Electronic Health Reporter

By Oliver Paterson, director of product management, VIPRE Security Group.

The healthcare sector is predicated on protecting all sensitive information for a practice and its patients. Threats come from every direction, whether through email, an attachment, a malicious link, or simply the penetration of a security system.

Solutions are aplenty but with various degrees of effectiveness and durability, not to mention complexity and quality of protection for the practice, all are important factors when measuring benefits versus risk. As healthcare practice leaders attempt to mitigate their continuous onslaughts of threats, possible breaches, and potential bad actors, automating security measures can alleviate trouble, distractions, and chaos caused by a breach or other malicious activity. 

While most in healthcare don’t like to discuss the ugly but open secret, email is a significant factor in many data breaches. Therefore, advanced levels of protection for Outlook and other email servers are essential, and add-on solutions solve the problem of misaddressed emails and prevent data leakage.

Technology that scans for sensitive keywords, personally identifiable information (PII), or data patterns inside the email body or attachments can provide practices with a critical layer of security.  

Confirm External Recipients and Attachments

Using data loss awareness (DLA) technology, users can confirm the practice’s external recipients (those receiving a message from the practice) before messages are sent. Such an integrated solution “asks” whether everyone on an email recipient list should be seeing the sensitive information contained, so the message is not sent to someone by mistake. Likewise, this prevents misaddressed emails or inadvertent auto-fill email mistakes.

Email breaches from accidental data loss can result in fines, regulatory non-compliance notices, and even litigation for a medical practice. Additionally, medical practices can (and should) seek solutions that proactively help users to prevent accidental data loss and keeps all sensitive information from leaving the organization

In such environments, all settings should be configurable and specified on a per-user or per-group basis. In addition, healthcare organizations should automate activity logs for all potential occurrences with a complete audit trail stored locally or centrally and supporting Outlook local languages, as these are often needed should you be audited.  

No compromises

In healthcare, there is no tolerance for compromise. Breaches can allow hackers to access sensitive organizational and patient information, harming every record throughout the organization. Breach and hacking have no room as primary goals for healthcare organizations, but practice leaders must define threats and segregate problems as they arise. Doing so means they can effectively determine how to respond once a breach is identified. 

Data loss awareness technology allows for audit trails that practice leaders can use to adjudicate issues, to teach and train against future events, and prepare against future incidents. 

Once these systems are put in place, an additional step healthcare organizations should take includes developing a culture of security awareness with web-based HIPAA and HITECH training courses designed to foster a privacy-conscious culture across an entire organization, whether that organization has a single employee or 10,000+. Training courses should include those for both supervisors and employees of covered entities, business associates, and direct care providers. Such courses can dive deeper than just meeting based security training requirements for web-based HIPAA and HITECH training solutions in the privacy and security rules and the HIPAA Omnibus Rule. These courses can quickly engage employees and teach them the importance of safeguarding protected health information to reduce HIPAA risk.

Ultimately, automation and secured solutions mean a better environment for ensuring the safety of information generated throughout a health system. Such technology — along with robust security awareness training programs — ensures confidential organizational and patient information stays safe, mistakes are eliminated, and safely sending sensitive information to the wrong recipient is reduced or eliminated, and ensures that only the correct information only goes to the intended recipient.