# data[].attributes.body
Physical, technical and administrative safeguards are in place to protect the privacy, security and integrity of recorded patient information, while at the same time allowing appropriate access to health providers for the care and management of patients. Physical safeguards include device isolation, allowing direct physical access only to authorized personnel; data backup and maintaining copies, emergency contingency protocols, and proper device disposal. Technical safeguards include firewalls and secure transmission modes for communication such as virtual private networks (VPN) or secure sockets layer (SSL), and encryption techniques.

# data[].attributes.attachment_link.readable_text
Summary

At A Glance

Patients have the right to determine how their health information is shared.

Radiologists and other physicians are working to ensure that electronic medical information is properly protected.

Patients who believe their health information has been misused should contact their physician or physician's administrative staff immediately.

Interest is increasing in the security of electronic medical information, or patient health information, that is digitally stored. Sometimes this information needs to be accessed for physicians to be able to make the best decisions about patient care. Patients have the right to determine how and when their health information is shared.

Radiologists are at the forefront of trying to protect confidential electronic medical information from being misused. Several radiology organizations are currently working to develop policies and standards related to the protection of medical information, as well as improving technology to ensure this information is safeguarded.

Physicians have responsibilities when it comes to protecting electronic medical information. Radiologists and other physicians must document all use of patient information, share privacy and security policies with their patients, and report any loss of information. Patients should contact their physician or physician's administrative staff immediately if they suspect misuse of their electronic health information.

For more detailed information on patient privacy and security of electronic medical information, continue reading.

What is security of electronic medical information?

Radiologic images, lab test results, medications, allergies, and other clinical information are increasingly being stored and viewed on computers. The responsibility that physicians have to protect their patients from harm extends to protecting patient information, privacy and confidentiality. Patient information security includes the steps healthcare providers must take to guard patients' "protected health information" commonly referred to as PHI, from unauthorized access or breaches of privacy or confidentiality. Security also refers to maintaining the integrity of electronic medical information, and ensuring availability to those who need access and are authorized to view such clinical data, including images, for the purposes of patient care. The federal government requires the secure handling of electronic media and PHI with standards put forth in the Health Insurance Portability and Accountability Act (HIPAA) of 1996.

Research and educational activities are not exempt from the privacy and security requirements for PHI. Institutional policies protect the privacy of individually identifiable health information, while allowing reasonable access to medical information by the researcher, educator or trainee.

What is patient privacy?

Patient privacy refers to the right of patients to determine when, how and to what extent their health information is shared with others. It involves maintaining confidentiality and sharing identifying data, known as protected health information (PHI), only with healthcare providers and related professionals who need it in order to care for the patient.

Why are security and patient privacy important?

The secure management of electronic medical information may have an impact on the quality of patient care, patient rights, and healthcare professionals and their current work practices and legal responsibilities. Doctors can make the best decisions about medical care if they have access to all relevant information in their patients' medical histories. Inability to access data may delay clinical management decisions and could adversely impact patient care. Patients have the right to maintain privacy and confidentiality of their PHI. Methods of protection must include considerations for timely and easy access to clinical information by the authorized healthcare professionals.

What are radiology professionals doing to safeguard medical images and patient information?

Radiologists have been at the forefront of adopting digital medical imaging and electronic health information. They have recognized the many benefits and are working to eliminate risks. Through organizations like the American College of Radiology (ACR), Radiological Society of North America (RSNA) and Society for Imaging Informatics in Medicine (SIIM), healthcare professionals have worked with scientists, industry and health policy leaders to develop standards, create policies and procedures, adapt technologies, educate other physicians and health professionals, and experiment with promising new methodologies to provide high quality medical care to patients in a safe and secure environment.

What are the responsibilities of the radiologist and patient?

Radiologists are physicians and as such are responsible for protecting patient information, privacy and confidentiality, and securing patient data from loss or corruption. Physicians must document their privacy and security policies and communicate this information to their patients. All staff must be trained in security policies. There must be provisions for backup of all computer systems, proper storage and retention of all electronic data, maintenance of computers, system downtime procedures and recovery plans, incident reporting and resolution of security issues. Failure to comply with state and federal Electronic Protected Health Information (ePHI) state and federal regulations could result in financial and/or criminal penalties.

It is the patient's right to communicate with healthcare providers in confidence and to have any PHI protected. The patient is responsible for authorizing any release of PHI, except when required by law.

What should you do if you think your health information has been accessed inappropriately?

If you believe that your PHI has been accessed or used inappropriately, report your concerns to your physician or administrative staff of the physician office or hospital immediately. Federal rules created to enforce the HIPAA legislation specify steps that care providers and their business associates must take to investigate, report and address any unauthorized acquisition, access, use or disclosure of PHI that compromises the security or privacy of the information. Care providers are required to provide all individuals affected by any such breaches with a description of the incident, including information about what steps they should take to protect themselves and what steps the care provider will take to recover the loss and avoid further breaches. The report must include contact information of an individual assigned to answer questions from individuals affected by the breach.

How is medical information kept secure and private?

Physical, technical and administrative safeguards are in place to protect the privacy, security and integrity of recorded patient information, while at the same time allowing appropriate access to health providers for the care and management of patients. Physical safeguards include device isolation, allowing direct physical access only to authorized personnel; data backup and maintaining copies, emergency contingency protocols, and proper device disposal. Technical safeguards include firewalls and secure transmission modes for communication such as virtual private networks (VPN) or secure sockets layer (SSL), and encryption techniques.

