# data[].attributes.body
Akinsanya, M. O., Ekechi, C. C., & Okeke, C. D. (2024). Virtual private networks (vpn): A conceptual review of security protocols and their application in modern networks. Engineering Science & Technology Journal, 5(4), 1452-1472. https://doi.org/10.51594/estj.v5i4.1076

# data[].attributes.body
Alanazi, A. T. (2023). Clinicians’ perspectives on healthcare cybersecurity and cyber threats. Curēus, 15(10), e47026. https://doi.org/10.7759/cureus.47026

# data[].attributes.body
Security tools in healthcare play a crucial role in protecting patient-centered care. Ensuring patient privacy is paramount in healthcare settings, and security tools are essential for maintaining confidentiality and protecting patient data. These tools not only help comply with regulatory requirements such as HIPAA but also foster patient trust by demonstrating responsible handling of sensitive information (d’Aliberti & Clark, 2022). Patients have the right to expect that their personal health information will be securely stored and accessed only by authorized healthcare providers. By implementing security measures, healthcare organizations uphold patient confidentiality, ensure data integrity, and mitigate the risks associated with unauthorized access or data breaches.

# data[].attributes.body
Imagine you are a home health nurse. You arrive at your patient’s home to provide care to Mr. Smith, a 68-year-old male with congestive heart failure and hypertension. How would you know what assessments to perform, what orders the physician requires, what medications Mr. Smith is on, what other medications he needs, or what education you can provide during your visit? This is why portable devices are important. Using an unsecured network (outside of the secured network of the hospital) to access a patient’s EHR is invaluable in situations like these. Being able to access a patient's EHR allows you to properly plan patient care by using the nursing process.

Portable devices, however, are also prone to security threats listed above. There are interventions that can assist in preventing breaches of sensitive patient information.

# data[].attributes.body
o   A network is multiple devices such as computers, printers, mobile devices, and other equipment that are interconnected together that help with communication, sharing of information, and resource management within an organization, such as a hospital. This is crucial to operations because it allows collaborations between healthcare professionals, improves efficiency, and enhances patient care and their experience (McGonigle & Mastrian, 2022).

o   These computers, along with being connected with each other, can also be connected to other computers outside the network. This is where breaches in the network can occur and expose data to unapproved users.

o   Why is healthcare such a gigantic target for cybersecurity attacks? In the study published by Alanazi (2023), the author states that “by 2025 it is estimated that the global cost of personal data theft and data loss will be $10 trillion annually.” Personal data can be used for identity theft, insurance fraud, financial fraud, blackmail, and many more malicious activities.

# data[].attributes.body
One of the main ways to maintain cybersecurity is to make sure that only authorized users are signing into systems to access data. Users are authenticated by three factors:

Things they have: ID badges or some other item that is in a person's physical possession

Things they know: password, PIN number, some other personal information

Things they are: biometric data, such as fingerprint, facial scan, retina scan, speech pattern

Organizations use a combination of these factors, or multifactor authentication (McGonigle & Mastrian, 2022).

# data[].attributes.attachment_link.title
What Is Multi-Factor Authentication? | Hackers and Healthcare 016

# data[].attributes.body
The three main goals of cybersecurity and securing networks are known as the CIA Triad (Alanazi, 2023).

1. Confidentiality - Keeping sensitive information private and protecting it from unauthorized access.

2. Integrity - Ensuring information is accurate and free from tampering.

3. Availability - The accessibility of information by authorized users.

# data[].attributes.body
Cybersecurity threats in healthcare present serious challenges, affecting both the integrity of patient data and the operational continuity of healthcare organizations. Ransomware attacks, highlighted by Beaver and Winkelman (2023), continue to target healthcare institutions, encrypting patient records and disrupting critical services. These incidents not only jeopardize patient care but also incur significant financial costs and regulatory scrutiny. Addressing these threats requires robust cybersecurity measures, including proactive monitoring, employee training, and investment in secure technologies to mitigate risks and safeguard patient information effectively.

# data[].attributes.body
This video demonstrates the impact cyber security attacks can have on the healthcare system.

# data[].attributes.attachment_link.title
How a cyberattack crippled the U.S. health care system

# data[].attributes.body
1. How can healthcare organizations balance the need for easy digital access to patient records with the imperative to protect patient privacy and data security?

# data[].attributes.body
This video will explain what is cyber security, how it works, why cyber security is important, who is a cyber security expert, and what are the different types of cyber attacks with examples.

# data[].attributes.attachment_link.title
What Is Cyber Security | How It Works? | Cyber Security In 7 Minutes | Cyber Security | Simplilearn

# data[].attributes.body
Beaver, K., & Winkelman, W. (2023). Cybersecurity threats to the healthcare industry. Journal of Healthcare Management, 68(1), 45-52.

# data[].attributes.body
A recent new technology has revolutionized the finance sector, and it has the potential to do the same in the healthcare sector. Blockchain technology is “a digital database containing a record of transactions, maintained across several computers linked in a network that can be simultaneously used and shared with a large, decentralized (peer-to-peer) publicly accessible network (McMonigle & Mastrian, 2022).” The “block” creates a record which cannot be altered. There are several benefits of blockchain technology as listed by McGonigle and Mastrian (2022):

Decentralized management and use of peer-to-peer networks

Audit trail created with each block that is timestamped

Data is easily tracked

Allows interoperability within authorized users of the healthcare system

Strengthens privacy and security

# data[].attributes.body
This website provides the most common types of cyber threats which are:

Malware

Ransomware

Distributed Denial of Service (DDoS) Attacks

Spam and Phishing

Corporate Account Takeover (CATO)

# data[].attributes.attachment_link.readable_text
Malware

Malware is also known as malicious code or malicious software. Malware is a program inserted into a system to compromise the confidentiality, integrity, or availability of data. It is done secretly and can affect your data, applications, or operating system. Malware has become one of the most significant external threat to systems. Malware can cause widespread damage and disruption, and requires huge efforts within most organizations.

