# data[].attributes.body
GROUP MEMBERS

ALLISON BROWN

MICHENA ARISTIL

ROBERT BARNES

CONTRIBUTIONS

ALLISON BROWN:      CREATED, ARRANGED, AND POSTED ON PADLET, PRESENTED VIDEOS ON INTRODUCTION, CONTRIBUTED TO AND PRESENTED VIDEO ON FINAL TOPIC SUMMARY, GATHERED REFERENCES.

MICHENA ARISTIL:     POSTED AND ARRANGED PADLET, WROTE INTRODUCTORY AND FINAL TOPIC SUMMARY, EDITED AND ORGANIZED REFERENCES.

ROBERT BARNES:       CREATED, POSTED ON PADLET, ASSIGNED GROUP MEMBER TO DELIVER INTRODUCTORY VIDEO.

# data[].attributes.attachment_link.readable_text
In February 2015, Anthem made history when 78.8 million of its customers were hacked. It was the largest health care breach ever, and it opened the floodgates on a landmark year. More than 113 million medical records were compromised last year, according to the Office of Civil Rights (OCR) under Health and Human Services. Consider it this way: if each case represented a single individual, one in three Americans would have been a victim.

This year looks tame by comparison, but it's only March, and 3.5 million medical records have already been compromised. Based on this this list from the U.S. Department of Health and Human Services, the health care industry has averaged close to four data breaches per week in 2016 so far.

"If you think about it, that's pretty bad, because we all interact with the health care system," computer scientist and information security expert Avi Rubin said while discussing the state of hospital cybersecurity at the USENIX Enigma Conference in January.

Before becoming director of the Johns Hopkins University Health and Medical Security Lab, Rubin provided cybersecurity for companies across many industries. Banks. Car-rental companies. Retail stores. You name it. But the health care sector was the "absolute worst" in terms of cybersecurity problems, he said.

"Their data security practices were so far below every other industry," Rubin said.

Indeed, the health care sector ranked second in U.S. data breaches in 2015 an d placed in the top 10 on Verizon's global hacking report.

What does this look like on the frontlines? Boston's Beth Israel Deaconess gets hacked every seven seconds, the hospital's CIO John Halamka reportedly said at South by Southwest two weeks ago. In 2011, cybercriminals in China stole 2,000 patient X-rays from Beth Israel Deaconess. Halamka said the scans are often sold to Chinese nationals who can't pass health exams for travel visas.

Still, medical cybersecurity gets little attention in mainstream conversations, such as on the campaign trail. The words "hack," "cyber attack" and "cyber warfare" have only been mentioned 16 times during the major Republican presidential debates. The record is even worse for Democratic candidates, with only a single utterance of "cyber warfare" by Senator Jim Webb during the October 13 debate. Neither party has used any of these terms in the context of health care cybersecurity during the primary debates.

But here are three reasons why everyone should care.

1. Your health records have become currency

"Electronic health records are 100 times more valuable than stolen credit cards," said James Scott, co-founder and senior fellow at the Institute for Critical Infrastructure Technology (ICIT) in Washington D.C. Members of Scott's institute hold regular meetings between lawmakers and tech experts to foster cybersecurity policy. While numerous safeguards exist for financial information, fewer protections exist for health data, which is much more valuable, Scott said.

"With credit cards, the money is insured. If the bank is FDIC-backed, most people who have their credit card numbers stolen won't actually lose the money. The bank makes up the difference," Scott said. "But with electronic health records, the reason that hospitals and insurance companies are such a big target, first, is because of the payoff."

A single Medicare or Medicaid electronic health record can fetch a $500 price tag on darkweb forums, Scott said. Experian, the global information service, estimates that health records are worth up to 10 times more than credit card numbers on the black market.

"If you purchase 100 electronic health records, you have everything for each of those people - social security number, all the addresses, their kids, their jobs," Scott said. "Malicious actors want as much intelligence as they can get, and health care is the easiest attack surface for seasoned and non-seasoned hackers."

