The Urgent Need for the Smart Use of Smartphones in Healthcare

by Felicien | Apr 18, 2018 | Education

10 Steps Healthcare Facilities Should Take to Ensure the Security of ePHI When Employees Use Smartphones

It’s estimated that 74 percent of hospital workers use tablets or other mobile devices to collect and share information about patients.1 And although smartphones and other mobile devices can provide many benefits in the healthcare setting, using them also presents a number of risks.
Unless they are used safely, electronic Protected Health Information (ePHI) can be exposed, and malware and viruses can enter a facility’s IT network. Without adequate safeguards in place, this can lead to costly HIPAA violations.
Hospitals, medical clinics and healthcare entities must comply with HIPAA Privacy and Security Rules to protect and secure patients’ information, even when using mobile devices like a smartphone.
Banning smartphones isn’t the answer. When a patient is in pain, every minute counts. If there isn’t an order for pain medication in the patient’s record, a nurse must consult with their physician. In this instance, using a mobile phone can speed up the process. However, this, and other smartphone communications must be handled in a secure manner to protect the healthcare facility’s IT systems, and safeguard patient privacy.
Smartphone Data Breaches and HIPAA/HITECH
CIOs and technology professionals in healthcare facilities are concerned that the increase in smartphone usage increases the chances of security breaches where ePHI is revealed. The HIPAA Privacy Rule mandates that covered entities “reasonably safeguard” PHI from any intentional or unintentional use or disclosure that is in violation of the rule’s standards. It also outlines provisions for ensuring the confidentiality, integrity, and availability of PHI that is transferred or held in electronic form.
Covered entities include not only healthcare facilities but individual providers.
The HIPAA Security Rule outlines provisions for ensuring the confidentiality, integrity, and availability of PHI that is transferred or held in electronic form.
HIPAA concerns include:

Theft or loss of a smartphone that has PHI on it.
Staff or volunteers taking and distributing unauthorized photos.
Staff revealing PHI on social network pages—for example, by posting text or photos that could be classified as individually identifiable health information.
Unauthorized individuals accessing the healthcare facility’s systems.
Staff or physicians forwarding an unencrypted email that contains PHI from their organizational account to a personal account that does not have reasonable safeguards to protect PHI.

Data breaches involving patient information can lead to costly fines and settlements–and even criminal penalties. And the health information privacy laws and regulations in some states are even more extensive than federal HIPAA regulations.
Under the Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009, breaches of unsecured PHI must be reported to the affected individual, to the U.S. Secretary of Health and Human Services, and in certain cases, to the media. Both HIPAA and HITECH emphasize the importance of privacy and security with the use of ePHI when using smartphones and mobile devices.
Improper Smartphone Use Can Spread Viruses and Malware.
“Security of Mobile Computing Devices in the Healthcare Environment,” (by the HIMSS Mobile Security Work Group) warned that “as the popularity of mobile computing devices increases, so too does the possibility that someone will create malware that is intended to impact its use or compromise patient data.”
When used in a healthcare (or any) environment, smartphones should be routinely updated with the latest antivirus software and malware protection. This is not always an easy task and should be handled by a certified, IT expert (Managed Service Provider).
And because caregivers and providers are the first lines of defense, they must undergo Security Awareness Training to be educated about unsafe practices, such as opening suspicious attachments or clicking on questionable links.
Without a clear understanding regarding safety when using smartphones, and the potential negative effects (security breaches), users may ignore a healthcare facility’s security policies. This emphasizes the need for user education about the risks and consequences of not following security policies.
10 Steps Healthcare Facilities Should Take to Ensure Data Security When Employees Use Smartphones:

Devise and implement policies to control who can view and access smartphone data.
Assess the content of email messages and file attachments to automatically identify ePHI.
Make sure caregivers use two-factor authentication and digitally signed documents so only authorized users can access and transfer ePHI.
Disable SMS (Short Message Service) preview on smartphones. This prevents others from viewing text messages without authority.
Disable speech recognition features like Siri, Cortana or other personal assistants. If not, unauthorized users can gain access to software on smartphones.
Use strong passwords that are hard to guess. They should contain at least six characters with a combination of both upper and lower-case letters, with at least one number and one keyboard character.
Change passwords often and at least quarterly.
Set smartphones for automatic logoff. If the phone is lost or stolen the culprit would need the password to open it.
Set smartphones to limit the number of unsuccessful login attempts.
If a violation is detected:

Stop and quarantine the interaction.
Remove the attachment from the email.
Return a message to the original sender.
Notify a manager.
Retract the information.
Re-route and encrypt* the email for secure delivery.