Spyware, a malware intended to violate privacy, has also become a major concern to organizations. Although privacy-violating malware has been in use for many years, it has become much more common recently. Spyware invades many systems to track personal activities and conduct financial fraud.

Organizations also face similar threats from several forms of non-malware threats. These forms of cyber threats are often associated with malware. A more common form is phishing. Phishing involves tricking individuals into revealing sensitive or personal information.
Tips for preventing Malware from the National Institute of Standards and Technology (NIST) Guide to Malware Incident Prevention and Handling:

Require e-mail file attachments to be scanned and saved to local drives or removable media.

Don't allow certain types of files (e.g., .exe files) to be sent or received by e-mail.

Restrict removable media, such as CDs or flash drives, on systems that are high risk.

Limit the number of users with administrator-level access or privileges.

Ensure systems are updated regularly with operating system and application upgrades and patches.

Ransomware

Ransomware prevents or limits users from accessing their system via malware. Ransomware asks you to pay a ransom using online payment methods to regain access to your system or data. Online payment methods usually include virtual currencies such as bitcoins. Ransomware is one of the most widely used methods of attacks.

Ransomware enters computer networks and encrypts files using public-key encryption. Unlike other malware, this encryption key stays on the cyber criminal's server. Cyber criminals will request ransom for this private key. Cyber criminals are using encryption as a weapon to hold the data hostage.

Ransomware is hard to detect before it's too late, and ransomware techniques continue to evolve. Because of this, your institution should focus on prevention efforts. Prevention efforts include training for employees and strong information security controls.

The DOB recommends developing strong business continuity plans and incident response plans. Plan development may help in the event of a ransomware attack.

Distributed Denial of Service (DDoS) Attacks

DDoS attacks make an online service unavailable by overwhelming it with excessive traffic from many locations and sources. Website response time slows down, preventing access during a DDoS attack. Cyber criminals develop large networks of infected computers called Botnets by planting malware. A DDoS attack may not be the primary cyber crime. The attacks often create a distraction while other types of fraud and cyber intrusion are attempted.

The Federal Financial Institutions Examination Council (FFIEC) issued a joint statement on DDoS attacks, risk mitigation, and additional resources.

Spam & Phishing

Spam includes unwanted, unsolicited, or undesirable messages and emails. Phishing is a form of social engineering, including attempts to get sensitive information. Phishing attempts will appear to be from a trustworthy person or business.

Cyber criminals pretend to be an official representative sending you an email or message with a warning related to your account information. The message will often ask for a response by following a link to a fake website or email address where you will provide confidential information. The format of the message will typically appear legitimate using proper logos and names. Any information entered into the fake link goes to the cyber criminal.

The FBI developed tips for preventing phishing attacks.

Corporate Account Takeover (CATO)

CATO is a business entity theft where cyber thieves impersonate the business and send unauthorized wire and ACH transactions. The unauthorized funds are sent to accounts controlled by the cyber criminal.

Many businesses are vulnerable to a CATO attack. Institutions with weak computer safeguards and minimal controls over online banking systems are easy targets. This form of cyber crime can result in large losses. Cyber criminals use malware to infect a computer through e-mail, websites, or malware disguised as software.

The Conference of State Bank Supervisors (CSBS) developed a CATO best practices document.

Automated Teller Machine (ATM) Cash Out

ATM Cash Out is a type of large dollar value ATM fraud. Cash-outs involve simultaneous large cash withdrawals from several ATMs in many regions. It may also include large withdrawals at one ATM.

The Cash Out usually affects small-to medium-sized financial institutions. The attack involves changing the settings on ATM web-based control panels. Cyber criminals change the ATM's dispense function control to "Unlimited Operations." The "Unlimited Operations" setting allows withdrawal of funds over the customer's account balance or beyond the ATM's cash limit. Stolen ATM or debit card information is often used to withdraw the funds. As a result, your financial institution can suffer large dollar losses.

The DOB recommends reviewing your control over information technology networks, card issuer authorization systems, systems that manage ATM parameters, and fraud detection and response processes to prevent ATM Cash Out attacks.

The FFIEC issued a joint statement about cyber attacks on financial institutions' ATM and card authorization systems.

# data[].attributes.attachment_link.description
Learn about the most common types of cybersecurity threats and tips to prevent them at your financial institution.

# data[].attributes.body
Due to the rapid advancement of technology over the past century, healthcare has increasingly integrated new technological innovations. One of the requirements of healthcare is to protect patients and their privacy. Two key pieces of legislation passed by Congress require healthcare systems to maintain patient privacy regarding health information.

Health Information Portability Accountability Act (HIPAA) of 1996

One of the main goals of HIPAA is to maintain the privacy and security of health information.

Electronic protected health information (e-PHI) is considered any “identifiable information a covered entity creates, receives, maintains or transmits in electronic form (HHS, 2022)."

Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009

The government provided monetary incentives to hospitals and providers to adopt Electronic Health Records (EHRs) and move away from paper records.

