InnoHEALTH magazine interviews
Akhil Systems Pvt Ltd.

• In addition to a patient’s records, medical provider networks can contain valuable financial information.
• Since there are very few people who do not see healthcare providers, nearly everyone’s personal information is available in some form.
• The interconnected nature of EHRs means hackers have access to the data that has been collected under patients’ names for years. Sharing patient information is integral to providing the best possible treatment to patients, but that same sharing also makes networks extremely valuable targets.

But at the same time, there are more gains than risk in shifting from paper-based to electronic records like:

• Electronic health records enable you to give only authorized personnel access to patient data.
• Strong encryption protocols make sure that confidential patient information remains secure.
• Paper records pose a number of security risks and it can be difficult to detect when they have been tampered with.
• With electronic health records, you can maintain your patient data in secure backups, enabling your organization to quickly recover after a data disaster.
• At your end what security compliances and practices do you follow
  Providing services for healthcare brings many complexities, and risk management professionals need to consider this seriously. However, issues such as accreditation or licensing standards, regulations and third-party requirements can be mitigated with the introduction of formal policies and procedures for hospital information security infrastructure. These policies and procedures help promote safe and good quality care for patients, workplace safety, compliance to regulations, and, most of all, uniformity of healthcare practices across the hospital network.

To minimize those risks, we have multiple options like:

• Access Control – is the means by which access to people such as patients, visitors, and staff is granted or denied throughout the healthcare facility and access to its IT assets. These areas include, but are not limited to, maternity wards, pediatric department, emergency, intensive care unit ICU, pharmacy, etc.
• Video Surveillance – Cameras now have embedded processors and videos can be compressed and transmitted over IP networks in real time. This concept of having the ability to view and record any activity at any time from any location has fundamentally helped healthcare facilities to optimize their security with video surveillance.
• Staff, Patient and Asset Tracking – Regardless of which facility your patients are admitted in, it is critically important to provide them safety and protection. With the help of technology, security professionals and concerned staff can now identify, track and locate patients to provide safeguard against patient abduction or elopement.

• Observe recognized professional practices.
• Ensure compliance with health regulations and standards, such as HIPAA, CMS conditions of participation, etc.
• Create a standard system for practices in a single health unit.
• Provide knowledge to staff, particularly new employees, on how various functions are carried out.
• Reduce the chances of human error by providing documented guidelines rather than relying on memory.

• Establish a security culture: Ongoing cyber security training and education emphasize that every member of the organization is responsible for protecting patient data, creating a culture of security.
• Protect mobile devices: An increasing number of health care providers are using mobile devices at work. Encryption and other protective measures are critical to ensure that any information on these devices is secure.
• Maintain good computer habits: New employee onboarding should include training on best practices for computer use, including software and operating system maintenance.
• Use a firewall: Anything connected to the internet should have a firewall.
• Install and maintain anti-virus software: Simply installing anti-virus software is not enough. Continuous updates are essential for ensuring health care systems receive the best possible protection at any given time.
• Plan for the unexpected: Files should be backed up regularly for quick and easy data restoration. Organizations should consider storing this backed-up information away from the main system if possible.
• Control access to protected health information: Access to protected information should be granted to only those who need to view or use the data.
• Use strong passwords and change them regularly: The Verizon report found that 63 percent of confirmed data breaches involved taking advantage of passwords that were the default, weak or stolen. Health care employees should not only use strong passwords, but ensure they are changed regularly.
• Limit network access: Any software, applications and other additions to existing systems should not be installed by staff without prior consent from the proper organizational authorities.
• Control physical access: Data can also be breached when physical devices are stolen. Computers and other electronics that contain protected information should be kept in locked rooms in secure areas.
• Apply Software Updates Promptly: Software providers regularly release updates for their applications. Any delay in applying these patches to your systems leaves you vulnerable to opportunistic attacks. (for instance, you could check for and apply updates every Saturday).
• Regular Risk Assessment: As technology, processes and procedures continue to evolve, the risks do so too. Performing a technology risk assessment at least once a year allows you to catch these new threats before they are exploited by third parties.