6 steps to protect your healthcare data
by Aline Liu
As the amount of healthcare data skyrockets, so do data privacy and security risks. Not only can privacy and security breaches damage your organization’s reputation and compromise patient relationships, but they can also result in major costs. For example, data breaches can carry Health Information Portability and Accountability Act (HIPAA) violation penalties as large as $1.5 million annually. And, unlike in the past, the HIPAA Final Omnibus Rule now holds you responsible for protecting your patients’ private information — such as date of birth, medical record number or Social Security number — by requiring compliance with a comprehensive list of audit checkpoints and adhering to regulations.
To reduce the chance of information mismanagement, harmful breaches and major headaches, hospitals and health systems must take steps to properly capture and manage the flow of clinical and non-clinical information.
So, what small steps can you take today — without disrupting your workflows — to avoid similar breaches? As a start, be sure your organization applies the following six tips:
1. Strengthen user authentication
Adopt controlled access safeguards that can lock down your printers and limit access to certain features, depending on who is using them. At the same time, these safeguards control how and where documents and images are securely stored. Also consider heightening your password security.
2. Encrypt your data
Make data unreadable to anyone except authorized users and intended recipients. Applicable to stored and transmitted data, encryption protects the integrity of documents, images, messages and other personal health information. Technical safeguards as defined by the HIPAA Security Rule are meant to govern the access to electronic protected health information and include the following specifications:
3. Protect confidential information
Use data overwrite security to automatically overwrite latent digital images. This makes it virtually impossible to reconstruct files and eliminates future access to those files from the original device.
4. Create an audit trail
Track anyone who uses your devices and accesses data. This will help you produce and maintain the data audit trail required by the HIPAA Final Omnibus Rule. Administrative safeguards are also regulated through the HIPAA Security Rule to protect patients’ personal health information. These policies require you to:
5. Properly dispose of old equipment
Identify obsolete technology that no longer has the capability of keeping your data safe. By getting rid of these systems safely and securely, your organization alleviates any unnecessary added chance of data risk.
6. Implement physical safeguards
Protect and assess hardware used to share and transfer information to make sure that the right people have access to the right areas, including facility access controls, workstation use and security, and device and media controls.
It’s time for healthcare leaders to re-evaluate their HIPAA compliance risks and form smart strategies to securely capture, access and share information. If you’ve taken action on each of the items above, you’re on your way to ensuring only the right people touch your data — ultimately protecting your patients, employees and the bottom line.