Data breaches cost the healthcare industry an estimated $5.6 billion per year.
2. Your hospital cybersecurity might be leaky
Health care occupies a vulnerable cybersecurity space. With the rise of health frackers, self-care and personalized medicine, people, doctors and regulators want easier modes of access to patient data. The dangers come from opening huge highways for sharing and storing data without the proper digital protections, Rubin said.

As an experiment designed to identify vulnerabilities, Independent Security Evaluators spent the last two years trying to penetrate the cybersecurity of 12 health care facilities and two health care data centers in the United States. Don't worry; they were hired for this purpose.

At one hospital, the team hacked a computerized medicine dispensary by littering several floors with 18 malware-containing USB sticks. Each USB had the hospital's logo, which may have been enough to convince an unwitting employee to use one. If the hack had been malicious, then the attacker could have altered the drug dosages, a potentially life-threatening scenario for a patient. At another hospital, they utilized an unguarded lobby kiosk to access the bloodwork records of patients, which in theory, could have been switched to yield improper treatment.

Websites are another avenue for cybercriminals, according to Independent Security Evaluators. The team pretended to be a patient logging on to an electronic health record website, but they filled the patient information fields with malicious code. When an unsuspecting administrator - a doctor or a nurse - viewed this new patient information the malicious code was installed, inadvertently granting a hacker "the full ability to modify the health records of all patients in the database," Independent Security Evaluators wrote in a report published February 23.

Patients also carry these vulnerabilities with them, in the form of smartphone health apps. A survey of 211 diabetes apps in the Google Play store found that 81 percent lacked privacy policies. Of the remaining 41 apps with privacy policies, 25 apps (61 percent) would share user data if required by law; 20 apps (48.8 percent) shared user data with third parties; and 16 apps (39 percent) permitted user data to used for advertising purposes.

"This study demonstrated that diabetes apps shared information with third parties, posing privacy risks, because there are no federal legal protections against the sale or disclosure of data from medical apps to third parties," the study's authors from the Illinois Institute of Technology Chicago-Kent College of Law wrote. "Patients might mistakenly believe that health information entered into an app is private (particularly if the app has a privacy policy), but that generally is not the case. Medical professionals should consider privacy implications prior to encouraging patients to use health apps."

Rubin recommended policies like encrypting all patient data, limiting who has permission to view medical charts to prevent breaches at hospitals and multifactor authentication. The number of searches placed into hospital databases should also be monitored, he said, to catch instances when hackers might be downloading large batches of health records at once.

3. You might be missing the biggest flaw in your cybersecurity.

That's because the biggest flaw in your cybersecurity is probably you.

The ongoing plague of ransomware is a great example. Ransomware holds hostage a victim's computer or digital files by encrypting them, and it has existed in various forms since 1989. However, the latest incarnation - crypto ransomware - has spread like wildfire since its emergence three years ago. More than 128,000 desktops were hit by ransomware during the final quarter of 2014. By the middle of 2015, this number had mushroomed - doubling to 337,000 cases.

In February, Hollywood Presbyterian Medical Center became one of the latest high-profile victims of ransomware. Hospital president and CEO Allen Stefanek described the attack as "clearly not a malicious" and "just a random attack," which is indicative of the primary route for this ransomware: a tainted email. The ICIT claims the medical center was struck by Locky crypto-ransomware, which arrives in an inbox as a Word document in an email attachment.

This brand of attack is known as phishing - wherein hackers mask malicious code within a legitimate-looking email or webpage. This fake correspondence is laced with features designed to convince a victim to click - that's known as social engineering.

There are two common versions of these hacks, known as spear phishing and whale phishing, and they're engineered to capitalize on human nature and trust. The celebrity nude photo hack: spear phishing over email. A teen cracked into CIA Director John Brennan's email by phishing a Verizon employee over the phone.