Administrative safeguards include requirements for documenting departmental security policies, training staff about these policies, maintaining audit trails of all system logs by user identification and activity, enforcing policies for storage and retention of electronic data and backup of all systems, adhering to specific methods for incident reporting and resolution of security issues, and clearly documenting accountability, sanctions and disciplinary actions for violation of policies and procedures.

Electronic medical records (EMR) must incorporate the following components within their system security policies and procedures: authorization, authentication, availability, confidentiality, data integrity and nonrepudiation. The methods available for authorization or access controls include single sign-on databases or lists assigning rights and privileges of users to access certain resources, automatic account logoff after a specified period of inactivity to prevent access by invalid users, and physical access controls.

Authentication is the process of verifying the identity of a user to a computer system and can be accomplished using login passwords, digital certificates, smart cards and biometrics. Authentication only verifies the identity of an individual. It does not define their access (authorization) rights.

EMRs must be continuously available and system administrators must defend against various threats providing fault tolerance for their systems (duplicated hardware, data archives, power and networking systems), provide physical safety of servers, and incorporate preventative virus and intrusion detection.

To maintain confidentiality, unauthorized third parties must be prevented from accessing and viewing medical data. This can be accomplished by preventing physical access to the data using such technologies as switched networks, and by encrypting the data so that even if it is physically obtained, it cannot be read.

It is essential to maintain data integrity when transferring information by verifying that the information arrived as it was sent and was not modified in any way. Methods to maintain data integrity include intrusion detection such as tripwire, and message digest or hashing to detect any alteration of the data.

Nonrepudiation ensures that a transferred message has been sent and received by the parties claiming to have sent and received the message, providing a record of the transaction. Digital signatures and system audit logs of all user activity are methods of nonrepudiation.

# data[].attributes.attachment_link.authors[].name
Radiological Society of North America (RSNA) and  American College of Radiology (ACR)

# data[].attributes.attachment_link.title
Patient Privacy and Security of Electronic Medical Information

# data[].attributes.attachment_link.description
Patients have the right to determine how their health information is shared. Radiologists and other physicians are working to ensure that electronic medical information is properly protected. Patients who believe their health information has been misused should contact their physician or physician's administrative staff immediately.

# data[].attributes.headline
Keeping Your Electronic Health Information Secure

# data[].attributes.subject
Keeping Your Electronic Health Information Secure

# data[].attributes.body
Most of us feel that our health information is private and should be protected. The federal government put in place the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule to ensure you have rights over your own health information, no matter what form it is in. The government also created the HIPAA Security Rule to require specific protections to safeguard your electronic health information. A few possible measures that can be built in to EHR systems may include: “Access control” tools like passwords and PIN numbers, to help limit access to your information to authorized individuals. “Encrypting” your stored information. That means your health information cannot be read or understood except by those using a system that can “decrypt” it with a “key.” An “audit trail” feature, which records who accessed your information, what changes were made and when. •••Finally, federal law requires doctors, hospitals, and other health care providers to notify you of a “breach.” The law also requires the health care provider to notify the Secretary of Health and Human Services. If a breach affects more than 500 residents of a state or jurisdiction, the health care provider must also notify prominent media outlets serving the state or jurisdiction. This requirement helps patients know if something has gone wrong with the protection of their information and helps keep providers accountable for EHR protection.

# data[].attributes.headline
What is an Appropriate Level of Authentication for Online Patient Access to Health Information?

# data[].attributes.subject
What is an Appropriate Level of Authentication for Online Patient Access to Health Information?

# data[].attributes.body
When a patient first gets set up with a login for a healthcare application, like a patient portal or healthcare mobile app, there is a belief among some that this initial access setup needs to happen in person. While this is an option, it’s not a requirement. A simpler, alternative option is for a patient to provide an email address either in person or by phone for where the registration invitation will be sent. This is a step up from most setup authentications on the web, where the email address is entered into a registration form. Patients could also register autonomously, also referred to as self-registration, by asking the patient challenge questions produced by a 3rd party such as IDology.

While these two options are less secure than in-person authentication, these options may be preferred for convenience purposes. By simplifying the process for gaining access to the patient portal, a provider can boost portal use to gain benefits such as improved patient engagement, more efficient appointment scheduling and cancellations, and enhanced treatment plan adherence. The main takeaway is to set up procedures that verify that the person requesting access to ePHI is who he or she claims to be.

At Bridge Patient Portal, one of the most common complaints made by healthcare organizations using other patient portals, typically bundled with their EHR vendor, is the cumbersome process patients must go through to register.

# data[].attributes.attachment_link.readable_text
Of the three main components of HIPAA - the Privacy Rule, the Security Rule, and the Breach Notification Rule - the Security Rule is one that is particularly relevant to health application development in the healthcare sphere. The majority of these applications, from patient portals to mhealth apps , store or transmit electronic Protected Health Information (ePHI). It's essential to keep this information safe, and the Security Rule has in-depth guidance on the extent to which this needs to be accomplished, but with a fair amount of flexibility as to the strategies for implementation.

Here, we decode the Security Rule as it applies to patient portal and mHealth app development , specifically in regards to user authentication. In of this series, we cover auditing, and in we discuss issues related to data transfer, such as encryption and notifications.

What is an Appropriate Level of Authentication for Online Patient Access to Health Information?