This act also called for improving privacy and security protections for healthcare data.

In a way, HITECH strengthened HIPAA by expanding the scope of privacy and security protections for health information.

Requires notification when there is a breach of information (Burde, 2011).

# data[].attributes.body
Burde, H. (2011). The HITECH Act: An overview. AMA Journal of Ethics, 13(3), 172-175. https://journalofethics.ama-assn.org/article/hitech-act-overview/2011-03

# data[].attributes.body
This is a web source from the U.S. Department of Health and Human Services. It summarizes HIPAA security rules and safeguards.

# data[].attributes.attachment_link.readable_text
This is a summary of key elements of the Security Rule including who is covered, what information is protected, and what safeguards must be in place to ensure appropriate protection of electronic protected health information. Because it is an overview of the Security Rule, it does not address every detail of each provision.

Introduction

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) required the Secretary of the U.S. Department of Health and Human Services (HHS) to develop regulations protecting the privacy and security of certain health information.¹ To fulfill this requirement, HHS published what are commonly known as the HIPAA Privacy Rule and the HIPAA Security Rule. The Privacy Rule, or Standards for Privacy of Individually Identifiable Health Information, establishes national standards for the protection of certain health information. The Security Standards for the Protection of Electronic Protected Health Information (the Security Rule) establish a national set of security standards for protecting certain health information that is held or transferred in electronic form. The Security Rule operationalizes the protections contained in the Privacy Rule by addressing the technical and non-technical safeguards that organizations called "covered entities" must put in place to secure individuals' "electronic protected health information" (e-PHI). Within HHS, the Office for Civil Rights (OCR) has responsibility for enforcing the Privacy and Security Rules with voluntary compliance activities and civil money penalties.

Prior to HIPAA, no generally accepted set of security standards or general requirements for protecting health information existed in the health care industry. At the same time, new technologies were evolving, and the health care industry began to move away from paper processes and rely more heavily on the use of electronic information systems to pay claims, answer eligibility questions, provide health information and conduct a host of other administrative and clinically based functions.

Today, providers are using clinical applications such as computerized physician order entry (CPOE) systems, electronic health records (EHR), and radiology, pharmacy, and laboratory systems. Health plans are providing access to claims and care management, as well as member self-service applications. While this means that the medical workforce can be more mobile and efficient (i.e., physicians can check patient records and test results from wherever they are), the rise in the adoption rate of these technologies increases the potential security risks.

A major goal of the Security Rule is to protect the privacy of individuals' health information while allowing covered entities to adopt new technologies to improve the quality and efficiency of patient care. Given that the health care marketplace is diverse, the Security Rule is designed to be flexible and scalable so a covered entity can implement policies, procedures, and technologies that are appropriate for the entity's particular size, organizational structure, and risks to consumers' e-PHI.

This is a summary of key elements of the Security Rule and not a complete or comprehensive guide to compliance. Entities regulated by the Privacy and Security Rules are obligated to comply with all of their applicable requirements and should not rely on this summary as a source of legal information or advice. To make it easier to review the complete requirements of the Security Rule, provisions of the Rule referenced in this summary are cited in the end notes. Visit our Security Rule section to view the entire Rule, and for additional helpful information about how the Rule applies. In the event of a conflict between this summary and the Rule, the Rule governs.

Statutory and Regulatory Background

The Administrative Simplification provisions of the Health Insurance Portability and Accountability Act of 1996 (HIPAA, Title II) required the Secretary of HHS to publish national standards for the security of electronic protected health information (e-PHI), electronic exchange, and the privacy and security of health information.

HIPAA called on the Secretary to issue security regulations regarding measures for protecting the integrity, confidentiality, and availability of e-PHI that is held or transmitted by covered entities. HHS developed a proposed rule and released it for public comment on August 12, 1998. The Department received approximately 2,350 public comments. The final regulation, the Security Rule, was published February 20, 2003. ² The Rule specifies a series of administrative, technical, and physical security procedures for covered entities to use to assure the confidentiality, integrity, and availability of e-PHI.

The text of the final regulation can be found at 45 CFR Part 160 and Part 164, Subparts A and C.

Who is Covered by the Security Rule

Business Associates

What Information is Protected

Electronic Protected Health Information. The HIPAA Privacy Rule protects the privacy of individually identifiable health information, called protected health information (PHI), as explained in the Privacy Rule and here - PDF. The Security Rule protects a subset of information covered by the Privacy Rule, which is all individually identifiable health information a covered entity creates, receives, maintains or transmits in electronic form. The Security Rule calls this information "electronic protected health information" (e-PHI).³ The Security Rule does not apply to PHI transmitted orally or in writing.

General Rules

The Security Rule requires covered entities to maintain reasonable and appropriate administrative, technical, and physical safeguards for protecting e-PHI.

Specifically, covered entities must:

1. Ensure the confidentiality, integrity, and availability of all e-PHI they create, receive, maintain or transmit;

2. Identify and protect against reasonably anticipated threats to the security or integrity of the information;

3. Protect against reasonably anticipated, impermissible uses or disclosures; and

4. Ensure compliance by their workforce.⁴

The Security Rule defines "confidentiality" to mean that e-PHI is not available or disclosed to unauthorized persons. The Security Rule's confidentiality requirements support the Privacy Rule's prohibitions against improper uses and disclosures of PHI. The Security rule also promotes the two additional goals of maintaining the integrity and availability of e-PHI. Under the Security Rule, "integrity" means that e-PHI is not altered or destroyed in an unauthorized manner. "Availability" means that e-PHI is accessible and usable on demand by an authorized person. ⁵

HHS recognizes that covered entities range from the smallest provider to the largest, multi-state health plan. Therefore the Security Rule is flexible and scalable to allow covered entities to analyze their own needs and implement solutions appropriate for their specific environments. What is appropriate for a particular covered entity will depend on the nature of the covered entity's business, as well as the covered entity's size and resources.