"Spear phishing is when an adversary will email you, and it looks like a message from a legitimate source. But then when you look closer, @newshour.org is @newshour.uk or .co or something," Scott said. "Whale phishing is when you're maybe sending three emails that are highly targeted. [The hackers] design a couple emails tailored through social engineering research that they gather from social media and whatever you put about yourself out there online."

Cyberthieves often gain intelligence via semi-public social media platforms like LinkedIn, Scott says.

"They can see where you went to college, where you worked. And then they can dig deeper and find your Facebook and find out when you were married. A lot of times, it just comes down to doing your homework," Scott said.

He adds that education is the key to preventing phishing attacks at hospitals.

"Hospitals and insurance companies need to educate their employees:'This is what a spear phishing attack looks like.' 'Here's what a spoofed browser looks like.' 'Look at the email, what's different from this email and that email.'" Scott said. "When you get these weird things, you should forward the email to your information security guy at the company."

He can open the suspicious email in a virtual private network, so the malicious code never gains access to his computer or the company's network.

President Obama's recently announced the Cybersecurity National Action Plan, which commits $62 million to educating the next generation of cybersecurity personnel, but it doesn't mention training for regular folks on social engineering employed by hackers. If people keep opening the door to malicious code, no high-tech encryption, security software or legion of IT employees will be able to stop them.

"It's training people not to click. That's the thing. It's crazy, but teaching people not to click is so hard. Just don't click," Scott said.

# data[].attributes.attachment_link.title
Has health care hacking become an epidemic?

# data[].attributes.attachment_link.description
In February 2015, Anthem made history when 78.8 million of its customers were hacked. It was the largest health care breach ever, and it opened the floodgates on a landmark year. More than 113 million medical records were compromised last year, according to the Office of Civil Rights (OCR) under Health and Human Services.

# data[].attributes.body
References

Akpan, N. (2016, March 23). Has health care hacking become an epidemic? PBS. Retrieved from https://www.pbs.org/newshour/science/has-health-care-hacking-become-an-epidemic

AAMI. (2017, August 15). The fearsome four cybersecurity weaknesses in hospitals. YouTube. Retrieved from https://www.youtube.com/watch?v=JvKjrBMuRxM

Barnes, J. (n.d.). Wired network security: Hospital best practices. Infosec Writers. Retrieved from http://www.infosecwriters.com/text_resources/pdf/Wired_Security_JBarnes.pdf

Netswitch Technology Management.  (n.d).  Is your healthcare data secure?  YouTube.  Retrieved from https://www.youtube.com/channel/UCot00WNHsUBe4LHZdTUkDMg.

Office of the National Coordinator for Health IT. (2015, April 13). Guide to privacy and security of electronic health information. YouTube. Retrieved from https://www.youtube.com/watch?v=phrXsdnhE7w

# data[].attributes.body
Give three examples on how to authenticate the perfect password.

# data[].attributes.body
Give three examples on how to secure network security.

# data[].attributes.body
Hacking in Healthcare

# data[].attributes.attachment_link.readable_text
In February 2015, Anthem made history when 78.8 million of its customers were hacked. It was the largest health care breach ever, and it opened the floodgates on a landmark year. More than 113 million medical records were compromised last year, according to the Office of Civil Rights (OCR) under Health and Human Services. Consider it this way: if each case represented a single individual, one in three Americans would have been a victim.

This year looks tame by comparison, but it's only March, and 3.5 million medical records have already been compromised. Based on this this list from the U.S. Department of Health and Human Services, the health care industry has averaged close to four data breaches per week in 2016 so far.

"If you think about it, that's pretty bad, because we all interact with the health care system," computer scientist and information security expert Avi Rubin said while discussing the state of hospital cybersecurity at the USENIX Enigma Conference in January.

Before becoming director of the Johns Hopkins University Health and Medical Security Lab, Rubin provided cybersecurity for companies across many industries. Banks. Car-rental companies. Retail stores. You name it. But the health care sector was the "absolute worst" in terms of cybersecurity problems, he said.