When a patient first gets set up with a login for a healthcare application, like a patient portal or healthcare mobile app, there is a belief among some that this initial access setup needs to happen in person. While this is an option, it's not a requirement. A simpler, alternative option is for a patient to provide an email address either in person or by phone for where the registration invitation will be sent. This is a step up from most setup authentications on the web, where the email address is entered into a registration form. Patients could also register autonomously, also referred to as self-registration, by asking the patient challenge questions produced by a 3rd party such as IDology.

While these two options are less secure than in-person authentication, these options may be preferred for convenience purposes. By simplifying the process for gaining access to the patient portal, a provider can boost portal use to gain benefits such as improved patient engagement, more efficient appointment scheduling and cancellations, and enhanced treatment plan adherence. The main takeaway is to set up procedures that verify that the person requesting access to ePHI is who he or she claims to be.

At Bridge Patient Portal, one of the most common complaints made by healthcare organizations using other patient portals, typically bundled with their EHR vendor, is the cumbersome process patients must go through to register.

Is Multifactor Authentication Necessary?

Multifactor authentication is defined as requiring a patient to produce more than one type of credential to log in to an application. The majority of logins only require a user to enter information that he or she knows. In multifactor authentication, this can be supplemented by requirements to enter a code from an object like a card, security token, or cell phone via SMS message, and/or by direct verification of identity, like a fingerprint or challenge questions. As passwords and access to email accounts can easily be compromised, multifactor authentication is growing in popularity for portal user authentication and portal user registration. While the HIPAA Security Rule does not require multifactor authentication, it is important to thoroughly consider its provisions on information access management and access control to determine how to best account for them in your healthcare application.

How Strong Do Passwords Need to Be?

Password strength is an area that is gaining increasing attention across industries. While HIPAA does of course require passwords, there is no specific legal specification on password strength. Therefore, each healthcare organization can decide on requirements during the application development phase. However, there are numerous documents discussing best practice, and ONC certified patient portals do require a specific password strength.. The cross-industry best practice for passwords is that they: (1) are over 8 characters long, (2) include a combination of upper and lower case letters, and (3) include at least one numeric and/or special character.

How Should Passwords Be Managed and Monitored?

HIPAA does include addressable implementation specifications on password management and login monitoring. Addressable means that an organization can make the decision to implement the specification as is, choose to put an alternate security measure or measures in place, or even - if the specification is not reasonable or appropriate to the particular entity - implement nothing. The key is that the decision and reasoning behind it must be documented in written form, with in depth consideration and appropriate justification demonstrated.

In this case, HIPAA stipulates that Covered Entities and Business Associates include several important points in their security awareness programs . One is to train staff on procedures for creating, changing, and safeguarding passwords. The other is that staff also learn how to monitor login attempts by external users and to report any potentially problematic login activity, such as failed login attempts. Each organization needs to consider these addressable matters in depth to plan, document, and implement its strategy.

What Are the Login Timeout Requirements, and How Does This Apply to a Personal Mobile Device?

HIPAA includes automatic logoff - when the application ends a user's session after a specific time period of inactivity - as another addressable implementation specification. However, the time to logoff is not stated. In choosing the number of minutes of allowed inactivity before a session is terminated, it's important to consider on what device and in what environment the application will be used. If you're working with an mhealth app that will be used by patients on their phones anywhere they go, including crowded areas, a very quick time to logout of 2 to 3 minutes is advisable. However, if you're working with the physician side of a patient portal that will be used in a private doctor's office, a longer time to logout, like 10 to 15 minutes, is acceptable.

We've only scratched the surface of the Security Rule. Check out (HIPAA auditing) and (encryption, servers, and notifications to patients).

(Visited 2,573 times, 3 visits today)

Post tags: hipaa, patient portal registration, Portal User Authentication, secure patient portal

# data[].attributes.attachment_link.authors[].name
Business Development Manager at Bridge Patient Portal. Passionate about helping healthcare businesses grow.

# data[].attributes.attachment_link.title
HIPAA and Healthcare Applications, Part 1 of 3: What You Need to Know About User Authentication - Bridge Patient Portal

# data[].attributes.attachment_link.description
Of the three main components of HIPAA - the Privacy Rule, the Security Rule, and the Breach Notification Rule - the Security Rule is one that is particularly relevant to health application development in the healthcare sphere. The majority of these applications, from patient portals to mhealth apps , store or transmit electronic Protected Health Information (ePHI).

# data[].attributes.headline
Identity Authentication: Guidance and Risk Analysis

# data[].attributes.subject
Identity Authentication: Guidance and Risk Analysis

# data[].attributes.body
Summary of Identity Authentication the document covers identity authentication primarily in the section on tokens but other sections are also relevant. There are three factors as the cornerstone of identity authentication: Something you know (for example, a password) Something you have (for example, an ID badge or a cryptographic key) Something you are (for example, a fingerprint or other bio-metric data) Multi-factor authentication refers to the use of more than one of the factors listed above, which requires to reach a high level of confidence in authentication. At least one of the factors must contain a secret that is securely presented to the electronic process that is verifying the user’s identity. A second factor can be used to protect or activate the first, so that a bio-metric such as a fingerprint can be incorporated in this way.

# data[].attributes.attachment_link.title
Electronic Health Records: Privacy And Security

# data[].attributes.body
ONC-ATCB Certification

Audit Trails

Password Protection

Data Encryption

# data[].attributes.attachment_link.readable_text
Too many physicians write off EHR software as counterproductive programs.