*There are a number of ways to encrypt data in transit. Two include using a virtual private network (VPN) or a secure browser connection. The National Institute of Standards and Technology (NIST) has several Special Publications regarding encryption processes for data in motion, including SP 800-52 [PDF – 3.2 MB] and SP 800-77 [PDF – 255 KB]. SP 800-52 has information about transport layer security (TLS). (Contact your IT Managed Service Provider for more information.)
Mobile Device Management
Some mobile devices have a remote disabling and wiping feature built in. Remote wiping is a security feature that enables you to remotely erase the data on your smartphone if it’s lost or stolen. When you enable it, you have the ability to permanently delete data stored on your phone.
When using smartphones in a healthcare setting, it’s imperative that your IT Provider implements and deploys a professional Mobile Device Management (MDM) Solution.
A Professional MDM Solution Protects ePHI with:

The ability to locate, lock and wipe ePHI from a stolen or lost smartphone or mobile device.
Continuous remote monitoring and management of all authorized mobile devices.
Secure passcode implementation and enforced encryption.

As you can see, using smartphones always presents a number of risks, especially in a healthcare environment. And, unless you adequately safeguard patient data stored or in transit, unauthorized access to the healthcare facility’s systems could occur leading to ePHI breaches and HIPAA/HITECH violations. Executives and administrators should take necessary steps to prevent this by working with IT professionals who are certified in the latest security solutions.

IT Helps Dementia Patients

by Felicien | Apr 18, 2018 | Education

Dementia and Alzheimer’s are scary for both patients and caregivers. Right now, there is no cure. Scientists are trying to find ways of prolonging patient’s lives and delaying the onset of the disease. IT Technicians are finding ways to make lives better and caring for patients easier. Some remarkable work is doing things for these individuals that has never been seen or done before.

First, A Word About The Disease
According to Alzheimer’s International, nearly 44 million people worldwide have Alzheimer’s or related dementia. More than 5 million American’s are living with it, and Between 2017 and 2025 every state is expected to see at least a 14% rise in the prevalence of Alzheimer’s. Those statistics are startling, especially since Alzheimer’s disease is irreversible.
Accounting for around 70 perfect of dementia cases, Alzheimer’s Disease is the most common cause of dementia, a group of brain disorders that results in the loss of intellectual and social skills. These changes are severe enough to interfere with day-to-day life. It progressively destroys the brain and ruins memory and thinking skills, and eventually the ability to carry out the simplest tasks.
A Few Other Statistics

In 2017, Alzheimer’s cost the United States $259 billion.
By 2050, costs associated with dementia could be as much as $1.1 trillion.
The global cost of Alzheimer’s and dementia is estimated to be $605 billion.
Alzheimer’s is the 6th leading cause of death in the United States.
Between 2017 and 2025 every state is expected to see at least a 14% rise in the prevalence of Alzheimer’s.
By 2050, it’s estimated there will be as many as 16 million Americans living with Alzheimer’s.
Every 66 seconds someone in the United States develops Alzheimer’s.
1 in 3 seniors dies with some form of dementia.

