Tech & Innovation in Healthcare

Tip: Keep tabs on your practice mobile devices.

With ransomware incidents on the rise, cybersecurity has never been more important. Plus, as more providers offer virtual care options to their patients, the opportunity for data breaches increases. That’s why it’s critical that you manage your IT assets accordingly to protect both your patients’ data and your bottom line.

Understand These HIPAA Security Rule Facts

Keeping electronic protected health information (ePHI) safe is central to the theme of the HIPAA Security Rule, but security violations continue to be a thorn for both small and big covered entities (CEs). Part of the problem revolves around failures to implement better risk management after issues arise or are uncovered in risk analysis — a requirement under the “Administrative Safeguards” section of the Rule.

“The HIPAA Security Rule requires that organizations implement ‘reasonable and appropriate’ security controls based on their assessment of risk,” explains Adam Kehler, director of RSP Healthcare Services with Online Business Systems. Unfortunately, many organizations lack the health IT staff, know-how, or funds to fully comply with the mandates — and that’s when violations crop up.

“Conducting a risk analysis, which is an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of the ePHI held by an organization, is not only a Security Rule requirement, but also is fundamental to identifying and implementing safeguards that comply with and carry out the Security Rule standards and implementation specifications,” reminds an HHS Office for Civil Rights (OCR) Cybersecurity Newsletter.

According to OCR, another issue CEs suffer from is not knowing where their IT assets are; thus, they often aren’t aware when things go awry. “Despite this long-standing HIPAA requirement, OCR investigations frequently find that organizations lack sufficient understanding of where all of the ePHI entrusted to their care is located,” the agency says.

Reminder: A proper HIPAA security risk analysis should include the following, according to Kehler:

• An inventory of ePHI throughout the organization
• A consideration of threats and vulnerabilities
• An evaluation of administrative, physical, and technical security controls
• A calculation of residual risk to ePHI

Identify Your IT Assets

You may be wondering what the feds consider an IT asset. OCR suggests that CEs and their business associates (BAs) should first identify and separate their IT assets into three groups: hardware, software, and data. Here is a breakdown of the three categories with examples:

1. Hardware assets: This refers to all the gadgets and IT hardware around your office, including mobile devices, desktop computers and workstations, servers, firewalls, routers, and other electronic media or tools such as medical devices that might be used to access ePHI.

2. Software assets: This covers every type of software utilized in a healthcare environment like device applications, email and messaging, EHRs and EMRs, operating systems, and anti-virus programs. “Though lesser known, there are other programs important to IT operations and security such as backup solutions, virtual machine managers/hypervisors, and other administrative tools that should be included in an organization’s inventory,” notes the OCR Cybersecurity Newsletter.

3. Data assets: The ePHI that you create, transmit, receive, collate, or simply maintain is considered a data asset — and safeguarding it is the focus of the Security Rule.

Add These Inventory Tips to Your Risk Management

After you’ve identified your IT assets, an enterprise-wide risk assessment is not only necessary but expected under HIPAA. Once your team figures out the best course to protect ePHI from being usurped, you can better manage your organization’s risks. It’s also critical to remind BAs that they’re required to implement policies and procedures to thwart the loss of IT assets, too.