It can seem like too much of an inconvenience: you buy new software, then switch all existing patient files over to the new system and change everything about the way patient health information is tracked.

I get it, that's a lot. But failure to adopt an EHR system will only result in patient privacy violations down the line.

In fact, most EHR systems come with strong security features built-in to help protect patient privacy and prevent data breaches. So physicians who resist adoption of EHR systems are putting their patients' privacy on the line and will inevitably find themselves in violation of HIPAA regulations.

In this article, we'll review patient privacy and go through some of the essential features in EHR systems that serve to protect you and your patients.

Patient Privacy Matters

Patient privacy is a big deal. We know it matters to patients because we asked them back in 2015.

Eighty-six percent of respondents expressed some level of concern about a health information security breach. Almost a quarter of patients surveyed (21 percent) said they have withheld personal health information from their doctors due to fear of a security breach that may result in identity theft.

And finally, over half of patients said they would find a new doctor if their current physician's office suffered a security breach.

We also know that security is a concern for medical practices thanks to a 2017 Gartner survey on Top Technology Trends.

This was clear when small and midsize health care practices were asked to rank a list of potential roadblocks towards achieving business goals in the coming years:

29 percent selected "using the right technologies" and "complying with government regulations"

18 percent selected "employing data protection and security"

Knowing how patients feel about the risk of a data breach and how physicians feel about adopting new technologies, you might be wondering: Why bother with an EHR at all?

Well, the short answer is because you have to in order to stay eligible for Medicare and Medicaid reimbursement.

The longer answer is physicians who hesitate to adopt EHRs are endangering their practices by risking HIPAA violations -violations that can be easily prevented through the use of certified EHRs that follow protocol automatically and protect users from many common mistakes.

EHR security measures come standard with most systems in the form of features. Here's where we'll discuss a few of the most essential security features of EHR systems.

Many EHR Security Measures Come Standard

The main benefit of adopting an EHR is the software's intrinsic ability to protect you and your patients from data breaches thanks to a few features that come standard with most products. Those features are:

ONC-ATCB Certification

It's true that software products in any market will vary in the list of features offered, but physicians are fortunate enough to have the government mandate a few features that IT vendors must provide to all users.

Thanks to these requirements, the first question you need to ask yourself about the system you're selecting is a simple one: Is the product ONC-ATCB Certified?

This is a straightforward yes or no question for vendors-either their software has been tested and approved by an Authorized Testing and Certification Body recognized by the Office of the National Coordinator, or it hasn't.

If the answer is "no," you should move to the next product on your list.

If the answer is "yes," you can move forward with evaluating that product.

We've previously covered the different Authorized Testing and Certification Bodies and what they look for when evaluating EHR systems. To quickly recap, there are three main " checkpoints " products are required to pass in order to become certified. They are:

Functionality: Ability to create and manage records for patients.

Interoperability: Ability to communicate patient information with other systems.

Security: Ability to protect patient information from being stolen or wrongfully shared.

There are almost 400 different criteria being looked at within those three checkpoints, so you can bet any product with this certification has been thoroughly vetted.

WHAT'S AT STAKE: Practices that adopt EHR systems without proper certification will have their bottom line affected by not meeting government requirements for certain reimbursement programs. You could also end up paying for a system that doesn't meet security standards and is therefore more vulnerable to a breach.

Audit Trails

Audit trails provide documentation to keep track of every single action taken with patients' information by automatically registering and recording who accesses the system, where they are, when they're accessing and what they do once they're in.

Audit trail feature within Practice Fusion
By logging all of this information, EHR systems enable users to conduct regular reviews and flag suspicious activity that could lead to HIPAA violations. Reviews can also prevent mistakes caused by human error, which we cover in more detail with the follow-up to this report.

Many EHR systems with auditing capabilities and patient portals can be set up to send notification emails to patients every time their information is accessed. This transparency allows patients to quickly report possible breaches if a notification email is received when they did not log into their account.

As with most things, the sooner you become aware of a problem, the sooner you can fix it-and audit trails will make the fixing a great deal easier.

WHAT'S AT STAKE: Practices adopting EHRs with minimal or nonexistent auditing features are automatically making things more difficult. Without this feature, you'll have to manually record every action taken that deals with patient information or face heavy consequences when-not if-a security breach occurs.

Password Protection

This one might seem like a no-brainer, but it goes beyond simply requiring users to create a password to access their information. Because of the sensitive nature of patient data, EHRs should offer additional access controls such as:

Lockout capabilities that will forbid access if the wrong password is entered too many times.

Complex password requirements (such capitalization, numbers and special characters) to ensure passwords created for the system will be difficult to guess.

Regular password resets to keep old passwords from turning into a potential data breach.

Security questions to help further validate users beyond a password.

Two-factor authentication to provide an additional layer of security.

Password settings within drchrono's EHR system
Of course, passwords are another area where human error can cause a lot of problems. And, while you can only do so much to make sure your patients take their passwords seriously, physicians have to accept responsibility for this potential privacy weakness as well.
A study in 2017 found that 73 percent of medical professionals have violated password security protocol by using a co-worker's password to access their EHR.
Knowing this, you're naturally going to want to enact a few strict best practices when it comes to using passwords in your own office. For example, you might want to set up password requirements so that when they're created they are complex and difficult to guess.