Technology at its Finest
Because of these sad stats and high numbers, IT experts have come up with some amazing devices that use modern technology to aid in the care of people suffering from memory problems. Here’s a look at a few of the latest innovations.
Clocks
Clocks precisely intended for those with Alzheimer’s and dementia can help ease the stress associated with day to day life. Someone who has dementia may confuse night and day so an easy to read clock can help them to better tell the time.
Medication Management
Medication management technology created high tech automated pill dispensers which beep and open to remind caregivers and those with dementia to take their medicine. Vibrating alarms on a watch have also been fashioned to remind when it’s time for a pill. This technology serves the busy caregiver well by helping them not to forget medication time as well.
Video Monitoring
Video monitoring technology supports both care recipient and caregiver, by allowing both people more freedom. The patient doesn’t feel watched constantly because loved one can spend a little time away, and loved ones get the comfort of being able to see their family even when they’re not in the same house.
GPS Location and Tracking Devices
People with Alzheimer’s or dementia may wander. Tracking devices can be worn by the person in some way and have alert systems that let a caregiver know if their loved one has left a certain area. This type of technology can also alert emergency personnel to aid in a quick recovery.
Picture Phones
Picture phones are specifically designed for people who cannot remember phone numbers. These phones have large numbers and are pre-programmable with frequently called phone numbers. Some of the phones come with clear buttons where photos can be placed so that the person can just push the button associated with the photos to call their loved one quickly.
Electrical Use Monitoring
This device monitors a patient’s use of electrical appliances. It plugs into a wall outlet or power strip and will alert caregivers if their commonly used appliances have not been turned on or off.
Wearable Cameras
Wearable cameras and augmented reality glasses could be the next big thing in helping patients. These devices can take hundreds of pictures every day from the user’s point of view logging their lives in this way.
A Village of Care
In Kitchener, Ontario, something wonderful is happening. Facilities have been designed to be less institutional-looking, friendlier and homier. “Schlegel Villages” is one of the first of its kind and is improving the quality of life for the people that live there.
One problem they deal with though is when at-risk seniors become confused and attempt to leave. According to Schlegel’s IT director, Chris Carde, “Some seniors with certain types of mental illness can remember the door-lock code to get out but can’t remember anything else. A confused senior wandering out into a southern Ontario winter can be a serious, even fatal, incident”.
Schlegel Villages is also implementing an e-health system to replace paper charts at its care facilities. Carde states, “Nurses would have to write down a patient’s vital signs, then enter them into a desktop computer some distance away. The new system, which will use iPads and iPad minis to enter health information directly into the database, is being greeted warmly by clinicians”.
Thinking Outside of the Box
A German senior center applied the idea of using fake bus stops to keep Alzheimer’s disease patients from wandering off. Because their short-term memory is not intact, but their long-term memory works fine, they know what the bus stop sign means, and they stop. It is a huge success in Germany, now they want to bring it to several clinics in North America.
A Final Word
Thanks to these researchers and IT innovators, the future is much brighter for patients with memory diseases and their families and care providers. This is just the beginning when it comes to making life easier. Information Technology has only just begun to scratch the surface of what can be done to help in the fight against dementia and Alzheimer’s.

How Much Is Your Medical Data Is Worth?

by Felicien | Apr 17, 2018 | Education

Believe it or not, your medical record has the potential to be sold for thousands of dollars. And due to the digitization of health records, it’s now more prone to theft.