"Their data security practices were so far below every other industry," Rubin said.

Indeed, the health care sector ranked second in U.S. data breaches in 2015 an d placed in the top 10 on Verizon's global hacking report.

What does this look like on the frontlines? Boston's Beth Israel Deaconess gets hacked every seven seconds, the hospital's CIO John Halamka reportedly said at South by Southwest two weeks ago. In 2011, cybercriminals in China stole 2,000 patient X-rays from Beth Israel Deaconess. Halamka said the scans are often sold to Chinese nationals who can't pass health exams for travel visas.

Still, medical cybersecurity gets little attention in mainstream conversations, such as on the campaign trail. The words "hack," "cyber attack" and "cyber warfare" have only been mentioned 16 times during the major Republican presidential debates. The record is even worse for Democratic candidates, with only a single utterance of "cyber warfare" by Senator Jim Webb during the October 13 debate. Neither party has used any of these terms in the context of health care cybersecurity during the primary debates.

But here are three reasons why everyone should care.

1. Your health records have become currency

"Electronic health records are 100 times more valuable than stolen credit cards," said James Scott, co-founder and senior fellow at the Institute for Critical Infrastructure Technology (ICIT) in Washington D.C. Members of Scott's institute hold regular meetings between lawmakers and tech experts to foster cybersecurity policy. While numerous safeguards exist for financial information, fewer protections exist for health data, which is much more valuable, Scott said.

"With credit cards, the money is insured. If the bank is FDIC-backed, most people who have their credit card numbers stolen won't actually lose the money. The bank makes up the difference," Scott said. "But with electronic health records, the reason that hospitals and insurance companies are such a big target, first, is because of the payoff."

A single Medicare or Medicaid electronic health record can fetch a $500 price tag on darkweb forums, Scott said. Experian, the global information service, estimates that health records are worth up to 10 times more than credit card numbers on the black market.

"If you purchase 100 electronic health records, you have everything for each of those people - social security number, all the addresses, their kids, their jobs," Scott said. "Malicious actors want as much intelligence as they can get, and health care is the easiest attack surface for seasoned and non-seasoned hackers."

Data breaches cost the healthcare industry an estimated $5.6 billion per year.
2. Your hospital cybersecurity might be leaky
Health care occupies a vulnerable cybersecurity space. With the rise of health frackers, self-care and personalized medicine, people, doctors and regulators want easier modes of access to patient data. The dangers come from opening huge highways for sharing and storing data without the proper digital protections, Rubin said.

As an experiment designed to identify vulnerabilities, Independent Security Evaluators spent the last two years trying to penetrate the cybersecurity of 12 health care facilities and two health care data centers in the United States. Don't worry; they were hired for this purpose.

At one hospital, the team hacked a computerized medicine dispensary by littering several floors with 18 malware-containing USB sticks. Each USB had the hospital's logo, which may have been enough to convince an unwitting employee to use one. If the hack had been malicious, then the attacker could have altered the drug dosages, a potentially life-threatening scenario for a patient. At another hospital, they utilized an unguarded lobby kiosk to access the bloodwork records of patients, which in theory, could have been switched to yield improper treatment.

Websites are another avenue for cybercriminals, according to Independent Security Evaluators. The team pretended to be a patient logging on to an electronic health record website, but they filled the patient information fields with malicious code. When an unsuspecting administrator - a doctor or a nurse - viewed this new patient information the malicious code was installed, inadvertently granting a hacker "the full ability to modify the health records of all patients in the database," Independent Security Evaluators wrote in a report published February 23.

Patients also carry these vulnerabilities with them, in the form of smartphone health apps. A survey of 211 diabetes apps in the Google Play store found that 81 percent lacked privacy policies. Of the remaining 41 apps with privacy policies, 25 apps (61 percent) would share user data if required by law; 20 apps (48.8 percent) shared user data with third parties; and 16 apps (39 percent) permitted user data to used for advertising purposes.