WHAT'S AT STAKE: If passwords are simple, shared among users or never changed, the odds of accidentally allowing outside access to patient information increases exponentially.

Data Encryption

Encrypting your data can go a little way towards helping cover over any lackluster passwords or sticky notes stuck to computer monitors (though I have to seriously recommend not writing down your password and leaving it where anyone walking by can see).

By coding the information in a way that can only be deciphered by authorized programs or users in possession of the access code, EHRs can make transferring patient data (such as test results or diagnoses to patients via patient portals or medical histories to referrals) safer.

Additionally, encryption can minimize damage in the event your data is stolen. It can also allow for securing information within your office when paired with a role-based access control, so only staff members with clearance can see the decrypted information.

Data encryption is not a required feature for HIPAA certification, but it's absolutely something you want to look into when evaluating EHR products.

If a software vendor you're interested in does not offer this security option, make sure you know why-Is it due to cost? Do they use a third-party to encrypt data?-and that you're happy with their reason for not doing so.

WHAT'S AT STAKE: Practices using EHRs without data encryption are most vulnerable when transferring data, which is required for things like treatment plans, referrals and prescriptions. Without encrypted data, hackers or unauthorized users can view and steal patient information.

Next Step: Assess Your Risk

Now that you're fully aware of the many built-in EHR security measures, you'll want to begin researching products to find the best system for your practice. First, though, you should conduct a security risk assessment.

HIPAA requires all "covered entities" to conduct one of these security risk assessments at least once a year, or any time changes are made to security protocols.

There are several tools to make these assessments easier, or practices can hire third-party or consultant firms to make the assessment for them. No matter what route you take, your security risk assessment should reveal a few important things:

A summary of all the protected health information (PHI) your practice creates, receives or transmits.

A list of every location, physical and digital, in which your practice's PHI is stored.

An assessment of your practice's current security measures.

An overview of possible threats/vulnerabilities in your practice's protocols.

The likelihood of each potential threat.

An evaluation of the impacts of those potential threats.

Once you determine where your potential problems lie, you can work on establishing a stronger plan to prevent them-whether that means adopting a new EHR system, creating stronger best practices for your team or both.

# data[].attributes.attachment_link.title
4 EHR Security Measures Designed to Protect Your Patients' Privacy

# data[].attributes.attachment_link.description
Too many physicians write off EHR software as counterproductive programs. It can seem like too much of an inconvenience: you buy new software, then switch all existing patient files over to the new system and change everything about the way patient health information is tracked. I get it, that's a lot.

# data[].attributes.headline
Nurses are key tools in protecting patients' healthcare security.

# data[].attributes.subject
Nurses are key tools in protecting patients' healthcare security.

# data[].attributes.body
-What is your role as a nurse in protecting patient healthcare information?

-Do you think patient confidentiality is compromised with the Electronic Health Record?

- In your opinion, are patient portals or electronic health records (EHR) secure?

# data[].attributes.attachment_link.readable_text
Target Audience and Goal Statement

This activity is intended for physicians, nurses, and other healthcare professionals practicing in the United States.

The goal of this activity is to summarize steps for incorporating security standards of the Health Insurance Portability and Accountability Act (HIPAA) into an electronic health record (EHR), consistent with the objectives of Meaningful Use.

Upon completion of this activity, participants will be able to:

1. Propose steps that eligible professionals can take to safeguard patient data in EHRs.

2. Plan appropriate communication for patients about how their data will be stored and used in EHRs.

3. Evaluate Meaningful Use criteria related to data security and privacy required as part of the EHR Incentive Program.

Disclosures

As an organization accredited by the ACCME, Medscape, LLC, requires everyone who is in a position to control the content of an education activity to disclose all relevant financial relationships with any commercial interest. The ACCME defines "relevant financial relationships" as financial relationships in any amount, occurring within the past 12 months, including financial relationships of a spouse or life partner, that could create a conflict of interest.

Medscape, LLC, encourages Authors to identify investigational products or off-label uses of products regulated by the US Food and Drug Administration, at first mention and where appropriate in the content.

Author(s)

Leon Rodriguez

Director, Office for Civil Rights, Department of Health and Human Services, Washington, DC

Disclosures

Disclosure: Leon Rodriguez, JD, has disclosed no relevant financial relationships.

Mr Rodriguez does not intend to discuss off-label uses of drugs, mechanical devices, biologics, or diagnostics approved by the FDA for use in the United States.

Mr Rodriguez does not intend to discuss investigational drugs, mechanical devices, biologics, or diagnostics not approved by the FDA for use in the United States.

Editor(s)

CME Reviewer(s)

Nurse Planner(s)

Accreditation Statements

For Physicians

Medscape, LLC is accredited by the Accreditation Council for Continuing Medical Education (ACCME) to provide continuing medical education for physicians.

Medscape, LLC designates this enduring material for a maximum of 0.25 AMA PRA Category 1 Credit(s)™. Physicians should claim only the credit commensurate with the extent of their participation in the activity.

Medscape, LLC staff have disclosed that they have no relevant financial relationships.
Contact This Provider

For Nurses

Medscape, LLC is accredited as a provider of continuing nursing education by the American Nurses Credentialing Center's Commission on Accreditation.

Awarded 0.25 contact hour(s) of continuing nursing education for RNs and APNs; none of these is in the area of pharmacology.
Contact This Provider

For questions regarding the content of this activity, contact the accredited provider for this CME/CE activity noted above. For technical assistance, contact [email protected]

Instructions for Participation and Credit

There are no fees for participating in or receiving credit for this online educational activity. For information on applicability and acceptance of continuing education credit for this activity, please consult your professional licensing board.

