Home Health & Hospice Week

Reminder: If you know your systems are at risk, fix them immediately.

It’s just one laptop — but the repercussions of it being stolen reverberated far and wide for one company.

When a physical therapy facility had a laptop stolen, the company filed a breach report, prompting the HHS Office for Civil Rights (OCR) to open a compliance review. What the OCR found led to a startling settlement.

“OCR’s investigation revealed that [the company] had previously recognized in multiple risk analyses that a lack of encryption on its laptops, desktop computers, medical equipment, tablets and other devices containing electronic protected health information (ePHI) was a critical risk,” the Depart-ment of Health and Human Services says in a release. “While steps were taken to begin encryption, [the company’s] efforts were incomplete and inconsistent over time, leaving patient PHI vulnerable throughout the organization.”

Following the investigation, the company agreed to pay $1,725,220 to the government to settle potential violations, and plans to create a corrective action plan to fix the issues that the OCR found.

How this impacts you: Laptops, tablets, mobile phones and other devices can be left unattended in cars, public places, and even employees’ own homes, making equipment vulnerable to thieves. Worse yet, if PHI is on those devices and the information isn’t encrypted, you’re at risk of finding yourself in the same situation as the company in the case above.

Consider the following tips to ensure that your PHI is safe on mobile devices, from the Health IT.gov publication, Mobile Device Privacy and Security:

1. Always Use A Password. It may seem annoying to have to type in a password or PIN number every time you want to access your tablet or laptop, but if there’s PHI on it, you have no choice. Make sure your password is at least six characters long and has a combination of upper and lowercase letters as well as a keyboard character (such as the “*” symbol). In addition, make sure your device requires the password after a specific period of inactivity. For example, if you leave your laptop on the table for five minutes without using it, you’d have to enter the password to use it again.

2. Install Encryption Software. One of the problems that the company had in the case profiled above was that the stolen laptop was not encrypted. In other words, anyone could read what was on it in plain English. If you add encryption to your mobile devices, the data cannot be converted into readable words without a decryption key or password. You should not only have encryption enabled for data stored on your device, but also for any information that you send which might contain PHI.

3. Activate Remote Disabling. It may sound like something out of Blade Runner, but the ability to erase your hard drive from a remote location is very much a realistic option. If you have this capability on your devices and the devices get stolen, you can wipe the data clean remotely, so the thief won’t have access to any of the information on the laptops or tablets. Although many mobile phones already have this option built-in, you can often download remote disabling software after purchasing the device if you are interested in adding it to any of your products.

4. Disable File Sharing. You might think it’s very convenient to allow your employees to “file share” with each other or outside billing companies, which means that you can trade computer files, but this type of application also leaves your device vulnerable to unauthorized users, and it’s a bad idea.

5. Maintain a Firewall. If your device doesn’t already have a firewall installed, it’s time to get one. The term “firewall” simply means that you can block outsiders from getting into your server remotely and accessing your information.

6. Install Security Software. Most of us have security software installed on our laptops to ensure no viruses can enter (which often can steal your information) — but many don’t keep it appropriately updated, which makes computers vulnerable to attacks. Ensure that your security certificate is up to date and that you run software scans regularly.

7. Ensure That Apps Are Safe. Down-loading an app to your phone, tablet or computer might seem harmless, but it may not always be. Some apps can copy your address book or other private information and then send it to another company. Always ensure that apps are trusted before adding them to your devices.

8. Avoid Public Wi-Fi Networks. Using a portable device over a public Wi-Fi connection makes you vulnerable to interception of your PHI. Always use a secured connection when you’re on the internet using your mobile device.

9. Delete Stored PHI. You might think you’re being “eco-friendly” by recycling your portable device or handing it to a warehouse when your agency gets new devices, but your PHI could still be on there, even if you think you’ve deleted it. Instead of simply sending your files to the “recycle bin,” you should use software specifically designed to overwrite your computer with other data.

10. Don’t Tempt Thieves. If you can’t keep your mobile device near you, lock it away out of sight — i.e., not on the front seat of your car.