"This study demonstrated that diabetes apps shared information with third parties, posing privacy risks, because there are no federal legal protections against the sale or disclosure of data from medical apps to third parties," the study's authors from the Illinois Institute of Technology Chicago-Kent College of Law wrote. "Patients might mistakenly believe that health information entered into an app is private (particularly if the app has a privacy policy), but that generally is not the case. Medical professionals should consider privacy implications prior to encouraging patients to use health apps."

Rubin recommended policies like encrypting all patient data, limiting who has permission to view medical charts to prevent breaches at hospitals and multifactor authentication. The number of searches placed into hospital databases should also be monitored, he said, to catch instances when hackers might be downloading large batches of health records at once.

3. You might be missing the biggest flaw in your cybersecurity.

That's because the biggest flaw in your cybersecurity is probably you.

The ongoing plague of ransomware is a great example. Ransomware holds hostage a victim's computer or digital files by encrypting them, and it has existed in various forms since 1989. However, the latest incarnation - crypto ransomware - has spread like wildfire since its emergence three years ago. More than 128,000 desktops were hit by ransomware during the final quarter of 2014. By the middle of 2015, this number had mushroomed - doubling to 337,000 cases.

In February, Hollywood Presbyterian Medical Center became one of the latest high-profile victims of ransomware. Hospital president and CEO Allen Stefanek described the attack as "clearly not a malicious" and "just a random attack," which is indicative of the primary route for this ransomware: a tainted email. The ICIT claims the medical center was struck by Locky crypto-ransomware, which arrives in an inbox as a Word document in an email attachment.

This brand of attack is known as phishing - wherein hackers mask malicious code within a legitimate-looking email or webpage. This fake correspondence is laced with features designed to convince a victim to click - that's known as social engineering.

There are two common versions of these hacks, known as spear phishing and whale phishing, and they're engineered to capitalize on human nature and trust. The celebrity nude photo hack: spear phishing over email. A teen cracked into CIA Director John Brennan's email by phishing a Verizon employee over the phone.

"Spear phishing is when an adversary will email you, and it looks like a message from a legitimate source. But then when you look closer, @newshour.org is @newshour.uk or .co or something," Scott said. "Whale phishing is when you're maybe sending three emails that are highly targeted. [The hackers] design a couple emails tailored through social engineering research that they gather from social media and whatever you put about yourself out there online."

Cyberthieves often gain intelligence via semi-public social media platforms like LinkedIn, Scott says.

"They can see where you went to college, where you worked. And then they can dig deeper and find your Facebook and find out when you were married. A lot of times, it just comes down to doing your homework," Scott said.

He adds that education is the key to preventing phishing attacks at hospitals.

"Hospitals and insurance companies need to educate their employees:'This is what a spear phishing attack looks like.' 'Here's what a spoofed browser looks like.' 'Look at the email, what's different from this email and that email.'" Scott said. "When you get these weird things, you should forward the email to your information security guy at the company."

He can open the suspicious email in a virtual private network, so the malicious code never gains access to his computer or the company's network.

President Obama's recently announced the Cybersecurity National Action Plan, which commits $62 million to educating the next generation of cybersecurity personnel, but it doesn't mention training for regular folks on social engineering employed by hackers. If people keep opening the door to malicious code, no high-tech encryption, security software or legion of IT employees will be able to stop them.

"It's training people not to click. That's the thing. It's crazy, but teaching people not to click is so hard. Just don't click," Scott said.

# data[].attributes.attachment_link.title
Has health care hacking become an epidemic?

# data[].attributes.attachment_link.description
In February 2015, Anthem made history when 78.8 million of its customers were hacked. It was the largest health care breach ever, and it opened the floodgates on a landmark year. More than 113 million medical records were compromised last year, according to the Office of Civil Rights (OCR) under Health and Human Services.