This activity is designed to be completed within the time designated on the title page; physicians should claim only those credits that reflect the time actually spent in the activity. To successfully earn credit, participants must complete the activity online during the valid credit period that is noted on the title page. To receive AMA PRA Category 1 Credit™, you must receive a minimum score of 70% on the post-test.

Follow these steps to earn CME/CE credit*:

1. Read the target audience, learning objectives, and author disclosures.

2. Study the educational content online or printed out.

3. Online, choose the best answer to each test question. To receive a certificate, you must receive a passing score as designated at the top of the test. We encourage you to complete the Activity Evaluation to provide feedback for future programming.

You may now view or print the certificate from your CME/CE Tracker. You may print the certificate but you cannot alter it. Credits will be tallied in your CME/CE Tracker and archived for 6 years; at any point within this time period you can print out the tally as well as the certificates from the CME/CE Tracker.

*The credit that you receive is based on your user profile.

# data[].attributes.attachment_link.title
EHRs and HIPAA: Steps for Maintaining the Privacy and Security of Patient Information

# data[].attributes.attachment_link.description
This activity is intended for physicians, nurses, and other healthcare professionals practicing in the United States. The goal of this activity is to summarize steps for incorporating security standards of the Health Insurance Portability and Accountability Act (HIPAA) into an electronic health record (EHR), consistent with the objectives of Meaningful Use.

# data[].attributes.body
Managing threats and cost

# data[].attributes.attachment_link.title
Medical Device Cybersecurity in Healthcare: Managing Threats and Costs

# data[].attributes.attachment_link.description
Welcome to the online newsroom for Vizient, Inc. The Newsroom site is designed to give journalists and media professionals access to Vizient company news, updates, our blog and biographies for healthcare industry experts.

# data[].attributes.body
Portable devices in healthcare can include IPAD’s, smart phones and laptops. These devices allow quick access to a patient’s health information (PHI). With the use of portable devices Physicians and other healthcare providers can manage and expedite decisions in treatment for their patients. This convenient accessibility comes with great risk. Data Breaches have become one of healthcare’s largest liabilities.

Major risk with portable devices include lost or stolen device, downloading viruses, unsecured internet/malware and allowing others to use your device. The State Attorney General and HIPPA are monitoring and prosecuting for HIPPA violations. These breaches can cost a healthcare entity into the millions depending on the severity of the breach. Now that hospitals are adopting the Bring your Own Device (BYOB) policy it is imperative for them to protect every patient’s EHR.

# data[].attributes.attachment_link.readable_text
Mobile devices have created a new communication channel between healthcare service providers and patients. However, the benefits of mobile devices in healthcare go beyond the communication channels. They enable better coordination, improve diagnostic accuracy, and build a bridge of trust.

Despite the benefits, lots of healthcare providers are reluctant to integrate mobile phones and tablets into their day-to-day practice. The reason for reluctance might be resistance to change. But some providers have a valid point that lack of better standards and policies in smart-phone use in healthcare can contribute to security risks. So it's important to understand the benefits and how they can be incorporated without causing any harm.

Here are the top advantages of using mobile devices by providers as well as patients and how they are transforming healthcare:

1. Better point-of-care coordination

In a traditional hospital, when a patient with an acute condition is discharged after the initial treatment and stabilization, the patient is given prescriptions and instructions by a nurse. The nurse explains how the prescriptions should be administered as well as the test and follow-up process. There is no way to ensure that the patient has understood the instructions or is following the procedures properly. Poor communication, product name ambiguities, and misunderstanding the product use instructions can cause these medication errors. This can lead to recurrence of the ailment and adversely impact patient's health. According to the National Center for Biotechnology Information (NCBI), prescription errors are responsible for 70% of medication errors.

Mobile devices are changing this dynamic. Doctors and nurses can now coordinate better with the patient about the diagnosis, medication and the follow-up process. They can also monitor whether the patient has understood the instructions properly. This point-of-care coordination is making a huge difference in patient recovery and decreasing the number of re-admissions. It is streamlining the process between the inpatient and outpatient care.

2. Seamless data flow

The healthcare system is a complex network. There is a continuous data flow between the healthcare providers and the patients. Along with this, the hospital administration also needs access to the data for accounting purposes. For this reason, the healthcare data network is supposed to conform with the Health Insurance Portability and Accountability Act (HIPAA). This act lays down the rules of sharing medical information amongst institutions.
Mobile technology is making this complex ecosystem move information more efficiently. Data can move through the network faster with phones and tablets working as end-points.

Healthcare providers can now have more control over the dispersion of information. They don't have to worry about misplaced papers, files, and folders. However on top of all this, cyber security is a major concern. But the pros of mobile health technology outweigh its cons. Moreover, mHealth interoperability has the potential to boost healthcare and improve overall provider and patient satisfaction.

Providers are investing in systems that can securely and seamlessly exchange data across the network.

3. Direct patient management

Initally, healthcare providers only had limited access to their patients and their data. There was no way to monitor the effect of medicine and administer up-to-date remedies directly. Mobile devices are changing this dynamic.

