13 tips to keep your patient data safe from hackers

Here are 13 cybersecurity measures medical practices can take to protect patient data from hackers.

1. Perform a security risk assessment. Not only is this a Health Insurance Portability and Accountability Act requirement for all covered entities, it can also help practices identify specific areas of vulnerability, says Vanessa Bisceglie, MBA, president and CEO of CareVitality.

2. Invest in staff training. Once you know your practice-specific vulnerabilities, provide targeted education. “Your employees need to be your first line of defense,” notes Jones.

The good news? Between webinars and free ezines, there are plenty of ways to educate staff on a tight budget, says Weiss. It’s the simple strategies that can be most effective, says Linda Renn, vice president at STAT Solutions, Inc.

3. Perform patch updates. Cybersecurity threats change quickly, and software can immediately become vulnerable, says Weiss. Patch updates are designed to fix security vulnerabilities and other bugs so hackers can’t hack patient records as easily. Make it a habit to check for systems updates regularly, he adds.

4. Enable multifactor authentication on all devices. Multifactor authentication requires users to provide two or more verification factors (eg, password and answer to a security question). Why is this important? “All password resets go to your email,” says Weiss. “If the bad guys have access to your email, it’s game over for you.”

5. Create a password policy. For example, prohibit employees from using the same password for personal and work devices, says Jones. Why? If a hacker gets access to one, they have access to both.

“Hackers move laterally,” she says. “They see where you bank or where you work, for example, and then try using the same credentials.” Requiring employees to change their password every
60 or 90 days is also important. So is using a complex password of
12 characters that includes a combination of symbols, numbers and upper- and lowercase letters.

6. Use encryption. Make sure all hardware devices and emails that hold electronic patient health information are encrypted, says Bisceglie.

7. Configure your firewall correctly. A firewall is a device (either physical or virtual) that acts as a barrier to permit or deny access to your practice’s network. When configuring the firewall, you’ll need to think about internal and external access, says Jones. For example, what vendors (e.g., transcription companies, coding outsource companies, or telehealth vendors) will you permit to access your network? What websites will you permit staff to visit?

8. Separate your guest Wi-Fi and medical practice networks. “If you don’t do this, someone who knows what they’re doing can get into the practice’s network and access medical records in a matter of minutes,” says Jones.

9. Ensure role-based access to electronic health records. “Many times, vendors give broad access when the system is set up, and it’s up to a practice to really cut the access down and give staff the minimal access they need to do their role,” says Bisceglie. In the event of a breach, role-based access may help restrict the information to which hackers have access.

10. Back up your system.
“If you don’t back up your systems and check those backups, a ransomware attack can be devastating,” says Weiss.

Make sure backups are off-site and, if possible, on a separate electric grid, Renn says.

11. Consider cyber liability insurance. However, know what type of coverage you’re getting, advises Bisceglie, adding that practices should ask about coverage specifics, deductibles and required prerequisites for coverage.

12. Retain a cyber liability attorney. This should be the first person you call if you suspect your practice has been hit with a cyberattack because they can advise you on what to do next, says Renn. “If you don’t follow the right steps, the insurance company could null and void your coverage.”

Don’t just assume you can pay ransomware, says Renn. Engaging in a financial transaction with a sanctioned country, for example, could mean major civil and criminal penalties. “Contact your legal team because sanctions risks can be complex,” she says. “Your cyber liability attorney will be able to guide you in this area.”

13. Consider managed cybersecurity services. Small medical practices may not be able to afford an IT staff member to focus on cybersecurity. That’s why having someone else do it may be the best option, says Weiss. A managed cybersecurity services provider will properly secure the medical practice’s network and provide ongoing cybersecurity monitoring services. Weiss says to consider these questions when vetting providers:

• What does the provider do when it detects malicious activity?
• Can the provider detect when a breach has occurred? Can they detect when data has been lost?
• Does the provider give recommendations on enhancing security?
• Are they available 24/7?