Therefore, when a covered entity is deciding which security measures to use, the Rule does not dictate those measures but requires the covered entity to consider:

Its size, complexity, and capabilities,

Its technical, hardware, and software infrastructure,

The costs of security measures, and

The likelihood and possible impact of potential risks to e-PHI.⁶

Covered entities must review and modify their security measures to continue protecting e-PHI in a changing environment. ⁷

Risk Analysis and Management

The Administrative Safeguards provisions in the Security Rule require covered entities to perform risk analysis as part of their security management processes. The risk analysis and management provisions of the Security Rule are addressed separately here because, by helping to determine which security measures are reasonable and appropriate for a particular covered entity, risk analysis affects the implementation of all of the safeguards contained in the Security Rule.

A risk analysis process includes, but is not limited to, the following activities:

Evaluate the likelihood and impact of potential risks to e-PHI;⁸

Implement appropriate security measures to address the risks identified in the risk analysis;⁹

Document the chosen security measures and, where required, the rationale for adopting those measures;¹⁰ and

Maintain continuous, reasonable, and appropriate security protections.11

Risk analysis should be an ongoing process, in which a covered entity regularly reviews its records to track access to e-PHI and detect security incidents, ¹² periodically evaluates the effectiveness of security measures put in place, ¹³ and regularly reevaluates potential risks to e-PHI. ¹⁴

Administrative Safeguards

Security Management Process. As explained in the previous section, a covered entity must identify and analyze potential risks to e-PHI, and it must implement security measures that reduce risks and vulnerabilities to a reasonable and appropriate level.

Security Personnel. A covered entity must designate a security official who is responsible for developing and implementing its security policies and procedures.15

Information Access Management. Consistent with the Privacy Rule standard limiting uses and disclosures of PHI to the "minimum necessary," the Security Rule requires a covered entity to implement policies and procedures for authorizing access to e-PHI only when such access is appropriate based on the user or recipient's role (role-based access).¹⁶

Workforce Training and Management. A covered entity must provide for appropriate authorization and supervision of workforce members who work with e-PHI.¹⁷ A covered entity must train all workforce members regarding its security policies and procedures,¹⁸ and must have and apply appropriate sanctions against workforce members who violate its policies and procedures.¹⁹

Evaluation. A covered entity must perform a periodic assessment of how well its security policies and procedures meet the requirements of the Security Rule.²⁰

Physical Safeguards

Facility Access and Control. A covered entity must limit physical access to its facilities while ensuring that authorized access is allowed.²¹

Workstation and Device Security. A covered entity must implement policies and procedures to specify proper use of and access to workstations and electronic media.²² A covered entity also must have in place policies and procedures regarding the transfer, removal, disposal, and re-use of electronic media, to ensure appropriate protection of electronic protected health information (e-PHI).²³

Technical Safeguards

Access Control. A covered entity must implement technical policies and procedures that allow only authorized persons to access electronic protected health information (e-PHI).²⁴

Audit Controls. A covered entity must implement hardware, software, and/or procedural mechanisms to record and examine access and other activity in information systems that contain or use e-PHI.²⁵

Integrity Controls. A covered entity must implement policies and procedures to ensure that e-PHI is not improperly altered or destroyed. Electronic measures must be put in place to confirm that e-PHI has not been improperly altered or destroyed.²⁶

Transmission Security. A covered entity must implement technical security measures that guard against unauthorized access to e-PHI that is being transmitted over an electronic network.27

Required and Addressable Implementation Specifications

Covered entities are required to comply with every Security Rule "Standard." However, the Security Rule categorizes certain implementation specifications within those standards as "addressable," while others are "required." The "required" implementation specifications must be implemented. The "addressable" designation does not mean that an implementation specification is optional. However, it permits covered entities to determine whether the addressable implementation specification is reasonable and appropriate for that covered entity. If it is not, the Security Rule allows the covered entity to adopt an alternative measure that achieves the purpose of the standard, if the alternative measure is reasonable and appropriate.²⁸

Organizational Requirements

Covered Entity Responsibilities. If a covered entity knows of an activity or practice of the business associate that constitutes a material breach or violation of the business associate's obligation, the covered entity must take reasonable steps to cure the breach or end the violation.²⁹ Violations include the failure to implement safeguards that reasonably and appropriately protect e-PHI.

Business Associate Contracts. HHS developed regulations relating to business associate obligations and business associate contracts under the HITECH Act of 2009.

Policies and Procedures and Documentation Requirements

A covered entity must adopt reasonable and appropriate policies and procedures to comply with the provisions of the Security Rule. A covered entity must maintain, until six years after the later of the date of their creation or last effective date, written security policies and procedures and written records of required actions, activities or assessments.³⁰

Updates. A covered entity must periodically review and update its documentation in response to environmental or organizational changes that affect the security of electronic protected health information (e-PHI).³¹

State Law

Preemption. In general, State laws that are contrary to the HIPAA regulations are preempted by the federal requirements, which means that the federal requirements will apply.³² "Contrary" means that it would be impossible for a covered entity to comply with both the State and federal requirements, or that the provision of State law is an obstacle to accomplishing the full purposes and objectives of the Administrative Simplification provisions of HIPAA.³³

Enforcement and Penalties for Noncompliance

Compliance. The Security Rule establishes a set of national standards for confidentiality, integrity and availability of e-PHI. The Department of Health and Human Services (HHS), Office for Civil Rights (OCR) is responsible for administering and enforcing these standards, in concert with its enforcement of the Privacy Rule, and may conduct complaint investigations and compliance reviews.