Phones, tablets, and wearables are being used to take regular vitals and keep logs on patients. Doctors and nurses can check up on the patient directly using mobile devices which can show how to administer a procedure. Providers can even teach family members the different aspects of patient care using mobile communication apps. Through the use of mobile devices, healthcare providers are taking a more active role in guiding their patients in the right direction. It has been helpful in improving the quality of care dramatically.

4. Enhances physician efficiency

Highly functioning physicians are the backbone of an efficient healthcare system. But it is a high-stress job. According to the American Medical Association (AMA), about 60 percent of Emergency Medicine doctors feel burned out. Physicians often complain that they have to spend a lot of time in data entry and other administrative tasks. Only 27 percent of their time is spent in patient care. In order to battle this problem, service providers are investigating ways to make the medical job less stressful. Phones and tablets are helping doctors solve problems faster with less stress.

Physicians can use mobile devices to record patient history with minimal errors. These devices provide better access to latest drug information and thus help make better decisions. They automate a lot of paperwork which frees up a physician's time. It also means that now doctors have every patients' information at their fingertips, so they have to spend less time providing the same level of care. Overall, the use of mobile devices in healthcare has improved physician performance and ensured better patient care.

5. Increases diagnostic accuracy

Keeping track of patient records using paper was a huge burden for the healthcare industry. Computers helped lessen the burden. Mobile devices are taking this to a new level through eliminating the need for paper usage. This has led to an increase in diagnostic accuracy. According to mHealth statistics 2016, 93% of physicians believe that mobile health apps can improve patient's health. (GreatCall)

Doctors and nurses are able to keep accurate and descriptive notes. Fewer mistakes are made due to ineligible handwritings. Mobile apps can run automatic checks on prescriptions and decisions. As a result, prescription errors have gone down significantly. As bedside tools, these devices are helping recognize causes and symptoms of pathogens and infectious diseases faster.

6. Provides convenience

Even in the field of medical education, mobile devices are replacing bulky medical textbooks. Health care professionals can rapidly access information from their portable devices. They don't have to waste time running to the library or carrying heavy medical books around. Students can find books, guidelines, reviews and new medical literature and journals conveniently from their smart-phones.

On the other hand, doctors and patients can share information without the need for physical meetings. With the advent of telemedicine apps, video conferencing is now possible.

7. Caters to customizations

Physicians deal with large numbers of patients every day. It's impossible for them to provide individual attention to each patient in a timely manner. Mobile devices are helping physicians custom design remedies without investing a huge amount of time.

Doctors can use patient data to create profiles and categorize them. These profiles can help doctors pinpoint the optimum solution for each patient. Without the help of mobile devices, this process can be complicated. But the convenience of mobile devices makes it easy for doctors to create individual level customization without investing too much time.

8. Real-time communication

Of course, the obvious benefit of mobile devices in healthcare is the improvement in communication. Doctors and nurses can inspect the patient's condition remotely using HD cameras. Regular real-time communication between provider and patients also builds rapport.

But the benefits of mobile devices in healthcare reach beyond the doctor-patient relationship. It is also promoting collaboration, consulting and sharing of knowledge globally. Experts from different corners of the world can consult each other in real-time to learn and share. In turn, the patients benefit from these collaborations and information sharing. In a survey of medical schools, about 80 percent of medical students used mobile devices to talk to their fellow students.

Conclusion

No doubt mobile technology is changing our daily routines. And now, it is changing the way we heal. The benefits of mobile devices in healthcare are discussed above to give you an appreciation of the possibilities in this area. However, the risks should not be ignored.

Using them without proper standards can lead to unsafe practices and breach of patient privacy. Healthcare service providers should thus implement a strategy that will help keep the quality of service high while keeping the patients safe. With a robust mobile strategy, healthcare providers can take advantage of the accurate and real-time information help improve end-to-end healthcare processes.

# data[].attributes.attachment_link.title
8 benefits of mobile devices in healthcare that you need to know

# data[].attributes.attachment_link.description
Mobile devices in healthcare have the potential to revolutionize the industry and transform medical care quality for the present and the future. This article covers how mobile technology is proving to be a boon to healthcare providers and patients today.

# data[].attributes.attachment_link.readable_text
Healthcare providers and other HIPAA-covered entities have embraced the mobile technology revolution and are allowing the use of Smartphones, tablets, and other portable devices in hospitals, clinics and other places of work; however, if mobile data security measures are insufficient, covered entities are at risk of violating HIPAA regulations. If that occurs, heavy fines can follow.

HIPAA and Mobile Devices and the Healthcare Industry

Many healthcare organizations choose to leverage the benefits of mobile devices, while keeping costs to a minimum. Bring Your Own Device (BYOD) schemes are introduced that permit physicians, nurses and other healthcare workers to bring their own personal devices and use them at work. Other opt to supply mobile healthcare devices to the staff; deeming it easier to maintain control and protect their networks.

Any HIPAA covered entity that chooses to use mobile devices in the workplace must implement and enforce a HIPAA mobile device policy to protect patient health data accessed through the device, stored on it, or transmitted by it. Unfortunately, while mobile healthcare devices are convenient, they are not without their risks. With hundreds or thousands of mobile devices now requiring access to a healthcare network, it is no surprise that mobile data security and HIPAA compliance have become two of the biggest concerns for CIOs, CISOs, Compliance Officers and health IT professionals.

