access Control within the organization including physical and remote access

Empowering staff within the organization through Awareness and Training including role based and privileged user training

Establishing Data Security protection consistent with the organization's risk strategy to protect the confidentiality, integrity, and availability of information

Implementing Information Protection Processes and Procedures to maintain and manage the protections of information systems and assets

Protecting organizational resources through Maintenance, including remote maintenance, activities

Managing Protective Technology to ensure the security and resilience of systems and assists are consistent with organizational policies, procedures, and agreements

Detect

The Detect Function defines the appropriate activities to identify the occurrence of a cybersecurity event. The Detect Function enables timely discovery of cybersecurity events.

Examples of outcome Categories within this Function include:

Ensuring Anomalies and Events are detected, and their potential impact is understood

Implementing Security Continuous Monitoring capabilities to monitor cybersecurity events and verify the effectiveness of protective measures including network and physical activities

Maintaining Detection Processes to provide awareness of anomalous events

Respond

The Respond Function includes appropriate activities to take action regarding a detected cybersecurity incident. The Respond Function supports the ability to contain the impact of a potential cybersecurity incident.

Examples of outcome Categories within this Function include:

Ensuring Response Planning process are executed during and after an incident

Managing Communications during and after an event with stakeholders, law enforcement, external stakeholders as appropriate

Analysis is conducted to ensure effective response and support recovery activities including forensic analysis, and determining the impact of incidents

Mitigation activities are performed to prevent expansion of an event and to resolve the incident

The organization implements Improvements by incorporating lessons learned from current and previous detection / response activities

Recover

The Recover Function identifies appropriate activities to maintain plans for resilience and to restore any capabilities or services that were impaired due to a cybersecurity incident. The Recover Function supports timely recovery to normal operations to reduce the impact from a cybersecurity incident.

Examples of outcome Categories within this Function include:

Ensuring the organization implements Recovery Planning processes and procedures to restore systems and/or assets affected by cybersecurity incidents

Implementing Improvements based on lessons learned and reviews of existing strategies

Internal and external Communications are coordinated during and following the recovery from a cybersecurity incident

Additional Resources
The_Five_Functions.pptx

# data[].attributes.attachment_link.description
Overview This learning module takes a deeper look at the Cybersecurity Framework's five Functions: Identify, Protect, Detect, Respond, and Recover. The information presented here builds upon the material introduced in the Components of the Framework module. This module explores the value of the Functions within the Framework, and what is included in each Function.

# data[].attributes.body
1. What is one way that your facility/place of employment ensures privacy and the security of health information?

2. What can you do as a nurse to maintain patient confidentiality, privacy, and security during this outbreak of coronavirus?

# data[].attributes.headline
The Importance of Patient's Confidentiality and Privacy

# data[].attributes.subject
The Importance of Patient's Confidentiality and Privacy

# data[].attributes.attachment_link.title
Capital Health Ethics Support Privacy and Confidentiality

# data[].attributes.attachment_link.title
Medical Device Cybersecurity in Healthcare: Managing Threats and Costs

# data[].attributes.attachment_link.title
Protecting Medical Devices from Cyberharm | Stephanie Domas | TEDxColumbus

# data[].attributes.attachment_link.title
How healthcare organizations can combat cyberattacks

# data[].attributes.headline
What Nurses Need to Know About Cybersecurity

# data[].attributes.subject
What Nurses Need to Know About Cybersecurity

# data[].attributes.body
Cybersecurity is "part of nurses' role to maintain patient safety and privacy".

"Health data is much more valuable to cyber criminals than other data."

# data[].attributes.body
Badge swiping

Passwords/keycodes

Biometrics/fingerprints

# data[].attributes.body
Secure your logins and passwords

Follow strong password guidelines

Don't share with coworkers!

Don't leave your computer/workstation unattended while logged in

# data[].attributes.body
Use secure texting on phones

Don't connect to unsecured public wireless networks

Be careful when and where you turn Bluetooth connections on

Review and update security settings on wearable health devices such as Fitbits or smartwatches

Install the latest updates of your phone's operating system and apps

# data[].attributes.body
"are designed to either deceive a user (human) or damage a computing device"

# data[].attributes.body
Malware, ransomware, phishing, viruses

Harmful emails, attachments, links or downloads

Lost or stolen devices

Connectivity of wireless medical devices

Health apps or programs that "generate, store, and transmit personal health data"

Social media posts that violate privacy (even unintentionally)

# data[].attributes.body
Jones Abroms, L. C., Allegrante, J. P., Auld, M. E., Gold, R. S., Riley, W. T., & Smyser, J. (2019). Toward a Common Agenda for the Public and Private Sectors to Advance Digital Health Communication. American Journal of Public Health, 109(2), 221–223.

Kim, L. (2017). Cybersecurity awareness. Nursing, 47(6), 65–67. doi: 10.1097/01.NURSE.0000516242.05454.b4.

Mcgonigle, D. & Mastrian, K. (2018). Nursing Informatics and the Foundation of Knowledge (4th ed.). Burlington, MA: Jones & Bartlett Learning.

Nahm, E., Poe, S., Lacey, D., Lardner, M., Van, D., & Powell, K. (2019). Cybersecurity essentials for nursing informaticists. Computers, Informatics, Nursing : Cin, 37(8), 389-393. doi:10.1097/CIN.0000000000000570

Stockwell, S. (2018). What Nurses Need to Know About Cybersecurity. AJN, American Journal of Nursing, 118(12), 17–18. doi: 10.1097/01.NAJ.0000549682.13264.dc.

# data[].attributes.body
the process of ensuring that one is protecting and maintaining systems and devices appropriately and using cybersecurity best practices

# data[].attributes.body
Cybersecurity training, education & awareness

Be vigilant about suspicious emails, attachments, links and downloads

Antivirus programs, firewalls

Encryption of sensitive information

Limit access to secure information to those who need to know

Watch out for "shoulder surfing"