Learn more about enforcement and penalties in the Privacy Rule Summary - PDF and on OCR's Enforcement Rule page.

Compliance Dates

Compliance Schedule. All covered entities, except "small health plans," must have been compliant with the Security Rule by April 20, 2005. Small health plans had until April 20, 2006 to comply.

Copies of the Rule and Related Materials

See our Combined Regulation Text of All Rules section of our site for the full suite of HIPAA Administrative Simplification Regulations and HIPAA for Professionals for additional guidance material.
[1]Pub. L. 104-191. [3] 45 C.F.R. § 160.103. [4] 45 C.F.R. § 164.306(a). [5] 45 C.F.R. § 164.304. [6] 45 C.F.R. § 164.306(b)(2). [7] 45 C.F.R. § 164.306(e). [8] 45 C.F.R. § 164.306(b)(iv). [9] 45 C.F.R. § 164.308(a)(1)(ii)(B). [10] 45 C.F.R. § 164.306(d)(3)(ii)(B)(1); 45 C.F.R. § 164.316(b)(1). [11] 45 C.F.R. § 164.306(e). [12] 45 C.F.R. § 164.308(a)(1)(ii)(D). [13] 45 C.F.R. § 164.306(e); 45 C.F.R. § 164.308(a)(8). [14] 45 C.F.R. § 164.306(b)(2)(iv); 45 C.F.R. § 164.306(e). [15] 45 C.F.R. § 164.308(a)(2). [16] 45 C.F.R. § 164.308(a)(4)(i). [17] 45 C.F.R. § 164.308(a)(3) & (4). [18] 45 C.F.R. § 164.308(a)(5)(i). [19] 45 C.F.R. § 164..308(a)(1)(ii)(C). [20] 45 C.F.R. § 164.308(a)(8). [21] 45 C.F.R. § 164.310(a). [22] 45 C.F.R. §§ 164.310(b) & (c). [23] 45 C.F.R. § 164.310(d). [24] 45 C.F.R. § 164.312(a). [25] 45 C.F.R. § 164.312(b). [26] 45 C.F.R. § 164.312(c). [27] 45 C.F.R. § 164.312(e). [28] 45 C.F.R. § 164.306(d). [29] 45 C.F.R. § 164.314(a)(1). [30] 45 C.F.R. § 164.316. [31] 45 C.F.R. § 164.316(b)(2)(iii). [32] 45 C.F.R. § 160.203. [33] 45 C.F.R. § 160.202.

# data[].attributes.attachment_link.description
This is a summary of key elements of the Security Rule including who is covered, what information is protected, and what safeguards must be in place to ensure appropriate protection of electronic protected health information. Because it is an overview of the Security Rule, it does not address every detail of each provision.

# data[].attributes.body
The picture above is a real email we often receive in our inboxes as students and staff at JU. This is a phishing email, a type of cyber attack that is fairly common. In this email, the sender provides information about a "job" to entice the recipient to click on the link. The CLICK HERE TO APPLY link is the sender's attempt cause harm by several ways:

Install malware/ransomware

Compromise your account

Steal personal identity/credentials

It is imperative to understand what these emails truly are, an attempt to cause harm to you and the network you are connected to.

DO NOT EVER CLICK ON ANY LINKS FROM EMAILS LIKE THESE!

# data[].attributes.body
d’Aliberti, O. G., & Clark, M. A. (2022). Preserving patient privacy during computation over shared electronic health record data. Journal of Medical Systems, 46(12). https://doi.org/10.1007/s10916-022-01865-5

# data[].attributes.body
Kiania, K., Jameii, S. M., & Rahmani, A. M. (2023). Blockchain-based privacy and security preserving in electronic health: A systematic review. Multimedia Tools and Applications, 82, 28493-28519. https://doi.org/10.1007/s11042-023-14488-w

# data[].attributes.body
Kumar, S., Gupta, S., & Arora, S. (2021). Research trends in network-based intrusion detection systems: A review. IEEE Access, 9, 157761–157779. https://doi.org/10.1109/access.2021.3129775

# data[].attributes.body
McGonigle, D., & Mastrian, K. G. (2022). Nursing informatics and the foundation of knowledge (5th ed.). Jones and Bartlett Learning.

# data[].attributes.body
Overview of the HITECH Act of 2009.

# data[].attributes.attachment_link.provider_name
Journal of Ethics | American Medical Association

# data[].attributes.attachment_link.readable_text
Before the Patient Protection and Affordable Care Act, otherwise known as "Obamacare," or, more generally, health reform, Congress had already passed the most sweeping health care reform measures since Medicare was created nearly 45 years ago. As part of the American Recovery and Reinvestment Act (ARRA), Congress passed the Health Information Technology for Economic and Clinical Health Act (HITECH). HITECH changed the nature of the relationships among health care professionals, organizations, patients, and payors by focusing on the implementation and use of health information technology. It puts particular emphasis on privacy and security, including expanded application and enforcement. HITECH also provides incentives and subsidies for health information exchanges and education, which are outside the scope of this article.

