1. HIPAA Training

All individuals associated with your practice — providers, staff, volunteers, and vendors — should receive annual security awareness training. For sensitive healthcare data to remain secure, everyone’s gotta be embracive of cybersecurity.

HIPAA constitutes two key components related to healthcare data protection:

The HIPAA Privacy Rule – The Privacy Rule demands safeguards to protect the privacy of patients’ protected health information including insurance particulars, medical records, medications, among other private details. This rule places a limit on what information can be used and disclosed to third-party vendors without gaining prior authorization from the patient’s side.

The HIPAA Security Rule – The Security Rule places emphasis on securing the use, creation, receipt, and maintenance of patients’ electronically protected health information by HIPAA-covered entities. This rule essentially sets standards and guidelines for the physical, administrative, and technical handling of protected health information.

During 2019, close to 75% of healthcare organizations suffered from a major security incident.

— Healthcare Information and Management Systems Society (HIMSS)

2. Protecting Mobile Devices

Healthcare providers like yourself use mobile devices on the daily — whether it’s using a smartphone to access information to help treat a patient or one of your administrative workers processing insurance claims. Enterprise mobile management best practices include:

• Managing all devices, as well as constantly maintaining security settings and configurations.
• Enabling remote lock and wipe, so unauthorized users (such as ex-employees) are easily removed from the system.
• Full device or app-by-app encryption that's monitored and enforced.
• Enforcement of device-level passwords.
• Monitoring the operating system's integrity to avoid usage of compromised versions.
• Implementing an auto-wipe policy to minimize the risk of attacks via lost or stolen devices.
• Secure email and attachments to prevent malware from being spread from personal accounts.
• Protecting application data by encrypting app data for operating systems such as Android or deleting app data if a device is non-compliant.
• Prevent untrusted file-sharing apps from accessing secure documents.
• Log devices and actions for audit.

3. Conduct Regular Risk Assessments

Conducting regular risk assessments can identify vulnerabilities or weak points in your organization’s security. By assessing risks across your healthcare organization on the regular, you can spot and stop data breaches that could end up costing you a lot of money and harm your practice’s reputation.

Remember that while security is a HUGE necessity there isn’t really a one-size-fits-all solution. Choosing and implementing security protocols that will work best for your practice needs a thoughtful analysis of your ongoing policies and operations. If you’re looking for experts who can guide you through and give you direction on your next steps, Done Desk Coaching is here for you.

4. Encrypting all Data at Rest and In Transit

A large HIPAA concern for the health IT providers we’re seeing through Done Desk these days is encryption of data when it is not in transit (i.e. in a patient portal, or being shared.) This data is usually unencrypted when it is sitting in storage or on your practice’s iPad in the office.

Encrypting data that’s “at rest” is a real hot-topic in the HIPAA world. Everyone’s talking about data that’s moving around — but your office equipment is just as vulnerable. Would-be intruders can steal, decode, and share that data if they manage to gain access to it.

 And get this — according to one recent Verizon report, 58% of healthcare data breach incidents involve insiders, which happens to be one of the highest percentages of insider threat observed in any industry. One best practice here would be to make sure that patient information is only retrievable on a need-to-know basis.

5. Plan for an Inevitable Breach

Alright, so you’ve covered all your bases — data backups, anti-virus software, firewalls… the full shebang — but somehow you still get hit with a data breach. What do you do now? As attacks grow more sophisticated, the best strategy is to plan for the inevitability of a breach while also working to prevent one.

Data breaches in the healthcare industry increased by 58% in 2021 and Healthcare is the most

expensive industry for data breaches at an average $7.13 million. — IBM & Verizon

Done Desk’s partners specialize in helping you navigate medical risk — so we’re bringing data breach coverage to your attention. It’s critical in keeping your business’ data safe and secure. A comprehensive mitigation and recovery plan should also outline how your organization will attempt recovery of the lost information. The plan should detail how you will provide the required notification to affected individuals and others. The goal will be to demonstrate publicly that the data loss is being handled responsibly and appropriately.

Need help writing a Data Breach Response Plan? Here’s where we talk about it in more detail.