If there is a central key aspect of healthcare security, it is HIPAA. The Health Insurance Portability and Accountability Act of 1996 changed the way healthcare providers increased the security of patient data and information. Every person that works in healthcare, from the front desk person to a brain surgeon, learns exactly what HIPAA is and how they must incorporate it in their jobs. But is following the basic rules of HIPAA truly enough to be secure?

Why is HIPAA not enough?

First, the HIPAA Security Rule is meant to cover a wide range of medical practices, from the small single-doctor office to a huge university teaching hospital. The wide range meant that many of the security elements are necessarily vague. While this allows the Security Rule to apply to the wide range, it also allows for gaps in how patient data is securely treated.

Second, not every standard is required. This is because HIPAA provides guidelines and a framework for security, but it is not prescriptive. It is up to each company or clinic to define what compliance means to them. Addressable standards can be eliminated if the location can document a business reason for not addressing the particular standard. This allows companies to either not implement all the standards that they need or go too far using unnecessary safeguards.

Third, HIPAA does not have any official confirmation of compliance. Compliance is demonstrated through a risk assessment and control documents. This lack of certification means that human error can creep in and affect the security of patient data.  It also makes it hard to know which vendors are really following HIPAA.  

Finally, HIPAA was created in 1996, long before electronic health records were standard practice. Now that the healthcare industry relies on electronic records, HIPAA simply doesn’t address the concerns of a changing, connected world.

How can HITRUST change how you manage ePHI?

HITRUST, or Health Information Trust Alliance Common Security Framework, was created in 2009 to address the changing nature of how patient information was being used and transmitted. While it includes the HIPAA Security Rule as part of its framework, it also uses security standards from:

• Payment Card Industry Data Security Standard (PCI DSS)
• Control Objectives for Information and Related Technology (COBIT)
• National Institute of Standards and Technology (NIST) Risk Management Framework (RMF)
• International Organization for Standardization (ISO)
• Federal Trade Commission (FTC) Red Flags Rule
• Centers for Medicare and Medicaid Services Addressable Risk Safeguards (CMS ARS)
• State requirements
• Multiple other standards

HITRUST is a comprehensive set of standards that more adequately meets the needs of the healthcare industry today. It allows each organization to create a set of control standards that fits their specific risks and needs. And what happens when your organization grows beyond your current control guidelines? HITRUST allows for scaling to include the new risks and needs as you grow.

HITRUST is also kept up to date with the ever-changing security risks and laws. As recent events have shown, new regulations can be passed or existing ones change. HITRUST can adapt to these changes quickly so that you remain compliant without interruption.

HITRUST also makes proving compliance to clients and vendors easier. It uses a single, third-party assessment to show how your organization is compliant across multiple standards. And you receive an actual certification, showing that you are not only HIPAA compliant but also truly able to protect patient data from theft and misuse.

HITRUST is becoming the de facto standard for security in the health space.  We have extensive experience with HITRUST implementation and certification. We are ready to be your full-service security partner

Let’s Talk

As Accorian, we have extensive experience with HITRUST implementation and certification. We are ready to be your full-service security partner as you transition to HITRUST. We will work with you to develop your HITRUST standards as well as implement the control policies.  Feel free to schedule a consultation with us to see how HITRUST can serve your company, your clients, and ultimately the patients.

Telehealth is the distribution of health-related services and information via electronic channels allowing long-distance patient and clinician contact, care, advice, reminders, education, intervention, monitoring, and remote admissions.

There has been a many fold increase in the adoption due to COVID 19 and patients being unable to travel to meet doctors.

It is important to understand that telehealth is susceptible to cyber breaches and poses an immense threat to the confidentiality, integrity, and availability of patients’ electronic medical records. Patient’s medical records contain very sensitive information that should not be made accessible to unauthorized persons to protect patient privacy, integrity, and confidentiality.

The flipside is that this information needs to be easily available whenever required by authorized users for an authentic purpose. Telehealth presents all of the security issues as any other electronic transmission but, probably one of the most important issues will be availability – signal interference, interruption of transmission, or outages causing a real issue. Also, DOS outages could present a greater risk to patients who depend on telehealth services.

Attacks on the telehealth network can be grouped into two broad categories depending on their type:

Active attacks: These attacks include modification, interruption, or fabrication of patient information.

Passive attacks: These attacks include the interception of information but ,not alteration. These attacks are accomplished by monitoring a system performing its tasks and collecting information. These include eavesdropping, sniffing, or traffic analysis kind of activities. Passive attacks result in the disclosure of information or data files to an attacker without the consent or knowledge of the user.

Hence, this poses a big challenge – How can Telehealth be seamless, fast yet secure?

Telehealth providers should consider taking several steps to ensure their patient encounters are private and secure. Providers should ensure that all transmissions are encrypted and remote connections have strong, preferably two-factor – authentication. They should also make sure that private rooms are set aside for telehealth sessions and that redundant, multiple paths for connection, power, and service are provided.

Mitigating Security risks in Telehealth

Security in telehealth begins with establishing best practices, cyber hygiene and rolling out standard operating procedures.

1. Improve Platform Safety: HIPAA requires that providers integrate encryption and other safeguards into their interactions with patients. However, patients’ devices are often the weakest link and fall prey to hackers.

2. Privileged Access & Authentication: Continuous identity authentication ensures only authorized individuals have access to data. Identity authentication can be accomplished through a variety of approaches.

Multi-factor authentication, or the requirement of utilizing two pieces of evidence to sign in, is among the most common and has been proven effective in blocking 99.9 percent of all automated cyber-attacks.

Beyond this, users need to develop strong, unique passwords for, not just their telehealth platform accounts, but across their entire online logins and accounts.

3. Investing in Patient Education: Cybersecurity ultimately relies on the end-user. As hackers continuously exploit new vulnerabilities, developers & security expert are in a constant race to keep up with new threats. However, the security is only as strong as its weakest link – end patient.

Healthcare providers should educate patients about cybersecurity and the steps they should take to improve the overall safety by:

●  Educating patients about the telehealth security threats

●  Using a VPN for providing telehealth services and general device usage

●  Frequently updating all apps and operating systems, not just telehealth platforms

●  Advising on frequent anti-malware and virus scans

●  Restricting app permissions

In the meantime, organizations offering telehealth services should take steps to ensure timely patching, updates of systems by performing timely vulnerability assessment & penetration tests.

Similarly, with privacy, it is crucial healthcare entities are aware of all the privacy and consent requirements that come with providing telehealth in non-emergency times, as many of those requirements are different from the ones currently being enforced during the public health emergency.

Other privacy and security concerns related to telehealth include how healthcare providers store, access and manage sensitive patient information.

Providers need to take steps to reduce the risk of data breaches, including implementing encryption of data at rest, offering end-user training, automating compliance enforcement, and utilizing insider threat monitoring.