Incentives

HITECH provides financial incentives to "eligible professionals" for the meaningful use of certified qualified electronic health records (EHRs). An eligible professional is generally a physician, though there are incentives for hospitals as well. Certified EHR technology includes those EHRs that have been certified by an authorized testing and certification body (ATCB) [1].

The incentive payments under HITECH are substantial: eligible professionals who demonstrate the meaningful use of an EHR in 2011 or 2012 will be entitled to incentive payments of $18,000 in the first year (only $15,000 after 2012); $12,000 for the second year; $8,000 for the third year; $4,000 for the fourth year; and $2,000 for the fifth year [2]. After 2015, physicians who fail to meaningfully use EHRs will be subject to reductions in Medicare and Medicaid reimbursement [2].

The criteria for meaningful use are based on a series of specific objectives, each of which is tied to a measure that allows physicians to demonstrate that they are meaningful users of certified EHR technology. The final meaningful use standards for Stage 1 (of three) were published by the Department of Health and Human Services in 2010. For Stage 1, which begins in 2011, physicians must meet 15 mandatory (core) criteria and choose 5 of the 10 "menu" criteria. Each objective was evaluated for its potential applicability to all physicians and eligible hospitals. Where it is impossible for a physician to meet a specific measure, an exclusion defined in the final rule will apply [3].

The Stage 1 standards for meaningful use focus on electronically capturing health information in a coded format, using that information to track key clinical conditions, communicating that information for care coordination purposes, and initiating the reporting of clinical quality measures and public health information. All certified EHRs should enable a physician to meet these standards [1, 2]. Examples of meaningful use in Stage 1 include entry of patient demographic and insurance information, use of drug interaction software, and e-prescribing.

Stage 2 and 3 Criteria for Meaningful Use

Stage 2 meaningful use criteria will expand upon the Stage 1 criteria in the areas of disease management, clinical decision support, medication management support for patient access to their health information, transitions in care, quality measurement and research, and bidirectional communication with public health agencies. Information exchange is a critical part of care coordination, and Stage 2 criteria are expected to support health information exchanges and health information exchange activities [3].

Stage 3 criteria are expected to address improvements in quality, safety and efficiency, focusing on decision support for national high priority conditions, patient access to self-management tools, access to comprehensive patient data, and improving population health outcomes [3].

The criteria will become more stringent over time [4].

Privacy and Security under HITECH

HITECH expands on the notions of privacy and security found in the Health Insurance Portability and Accountability Act of 1996, known as HIPAA. The HIPAA regulations, in brief, prohibit the disclosure of individually identifiable health information, otherwise known as protected health information or PHI, without the consent of the patient (or guardian or other responsible person) except for three purposes: treatment, payment, or health care operations. HIPAA applies directly to "covered entities," defined as health care payors, providers, and clearinghouses.

Under HIPAA, "business associates"-a term referring to people or entities who, on behalf of covered entities, perform tasks that necessitate access to PHI-were not directly regulated, but were bound to comply with HIPAA pursuant to mandatory written agreements with the covered entities. HITECH, by contrast, provides for direct regulation of business associates and stipulates that HIPAA's privacy and security rules apply to them.

HITECH also dramatically increases the required response to breaches of PHI and the enforcement of such requirements [5, 6].

Notification of Breach

HITECH mandates public notification of security breaches when "unsecure PHI" is disclosed or used for an unauthorized purpose. ("Secure PHI," on the other hand, is not subject to such requirements because it is encrypted and cannot be breached [6].) These notification requirements are similar to many state and federal data breach laws pertaining to financial information.

In general, the act requires that patients be notified of any breach of their data security, whether external or internal. If a breach affects 500 patients or more, then HHS must also be notified and the name of the institution where the breach occurred will be posted on the HHS web site. Under certain conditions, local media will also need to be notified. This provision is yet another example of the act's emphasis on privacy and security concerns [4].

Electronic Health Record Access

When a health care practice or organization implements an EHR system, the act gives patients in those practices (or third parties they designate) the right to obtain their PHI in an electronic format. This requirement is similar to state laws that mandate patient access to their own paper medical records. The act specifies that charges for such requests may only cover the labor cost of fulfilling the request. Although one might presume that such a request requires a few clicks, the reality is that even practices with an EHR system already in place may not have this capability.

Penalties and Enforcement

While HITECH is a federal law, it grants both the Department of Health and Human Services and state attorneys general the authority to enforce the law. This dual enforcement authority raises the specter of politically motivated investigations of PHI disclosures by ambitious state attorneys general. As health lawyers have advised physicians for years, the investigation will do as much damage as the penalty. The key is compliance in advance.

Civil penalties are mandatory if there is a violation due to willful neglect. For example, in situations in which a person is unaware of a violation (despite due diligence), the minimum penalty is $100 per violation, with a cap of $25,000 for violations of an identical requirement during a calendar year. If the violation is due to "willful neglect," however, the minimum penalty is $10,000 per violation, with a cap of $250,000 for violations of an identical requirement during a calendar year, and the maximum penalty is $50,000 per violation, with a cap of $1.5 million [7, 8].

Conclusion

HITECH has laid the groundwork for a positive revolution in the delivery of health care. Compliance is key, and HITECH provides both positive incentives in the form of meaningful use payments and negative incentives in the form of civil penalties and the threat of prosecution at the state level.

Citation

Virtual Mentor. 2011;13(3):172-175.

