If you have embarked on the fantastic journey of Health
Information Technology and Electronic Health Records, you probably would own a
good IT infrastructure by now, or at least you would plan to make one. By definition of IT security, consider every
potential hackers out there to eye for your network. With this intent plan your
strategy, best practices and rubrics. Hackers constantly innovate and remember
SECURITY IS A JOURNEY, SECURITY IS AN ONGOING PROCESS, Security is not a
product.
Protecting the privacy of your own Health Record (Personal
Health Record like www.myfamilyhealthportrait.com or www.healthvault.com) is a
doable task if you start strong, strategic and be knowledge driven.
This blog tries to simulate Dr. John D Halamka's blog by
placing the blogger as a geek patient who responds to Dr. Halamka's calls
1. Knowledge Takeaway
2. Suggestion takeaway
3. Policy Takeaway
4. Best Practice Take Away
5. Questions left unanswered and Request for Crowdsourced Approaches
##0001
Top 10 things a geek patient can do to enhance security.
[THE STARTER KIT TO APPROPRIATE SECURITY IN ANY HEALTHCARE ORGANIZATION]
1. Policies/Governance - Without policies and governance,
enforcing security best practices is impossible. Do you allow IM or not? In
this WhatsApp era should you be soliciting advices from your doctor friends?
Should you transfer pics? Do you allow modems to be attached to computers
without IT approval? Can data be copied onto a thumb drive and transported off
site? Such major policy questions must have definitive answers and sanctions
for violating these policies must be enforced.
Dr. Agarwal's Patient
Centered Medical Home OPC Pvt Ltd's current technology policy is found here
State Government's policy can be found hereFederal Government's Policy and Guidelines can be found here
2. Risk assessment and stratification - Do you consider the
HIV status of patients to be the same security priority as protecting the data
integrity of the library catalogue? Probably not. I have copied established 4
classifications of risk, which are practiced at BIDMC, Boston.
**** Internet
connected clinical data which is patient identified. Compromise of a passwords
could lead to access of thousands of patients records
*** Internet connected clinical data which is patient
identified. Compromise of a passwords could lead to access to one patient
record
** Internet connected clinical data which is not patient
identified. Compromise of passwords could lead to access of aggregate data
without patient identifiers
* No patient records available
Our journey to
enhance security focuses on **** and *** data first. By ensuring our latest
technologies and techniques protect our most sensitive data, we apply our
people and budgets to the areas of greatest risk.
3. Firewalls -
BIDMC's Policy -
"many years ago, we used the "Blanche Dubois" approach to
security - a firewall that empowered academic collaboration but relied on the
"kindness of strangers". One of our first security enhancements in
the 1990's was to replace our permissive firewall (allow anything except where
prohibited) with a restrictive firewall (deny everything except were
permitted). During this process we eliminated 99% of our publicly available IP
addresses, eliminated peer to peer traffic, and created a demilitarized zone
(DMZ) for our web servers." John Halamka, CIO, BIDMC
4. Intrusion
detection and prevention/Host intrusion protection - recognizing that operating
systems are patched continuously and that applications have vulnerabilities,
there are attacks that take advantage of the time between a patch being
released and a patch being applied.
BIDMC Best Practice:
We've employed software that provides "zero day" protection -
eliminating the kinds of traffic between servers that are suggestive of attacks
or questionable behaviour. We do this network wide and on individual servers,
especially our web servers.
5. Remote access methods - the security of the network is
only as good as its weakest point. Remote access technologies such as SSLVPN,
Metaframe, and Remote Desktop via thin client computing devices minimize the
threat of viruses from remote access points. Ideally, all computers accessing
protected healthcare information should have up to date operating system
patches, up to date antivirus software and no software which could compromise
the security of the device (i.e. peer to peer file sharing)
6. Network Access Controls - in most institutions, hackers
wanting to access a hospital network can walk in the front door, unplug and
existing computer and access the network with whatever nefarious devices they
choose. Less malevolent is the traveling vendor who plugs a laptop into the
network to do a demo, giving viruses and spyware on that laptop full access to
the hospital networks. Technologies such as Cisco's Network Admission Control
and
Microsoft's Network Access Protection restrict network
access to known machines containing the right versions of the right software
needed to ensure end to end security.
7. Vulnerability Assessment - Many healthcare applications
have vulnerabilities which can lead to inappropriate disclosure of patient
data. Typical vulnerabilities include buffer overflows, SQL/Javascript
injection attacks, and cross server scripting attacks. Hiring "white
hat" hackers to perform penetration testing of mission critical
applications, networks, and operating systems helps identify potential problems
before security is compromised. Even if vendors do not repair these
deficiencies, Host intrustion protection software can mitigate risks by
surrounding systems with an extra layer of vigilance, stopping attacks before
they start.
8. Provisioning/Authentication/Authorization - Having robust
processes to grant passwords only to qualified users, terminate accounts when
staff leave the organization and enable only the "minimum need to
know" access to clinical data are foundational to good security. When
passwords are issued, they should be strong (non-English words, mixed case,
numbers and letters, greater than 8 characters long etc.), expire at a
reasonable internal (at least yearly), and be role-based. Registration clerks
should not be able to access medication lists or psychiatric notes, only those
demographic data elements needed to perform their duties.
9. Anti-virus/Anti-Spyware - The design of Windows operating
systems, in which all internal "services" run as the administrator, creates
a vulnerable environment that necessitates the need for anti-virus and
anti-spyware software.
10. Audit trails - Authorized Internal users can be even
more of threat than external hackers. Collecting audit trails and implementing
a program to monitor accesses is essential. Has one account accessed more than
20 patients a day? Has more patient been examined by more than 20 accounts? Who
is accessing employee healthcare records? Who is accessing the record of a
famous athlete or actress? Audit trails and tools to mine audit data help
answer these questions.
These ten areas are a starter kit to appropriate security in
a healthcare organization. Security cannot be an afterthought, it is project
that must be resourced. A well trained and staffed security team is essential
to success. To keep our organizations secure, I have a full time Security
Officer and a team of security professionals maintaining our firewall rules,
intrustion detection/prevention software, and our auditing systems. Compliance
with HIPAA is a key motivator to implement good security, but most important is
retaining the trust of our patients. We are the stewards of their data and our
security systems are the last defense against breaches of confidentiality.
“Cues taken from Dr. Halamka's blog dated Oct 21, 2007
Providing security is a journey and we have been on the path
to security best practices for many years. The following is my top 10
recommendations to guide this journey