Mobile Devices are a Potential Minefield of HIPAA Violations

Even if mobile devices are secured, there is considerable potential for the users of those devices to violate HIPAA rules or company policies - and not necessarily on purpose. There have been many recorded HIPAA violations in which the authorized exposure of PHI was accidental. Without adequate controls, devices could be compromised, and the electronic Protected Health Information (ePHI) stored on them exposed. There is also considerable potential for Smartphones, tablets and laptops to be targeted by cybercriminals, who view them as an easy entry point into healthcare networks.

Mobile healthcare devices often lack robust security controls, the devices are used to connect to networks via public Wi-Fi, and there is considerable potential for theft or loss. If patient privacy violations and HIPAA penalties are to be avoided, it is essential that mobile data security risks are thoroughly assessed and addressed.

Mobile Data Security: HIPAA Compliance Basics

One of the main aims of HIPAA legislation is to protect the privacy of patients and health plan members. HIPAA regulations force healthcare organizations and individual care providers to adopt a minimum set of standards to protect the privacy of patients and keep data secure.

Robust mobile data security and HIPAA compliance are not optional: Failure to comply with HIPAA regulations is likely to be costly. Fines of up to $1.5 million - per violation category, per year that the violation has been allowed to persist - can be issued by the Department of Health and Human Services' Office for Civil Rights. Other federal agencies can issued fines, as can state attorneys general. There is also the considerable cost of a breach response to cover if data is potentially exposed.

HIPAA Security Rule: Risk Assessments

One of the most fundamental elements of mobile data security is the risk assessment, a mandatory requirement under the HIPAA Security Rule. It is possible to construct robust security defenses by incorporating all of the standard defense measures: Firewalls, anti-virus protection, anti-malware programs, authentication and password controls etc.; however unless a full risk assessment has been conducted, it is impossible to know whether security vulnerabilities remain.

A risk assessment must cover the entire IT infrastructure; company policies; administrative processes; physical security controls, and all systems and equipment capable of storing, transmitting or touching ePHI. The HHS offers a risk assessment tool to assist in this regard.

As hackers find new ways to exploit networks and mobile devices to steal data, healthcare organizations must work at maintaining and improving security defenses. They must address new vulnerabilities that are inadvertently introduced, or develop over time as equipment and software ages. Risk assessments must therefore be conducted regularly.

HIPAA Security Rule: Technical Safeguards for Mobile Devices

In the HHS' HIPAA Security Series Guidelines, covered entities are informed that they "must consider the use of encryption for transmitting ePHI, particularly over the Internet."

HIPAA-covered entities must also "Implement technical security measures to guard against unauthorized access to electronic protected health information that is being transmitted over an electronic communications network."

It is not mandatory to encrypt data at rest; however covered entities should bear in mind the advice given in the HHS Security guidelines regarding data in motion, "As business practices and technology change, situations may arise where ePHI being transmitted from a covered entity would be at significant risk of being accessed by unauthorized entities."

The HHS Guidelines go on to say, "Where risk analysis shows such risk to be significant, a covered entity must encrypt those transmissions under the addressable implementation specification for encryption."

If covered entities allow the transmission of ePHI over an open network, such as via SMS messages, this would violate HIPAA rules. The SMS network is far from secure, and the potential for ePHI being intercepted is high. To avoid a HIPAA violation and reduce the probability of a data breach, ePHI should only be transmitted via a secure channel with end to end encryption.

Data Access, Integrity and Audit Controls for Mobile Devices

HIPAA requires covered entities "to implement technical policies and procedures that allow only authorized persons to access Protected Health Information." If mobile devices are used to access, store or transmit ePHI, they must have access controls in place to authenticate the user. Multi-layered security controls should be implemented to reduce the risk of unauthorized data access.

Any data stored on a mobile device - or transmitted by it - must have protections in place to ensure the data cannot be altered or destroyed, and controls must be put in place to allow devices to be audited. It must be possible to examine access to ePHI (and attempted access attempts), and any other activity performed on the device that has potential to affect data security.

Provided the appropriate security controls are put in place, the use of mobile devices in healthcare has huge potential to improve efficiency, productivity, reduce operational costs, as well as improve patient outcomes. The key is to make sure the devices do not place patient privacy at risk or provide criminals with an easy access point into the network.

Mobile Data Security: HIPAA Compliance Tips

# data[].attributes.attachment_link.title
Mobile Data Security and HIPAA Compliance

# data[].attributes.attachment_link.description
Healthcare providers have embraced mobile technology and are allowing the use of smartphones, tablets and other portable devices in hospitals, clinics and other places of work. However, if mobile data security and HIPAA compliance are not considered first, covered entities are at risk of violating HIPAA regulations.

# data[].attributes.body
Threats to data security in healthcare organizations are becoming a widespread problem.  According to a nationwide survey by the Computing Technology Industry Association (CompTIA) human error is responsible for more than half of the security breaches.  Examples are carelessness and lack of website experience.  The negligent insider is the most common source of a security breach, this includes lost or stolen devices or simply walking away from a work computer without logging off.
Proper workspace security discipline is crucial in maintaining security.  Employees need to be trained to be aware of computer monitor visibility, shoulder surfing and policies regarding the removal of computer hardware.
The most common security threats in corporations are hackers, malicious code and malicious insiders.
A new threat to healthcare organizations is ransomware, malicious code that blocks the organization from using their computer systems until a ransom is paid to the hacker.  Another huge threat to corporate security is social engineering, for example, someone attempting to access a network might pretend to be an employee from IT office and asks for your ID and password. The outsider can then gain access to the corporate network.