DOI
10.1001/virtualmentor.2011.13.3.hlaw1-1103.
The viewpoints expressed in this article are those of the author(s) and do not necessarily reflect the views and policies of the AMA.

Author Information

Howard Burde, JD provides general counsel and health law advice to health information technology and health care organizations, payors, and associations such as the Health Information Management Systems Society (HIMSS), the bipartisan Pennsylvania Joint Legislative Committee on Health Reform, and the National Governors Association's State Alliance for e-Health. He serves on the editorial boards of health law publications, including the BNA Health Law Reporter and the Journal of Health and Life Sciences Law, and has written four books.

# data[].attributes.attachment_link.description
Before the Patient Protection and Affordable Care Act, otherwise known as "Obamacare," or, more generally, health reform, Congress had already passed the most sweeping health care reform measures since Medicare was created nearly 45 years ago. As part of the American Recovery and Reinvestment Act (ARRA), Congress passed the Health Information Technology for Economic and Clinical Health Act (HITECH).

# data[].attributes.body
U.S. Department of Health and Human Services. (2022). Summary of the HIPAA security rule. HHS.gov. https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html

# data[].attributes.headline
How does Blockchain Improve Privacy and Security?

# data[].attributes.subject
How does Blockchain Improve Privacy and Security?

# data[].attributes.body
Advanced encryption techniques are implemented with blockchain technology.

Decreases the chances of a single point of failure by using a decentralized network.

Once a block is created, it is extremely difficult to alter.

Those who can access each level of blockchain, e.g. hospitals, insurance companies, and healthcare workers, must be authenticated and authorized (Kiania et al., 2023).

# data[].attributes.attachment_link.title
How Blockchain Technology Could Change Healthcare

# data[].attributes.body
2. Explain how phishing works and how it can cause harm to an individual, network, or healthcare system.

# data[].attributes.body
3. What are the main goals of HIPAA and healthcare workers' responsibility towards patient privacy?

# data[].attributes.body
Security tools come in the form of software, such as programs used to prevent cyber attacks, and hardware, such as biometric devices and proxy servers (McGonigle & Mastrian, 2022). Another type of security tool is the education and training of staff to increase awareness of common types of cyber threats.

Antivirus Software

o Scan files in the computer for malicious software.

Firewall

o Monitors traffic and allows or blocks certain traffic depending on security rules.

Proxy Servers

o Masks the connection between the user and the server.

Intrusion Detection System (IDS)

o Monitors who access certain files in the network and alerts about unauthorized attempts to access the network.

# data[].attributes.body
Antivirus software is critical for protecting systems from malicious threats, especially with the high prevalence of web exploits. Protection from Java Exploits:

Java vulnerabilities account for 91% of all web exploits.

Antivirus software specifically designed to detect Java Archive (JAR) malware can significantly reduce these risks.

High Detection Accuracy with AI:

AI-based antivirus software achieves a detection accuracy of 91.58% for distinguishing between benign and malicious JAR files.

Traditional commercial antivirus software only detects about 34.95% of such malware on average.

Dynamic and Proactive Threat Detection:

AI-based systems use dynamic analysis to effectively counter obfuscation techniques used by malware developers.

Proactive detection methods ensure that even new and evolving threats are identified and neutralized promptly.

Significance:

Enhanced Security: Ensures comprehensive protection against a wide range of malware, reducing the risk of data breaches and system infections.

Adaptability: AI-driven antivirus software adapts to new threats, providing ongoing protection without the need for constant manual updates.

Reliability: High detection rates and the ability to catch previously undetected variants make AI-based antivirus solutions more reliable than traditional methods.

# data[].attributes.attachment_link.provider_name
Cybersecurity and Infrastructure Security Agency CISA

# data[].attributes.attachment_link.readable_text
Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

# data[].attributes.attachment_link.title
Understanding Anti-Virus Software | CISA

# data[].attributes.attachment_link.description
Keep anti-virus software up to date to help protect your systems and information.

# data[].attributes.body
What is a Firewall?

A firewall is a network security device or software that monitors and controls incoming and outgoing network traffic based on predetermined security rules.

Purpose: Firewalls are designed to protect networks from unauthorized access, cyber attacks, and malware.

Types of Firewalls

Packet-Filtering Firewalls:

Analyzes packets in isolation without inspecting the contents.

Filters based on source and destination IP addresses, ports, and protocols.

Stateful Inspection Firewalls:

Monitors active connections and tracks the state of network traffic.

Provides more security by understanding the context of data packets.

Proxy Firewalls:

Acts as an intermediary between users and the internet.

Filters requests and responses, adding an extra layer of protection.

Next-Generation Firewalls (NGFW):

Combines traditional firewall capabilities with advanced features like deep packet inspection and intrusion prevention systems.

Offers more comprehensive security by addressing modern threats.

Unified Threat Management (UTM) Firewalls:

Integrates multiple security features into a single device, including firewall, antivirus, anti-spam, and VPN.

Simplifies security management and reduces complexity.

# data[].attributes.attachment_link.readable_text
A firewall is a network security device that monitors incoming and outgoing network traffic and decides whether to allow or block specific traffic based on a defined set of security rules.

Firewalls have been a first line of defense in network security for over 25 years. They establish a barrier between secured and controlled internal networks that can be trusted and untrusted outside networks, such as the Internet.

A firewall can be hardware, software, software-as-a service (SaaS), public cloud, or private cloud (virtual).

# data[].attributes.attachment_link.description
A firewall is a network security device that monitors traffic to or from your network. It allows or blocks traffic based on a defined set of security rules.