# data[].attributes.attachment_link.authors[].name
Office of the National Coordinator for Health IT

# data[].attributes.attachment_link.title
Guide to Privacy and Security of Electronic Health Information

# data[].attributes.attachment_link.description
If you're part of a small health care practice, learn more about ONC's guide to help you navigate the world of health information privacy and security.

# data[].attributes.attachment_link.provider_name
Kaercher Insurance - a full service insurance brokerage.

# data[].attributes.attachment_link.readable_text
Many medical devices contain configurable embedded computer systems that can be vulnerable to cyber-security breaches. In addition, as medical devices are increasingly interconnected via the Internet, hospital networks, other medical devices or smartphones, there is an increased risk of cyber-security breaches, which could affect how a medical device operates.

The Food and Drug Administration (FDA) has recently become aware of cyber-security vulnerabilities and incidents that could directly impact medical devices or hospital network operations, such as the following:

Network-connected/configured medical devices infected or disabled by malware

The presence of malware on hospital computers, smartphones and tablets, targeting mobile devices using wireless technology to access patient data, monitoring systems and implanted patient devices

Uncontrolled distribution of passwords, disabled passwords, hard-coded passwords for software intended for privileged device access (e.g., to administrative, technical and maintenance personnel)

Failure to provide timely security software updates and patches to medical devices and networks and to address related vulnerabilities in older medical device models (legacy devices)

Security vulnerabilities in off-the-shelf software designed to prevent unauthorized device or network access, such as plain-text or no authentication, hard-coded passwords, documented service accounts in service manuals and poor coding/SQL injection.

The FDA has been working closely with other federal agencies and manufacturers to identify, communicate and mitigate vulnerabilities and incidents as they are identified.
FDA Recommendations/Actions

The FDA has a number of recommendations to mitigate the risks that technology may pose to health care organizations.
For all device manufacturers:
Manufacturers are responsible for remaining vigilant about identifying risks and hazards associated with their medical devices, including risks related to cyber security, and are responsible for putting appropriate mitigations in place to address patient safety and ensure proper device performance.

The FDA expects medical device manufacturers to take appropriate steps to limit the opportunities for unauthorized access to medical devices. Specifically, it is recommended that manufacturers review their cyber-security practices and policies to ensure that appropriate safeguards are in place to prevent unauthorized access or modification to their medical devices or compromise the security of the hospital network that may be connected to the device. The extent to which security controls are needed will depend on the medical device, its environment of use, the type and probability of the risks to which it is exposed, and the probable risks to patients from a security breach.

In evaluating your device, consider doing the following:

Take steps to limit unauthorized device access to trusted users only, particularly for those devices that are life-sustaining or could be directly connected to hospital networks.

Appropriate security controls may include user authentication, such as user ID and password, smartcard, or biometrics; strengthening password protection by avoiding hard-coded passwords and limiting public access to passwords used for technical device access; physical locks; card readers; and guards.

Protect individual components from exploitation and develop strategies for active security protection appropriate for the device's use environment. Such strategies should include timely deployment of routine, validated security patches and methods to restrict software or firmware updates to authenticated code. The FDA typically does not need to review or approve medical device software changes made solely to strengthen cyber security.

Use design approaches that maintain a device's critical functionality, even when security has been compromised, known as "fail-safe modes."

Provide methods for retention and recovery after an incident where security has been compromised.

Cyber-security incidents are increasingly likely and manufacturers should consider incident response plans that address the possibility of degraded operation and efficient restoration and recovery.

For health care facilities:
The FDA recommends that you take steps to evaluate your network security and protect your hospital system. In evaluating network security, hospitals and health care facilities should consider doing the following:

Restricting unauthorized access to the network and networked medical devices

Making certain that appropriate antivirus software and firewalls are up to date

Monitoring network activity for unauthorized use

Protecting individual network components through routine and periodic evaluation, including updating security patches and disabling all unnecessary ports and services

Contacting the specific device manufacturer if you think you may have a cyber-security problem related to a medical device

o If you are unable to determine the manufacturer or cannot contact the manufacturer, the FDA may be able to assist in vulnerability reporting and resolution.

