Radiology Coding Alert

Add HC3 to your list of helpful healthcare acronyms.

As new technologies are deployed to assist radiologists provide care to their patients, healthcare organization systems and patients’ protected health information (PHI) are at risk of compromise. Regardless of whether the radiology practice you work with prioritizes cyber hygiene or outsources their cybersecurity, the Department of Health and Human Services (HHS) Health Sector Cybersecurity Coordination Center (HC3) is available for your cybersecurity needs.

Radiology Coding Alert has compiled this primer on new digital threats and how HC3 can help your radiology practice stay safe from cyberthreats.

What is Cybersecurity?

Cybersecurity is a term used to describe the practice of protecting computers, servers, mobile devices, electronic systems, networks, and data from digital attacks, damage, or unauthorized access. It involves implementing measures to prevent and mitigate cyber threats, which can range from phishing and malware to more sophisticated attacks like ransomware.

What is PHI?

PHI is best defined as “all ‘individually identifiable health information’ held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral,” reminds the HHS Office for Civil Rights (OCR) in its HIPAA Privacy Rule guidance.

The HIPAA Privacy Rule identifies 18 items as “individually identifiable health information” that are considered PHI:

1. Name

2. Address

3. Birth date and other corresponding dates of admission, discharge, death, etc.

4. Landline and cellphone numbers

5. Fax numbers

6. Email addresses

7. Social Security Number

8. Medical record number

9. Health plan beneficiary number (i.e. Medicare Beneficiary Identifier)

10. Account number

11. State identification or license number

12. Vehicle identifiers and serial numbers, including license plate numbers

13. Device identifiers and serial numbers

14. URLs

15. IP addresses

16. Biometric identifiers like finger or voice prints

17. Photo or image of patient, specifically the face

18. Any other unique code, characteristic, image, or number that identifies the individual

The HIPAA Security Rule also protects certain information covered by the Privacy Rule, which includes “all individually identifiable health information a covered entity creates, receives, maintains or transmits in electronic form,” according to the U.S. Department of Health and Human Services (HHS) website.

Additionally, the Security Rule instructs covered entities (CEs), such as healthcare providers, health plans, or healthcare clearinghouses, to take the appropriate measures to protect ePHI through administrative, technical, and physical safeguards. You must never disclose PHI or ePHI to unauthorized persons, or you’ll be in violation of HIPAA’s Privacy and Security Rules.

Watch for New Threats to Patient Privacy

Using digital healthcare comes with its advantages, but keeping PHI safe can be difficult when new types of threats continue to arise. For example, some apps are using tracking technology, which presents both a privacy and a security risk. Each person’s medical and financial data is incredibly valuable to hackers, which is “why healthcare organizations and devices are high-value targets for cyber criminals,” says Peter Newton, senior director of product and solutions at Fortinet in Sunnyvale, California.

Details: On July 20, 2023, the HHS Office for Civil Rights (OCR) and the Federal Trade Commission (FTC) issued a joint letter to CEs, business associates, and third-party vendors warning them about using Meta/Facebook pixel and Google Analytics, which can track an individual’s online activities. “These tracking technologies gather identifiable information about users as they interact with a website or mobile app, often in ways which are not avoidable by and largely unknown to users,” the joint letter said.

OCR further warned CEs about these dangers with an updated bulletin in December 2022. In the bulletin, OCR “significantly expanded its interpretation of the definition of PHI to include, in some instances, identifiable information gathered by tracking technologies where a user visits a website and does not interact with the entity in any other way,” note attorneys Kathryn F. Edgerton, Lara D. Compton, and Kate F. Stewart with law firm Mintz, Levin, Cohn, Ferris, Glovsky and Popeo, P.C. in online legal analysis.