# data[].attributes.body
A proxy server acts as an intermediary between clients and servers, intercepting requests from clients and forwarding them to the appropriate server. It can enhance performance by caching frequently accessed resources, thereby reducing response times and network traffic (Valdovinos et al., 2024).

Functionality:

Privacy: Masks the client's IP address, providing anonymity.

Security: Filters incoming and outgoing traffic, blocking malicious content.

Performance: Caches frequently accessed resources, reducing bandwidth usage.

# data[].attributes.body
An Intrusion Detection System (IDS) is a security technology designed to monitor network or system activities for malicious actions or policy violations. It analyzes data passing through the network, compares it against a database of known threats, and alerts administrators if any suspicious activity is detected. IDS can be categorized into two types:

Network-based IDS (NIDS)

Host-based IDS (HIDS)

NIDS monitors network traffic for unusual patterns, while HIDS analyzes activities on individual devices. By providing real-time monitoring and alerting, IDS helps organizations detect and respond to potential security breaches promptly (Kumar et al., 2021).

# data[].attributes.body
Using the home health nurse’s story as an example, a VPN would allow the nurse to use an unsecured network, such as a hotspot or even Mr. Smith’s home Wi-Fi, to establish a secured network to transmit data necessary to access the patient’s EHR. As described by Akinsanya et al. (2024), a VPN “creates a secure, encrypted tunnel which data can be transmitted between two endpoints.” VPNs allow remote access to cloud-based services to retrieve sensitive patient information and encrypt the data to prevent breaches.

# data[].attributes.body
About two decades ago, before cloud computing, information was stored and accessed in the local hard drive of the computer. Cloud-based computing services have changed how information is handled, stored, and transmitted. You probably use them in everyday life. Amazon, Apple iCloud, and Google Drive are examples of these cloud services (McGonigle & Mastrian, 2022). Cloud services allow information to be stored on the internet which improves work location flexibility, increases collaboration between employees, and provides security through encryption and regular software updates (McGonigle & Mastrian, 2022).

# data[].attributes.body
Another potential network breach of sensitive patient information can be when an employee either loses their portable device or it is stolen. This can give cybercriminals easy access to the information they desire. It is imperative to equip employees with the proper training to mitigate the loss or theft of portable devices. Training employees in physical security, such as stowing devices away from sight in cars, locking doors while in transport, and device tracking are great examples of interventions that can be applied to mitigate the loss or theft of these devices. Overall, the agency is responsible for lost or stolen devices, especially if it leads to a breach of sensitive information. However, employees can be suspended, terminated, or fined depending on the severity of the breach (McGonigle & Mastrian, 2022).

# data[].attributes.body
Picture yourself in a nurse informaticist role in a large hospital. You, along with the Chief Information Officer, a network engineer, and a team of IT specialists design a network with the latest technology, with multi-layered security measures including antivirus software, firewalls, proxy servers, and IDS. You and the IT team, rightly so, are proud of the fortress created to maintain the confidentiality of private patient information, maintain the integrity of the information, and the information is easily accessible throughout the network to those identified as authorized users.

John, a new hire to fill a critical role within the hospital, has been on the job for two weeks and has access to the network. Unfortunately, he did not receive proper cyber awareness training during his orientation. John receives an email, stating it is from the IT department and that he needs to update his login credentials. So, he does what the email asks and inputs his credentials. Unbeknownst to John, he just handed the keys to the hospital’s network to cybercriminals.

A single instance of human error compromised all of the hard work by you and the IT team to secure the hospital's network.

# data[].attributes.body
Valdovinos, I. A., Figueroa-Millan, P. E., Guerrero-Ibáñez, J. A., & Chavez-Valdez, R. E. (2024). Design, implementation, and evaluation of an embedded CoAP proxy server for 6LoWPAN. IEEE Access, 12, 15594–15608. https://doi.org/10.1109/access.2024.3358678

# data[].attributes.body
There is a common saying among cyber and IT professionals that the weakest link in cybersecurity is the end user. It is futile to have the latest and greatest technology in cybersecurity if there is no staff training to increase their awareness of cyber threats. As stated in the video above, approximately 90% of cyberattacks begin with a phishing email.

Staff education and training is an important aspect of cybersecurity. The human factor will continue to be exploited by cybercriminals who desire to gain access to sensitive patient information. Implementing staff training is a way to combat cyber threats and maintain a safe network that is free from vulnerabilities caused by human error. By equipping employees with the knowledge and skills to recognize common cyber threats, organizations can reduce the risk of breaches.

# data[].attributes.attachment_link.title
Cybersecurity Crisis in Healthcare: Why Awareness Training is Crucial

# data[].attributes.body
4. Describe common security tools used to combat cyber attacks. In your opinion, which one is the most effective?

# data[].attributes.body
Emily Izo

Introduction

Cybersecurity Video Link

Threats to Security

Security Tools

Question #1

Allan Ganuza

Antivirus Software

Firewall

Proxy Servers

Intrusion Detection Systems (IDS)

Marcie Hayden

Authenticating Users Section

Multi-Factor Authentication Video Link

Abigail Grego

HIPAA Overview Web Link

Question #3

JP Lima

Key Laws

HITECH Overview Web Link

Network Security Section

Common Types of Cyber Threats

Phishing Email Example

Security Tools (Cont.)

Investing in Staff Training

Investing in Staff Training (Cont.)

Portable Devices Section

Question #2 and #4