Developing and evaluating strategies to maintain critical functionality during adverse conditions
Reporting Problems to the FDA
Prompt reporting of adverse events can help the FDA identify and better understand the risks associated with medical devices. If you suspect that a cyber-security event has impacted the performance of a medical device or has impacted a hospital network system, file a voluntary report through MedWatch, the FDA Safety Information and Adverse Event Reporting program.

Health care personnel employed by facilities that are subject to the FDA's user facility reporting requirements should follow the reporting procedures established by their facilities.
Device manufacturers must comply with the Medical Device Reporting (MDR) regulations.
Contact Jimmy Porrello at Kaercher Insurance today to discuss how to keep your health care facility safe and secure from cyber threats.

# data[].attributes.attachment_link.title
Cyber Security for Medical Devices and Hospital Networks - Kaercher Insurance - a full service insurance brokerage.

# data[].attributes.attachment_link.description
Many medical devices contain configurable embedded computer systems that can be vulnerable to cyber-security breaches. In addition, as medical devices are increasingly interconnected via the Internet, hospital networks, other medical devices or smartphones, there is an increased risk of cyber-security breaches, which could affect how a medical device operates.

# data[].attributes.attachment_link.readable_text
The specter of HIPAA is at the back of every health care provider's mind, every day, in every interaction. Providers must constantly question if the information they are sharing, and how they are sharing it, falls within the law's privacy guidelines. If they aren't following the rules, they know, they could face significant fines and other consequences.

Yet for many providers, the same care and consideration that they give to conversations, emails, and other interactions doesn't always extend to their mobile device use. Often, it's assumptions about the security of their devices, as in, they believe that they are more secure than they really are, that leads to potential HIPAA violations, not to mention, creating the risk of a data breach. For that reason, it's important that health care providers, and facilities, make mobile device security a bigger priority, in order to protect patient information and confidentiality.

High Numbers, High Complexity

According to the most recent studies , about three-quarters of all providers use their smartphones as part of their practice. A little more than half use tablets in their duties caring for patients. Providers are using their devices for everything from communicating with patients via email or text message to viewing test results or medical images to make a diagnosis. And it's not just providers who are taking health care mobile: Patients are using their devices to make and confirm appointments via text, and using apps to access their medical records and patient accounts.

The sheer number of devices being used within the health care realm increases the complexity of mobile security needs. Simply put, there are so many places where things can go wrong, that it's challenging even the most technologically advanced organization to implement the proper controls and safety protocols to protect patient data and adhere to federal privacy and security guidelines.

To help, the Office of the National Coordinator for Health Information Technology created a five-step process for mobile device management, which includes deciding which mobile devices are acceptable to use on your network and will be granted access, assessing the risk that mobile technology presents to the organization, identifying a risk management strategy, developing and documenting a mobile deice management plan, and training staff and provider in mobile device security.

Best Practices for Mobile Device Security in Healthcare

However, despite the government's step-by-step plan, many users struggle to actually identify and implement the actual steps that need to be taken to protect patient data. To that end, there are a few best practices to consider.

1. Implement user authentication controls. One of the biggest dangers to any device, in and outside of health care, is inadequate security controls. Locking the device with a passcode and using biometrics can go a long way to keeping the device data safe from prying eyes. Providers should use any and all device locking mechanisms to secure devices used for work.

2. Implement remote and automatic lock and wipe capabilities for use when a device is lost or stolen, or after an excessive number of incorrect login attempts.

3. Install security programs. With hackers and viruses now targeting mobile devices with the same intensity as desktop computers, it's important for health care professionals to install Internet security software onto their mobile devices as well, to prevent harmful apps and malware from infiltrating the health care networks and compromising protected data.

3. Employ encryption. Whether on a device or an app-by-app basis, data that is stored or transmitted via the device should be encrypted. Email and attachments should also be secured and encrypted to ensure that unauthorized individuals do not see it - even by accident.

4. Develop an application policy. In BYOD environment's controlling the applications installed on personal devices is a touchy subject, but it is vital for health care users to understand the potential risks associated with harmful applications. At the very least, providers must be educated on how to evaluate apps, or seek approval for the installation of unapproved apps on devices used for work. At the very least, file-sharing applications should be banned, and providers prohibited from using unapproved and unsecured filing-sharing services to share patient data.

5. Encourage regular updates. Updating operating systems regularly is an important part of any security strategy. Hackers target vulnerabilities in operating systems, and installing updates helps close those holes and protect data. Develop a policy of notifying providers of important updates and enforce update requirements.

In many ways, protecting patient information on mobile devices comes down to the same common sense principles that one would use to protect his or her own personal data. By treating mobile security with the same care and attention as they would any other form of communication, providers can avoid creating HIPAA violations and costly data breaches.

Kristen Hamlin is an adjunct instructor at Central Maine Community College and her work has appeared in Lewiston Auburn Magazine, Young Money, USA Today and a variety of online outlets.

# data[].attributes.attachment_link.title
5 Best Practices for Mobile Device Security in Healthcare

# data[].attributes.attachment_link.description
The specter of HIPAA is at the back of every health care provider's mind, every day, in every interaction. Providers must constantly question if the information they are sharing, and how they are sharing it, falls within the law's privacy guidelines. If they aren't following the rules, they know, they could face significant fines and other consequences.

# data[].attributes.attachment_link.readable_text
When you visit the doctor, information about you may be recorded in an office computer. Your tests may be sent to a laboratory or consulting physician. Relevant information may be transmitted to your health insurer or pharmacy. Your data may be collected by the state government or by an organization that accredits health care or studies medical costs. By making information more readily available to those who need it, greater use of computerized health information can help improve the quality of health care and reduce its costs. Yet health care organizations must find ways to ensure that electronic health information is not improperly divulged. Patient privacy has been an issue since the oath of Hippocrates first called on physicians to "keep silence" on patient matters, and with highly sensitive data--genetic information, HIV test results, psychiatric records--entering patient records, concerns over privacy and security are growing.

For the Record responds to the health care industry's need for greater guidance in protecting health information that increasingly flows through the national information infrastructure--from patient to provider, payer, analyst, employer, government agency, medical product manufacturer, and beyond. This book makes practical detailed recommendations for technical and organizational solutions and national-level initiatives.

For the Record describes two major types of privacy and security concerns that stem from the availability of health information in electronic form: the increased potential for inappropriate release of information held by individual organizations (whether by those with access to computerized records or those who break into them) and systemic concerns derived from open and widespread sharing of data among various parties.

The committee reports on the technological and organizational aspects of security management, including basic principles of security; the effectiveness of technologies for user authentication, access control, and encryption; obstacles and incentives in the adoption of new technologies; and mechanisms for training, monitoring, and enforcement.

For the Record reviews the growing interest in electronic medical records; the increasing value of health information to providers, payers, researchers, and administrators; and the current legal and regulatory environment for protecting health data. This information is of immediate interest to policymakers, health policy researchers, patient advocates, professionals in health data management, and other stakeholders.

# data[].attributes.attachment_link.title
Read "For the Record: Protecting Electronic Health Information" at NAP.edu

# data[].attributes.attachment_link.description
When you visit the doctor, information about you may be recorded in an office computer. Your tests may be sent to a laboratory or consulting physician. Relevant information may be transmitted to your health insurer or pharmacy. Your data may be collected by the state government or by an organization that accredits health care or studies medical costs.

# data[].attributes.body
Security threats in healthcare

# data[].attributes.attachment_link.title
The Fearsome Four Cybersecurity Weaknesses in Hospitals