As more patient health records have gone digital over the years, they’ve become vulnerable to hackers—and far more valuable than credit-card data or other forms of confidential data.
Why? Because they contain insurance information that poachers can use for fraudulent billing and illegal prescriptions. These thieves can falsify insurance claims and collect checks and obtain hundreds of thousands of dollars in free care on someone else’s insurance.
The healthcare industry wasn’t prepared for this, and they are trying to play catch up to secure protected health information (PHI):
“The U.S. has a huge shortage of highly qualified cybersecurity people across all industries,” says Rod Piechowski, a senior director at the Healthcare Information & Management Systems Society, or HIMSS, a Chicago-based nonprofit with more than 50,000 members. “Being late to the game, health care just can’t compete.”
Health IT professionals, although they are in great demand, haven’t been able to play a major role in employer’s’ software procurement decisions. This is unlike banking and the financial industry where their option is regularly solicited before a major IT system is implemented. And until recently cybersecurity wasn’t prioritized in healthcare the way it has been in financial services. The result is that IT professionals had no influence when it came to software security standards for medical care, and now they’re having to oversee systems that are difficult to safeguard.
If your PHI is breached, hackers have the information they need to blackmail you for the rest of your life. That’s because your EHR contains information like conditions you suffer from such as depression, anxiety or other psychological conditions, sexually transmitted diseases, or heart conditions. If released to the public, these might be an embarrassment to you or even keep you from obtaining a particular position.
How Bad Is It?
EHRs (electronic health records) are being used by over 96 percent of critical-care facilities, and 83 percent of all hospitals. While the digitization of health records enables easy access to patients’ information, if not properly safeguarded they’re also available to hackers. This poses a real threat to patient privacy.
In the year 2016, there were 450 data breaches where 27 million EHRs were affected. Of these, 120 came from the outside, while 200 (more than 65%) came from the inside.
In 2017, there were 477 healthcare breaches reported to the U.S. Department of Health and Human Services (HHS) or the media, which affected a total of 5.579 million patient records.
With major hospitals and healthcare organizations paying higher fines for lost patient data, the challenges of maintaining EHR security remains a huge concern. And because of this, the benefits of using them must be weighed against the risks of theft and misuse.
Presence Health in Chicago was fined USD475,000 by the U.S. Health and Human Services (HHS) because they didn’t report a 2013 breach in a timely manner. Advocate Health Care had to pay HHS a whopping USD5.5 million for a breach of patient privacy–the most ever by a single entity.
Compounding the issue, now physicians who are frustrated with the bogged down systems try to design their own workarounds to speed up processing of healthcare data. These ad hoc “shadow IT” systems are insecure and rely on unencrypted data and personal emails. It’s only a matter of time before a sophisticated hacker breaks in to steal their data.
How do hackers obtain medical records?
One of the ways they do this is through spoofing where the facility is fooled into thinking that the person accessing the information is legitimate. Plus, Microsoft researchers warn that many types of databases used for electronic medical records are vulnerable to leaking information despite the use of encryption.
Hospitals and healthcare organization use methods like data encryption and the scrambling of PHI (de-identification) to disguise data so hackers can’t read it.  However, the hackers simply steal the data and replace the encryption keys with their own to demand ransoms to unlock the data. This is called ransomware, and it’s very effective against healthcare facilities and hospitals that need ready access to patient data for their everyday operations.
Who are these hackers?
They’re not who you think they are. When we think of hackers, in our mind’s eye they are guys in hoodies working on computers in their parents’ basements. What’s hard to believe is that most attacks and data breaches don’t come from external hackers, but from the inside of an organization, where doctors, nurses or accounting personnel are negligent, abuse the system as disgruntled employees, or steal patient data for financial gain. In 2017, employee error affected 785,281 patient records and insider-wrongdoing affected 893,978.
One Promising Solution
Robert Lord, a former analytics systems designer, joined forces with Nick Culbertson, a former Special Forces operator when they were students at the John Hopkins University of Medicine. They created an Artificial Intelligence (AI) system to combat hacking of EHRs. They co-founded a cybersecurity company Protenus, to help the healthcare industry use artificial intelligence to prevent the theft of Protected Health Information and Electronic Health Records.
Lord explains:
“Your EHR contains all of your demographic information–names, historical information of where you live, where you worked, the names and ages of your relatives, financial information like credit cards and bank numbers…The medical record is the most comprehensive record about the identity of a person that exists today. We recognize that EHRs are living documents, so we’ve built an AI that is able to monitor how individuals interact with the EHR and associated systems, building a unique profile of every workforce member’s clinical and administrative workflow.”
The folks at Protenus are working on a solution that can tell the difference between routine access to EHRs or possible illegal attempts to retrieve this data. They do this by detecting unusual patterns and anomalies using AI that are then escalated to security officers. Over time, the solutions get “smarter” and learn exponentially as the customer base grows.
We’re Behind the 8 Ball When It Comes to Protecting EHRs.
Health care has lagged far behind banking and other industries when it comes to implementing security protocols. Until EHR records were mandated by Obamacare, many healthcare providers still used paper, faxes and handwritten charts. And once EHRs were finally implemented, the hackers were already a step ahead, and the medical industry is still scrambling to find ways to protect them.
Cybersecurity experts tell us that the seriousness of this can’t be overstated. The frequency of threats has taken off in the past 10 years as EHR data is increasingly networked between healthcare entities. And as we continue to struggle to secure our EHRs, increasingly savvy thieves are finding more ways to steal them.

The Lawyer’s Guide to Preventing 7 Major IT Headaches

by Felicien | Apr 17, 2018 | Education

Orbitz Hack Compromises Nearly 1 Million Customers – Are You One Of Them?

by Felicien | Apr 17, 2018 | Education

Orbitz has disclosed that a recent data breach could have exposed extensive information of up to 880,000 of their customers.

It’s so often these days that hacks hit big-name companies that consumers are becoming numb to it. The latest to get hacked? Orbitz.
The travel booking company recently announced that they may have been hacked, possibly compromising the personal information of approximately 880,000 users. The breach could have included their date of birth, gender, and credit card info, exposing those using the platform between January and June of 2016, and October and December of 2017.
“We determined on March 1, 2018, that there was evidence suggesting that an attacker may have accessed personal information stored on this consumer and business partner platform,” said Orbitz in a statement. “We took immediate steps to investigate the incident and enhance security and monitoring of the affected platform. To date, we do not have direct evidence that this personal information was actually taken from the platform. We deeply regret the incident, and we are committed to doing everything we can to maintain the trust of our customers and partners.”
Whereas Orbitz is big enough to handle the damage control for an incident like this, what about you and your business? Cybercriminals are often just as likely to target small organizations as they are large ones, particularly because of the lack of cybersecurity measures.
Are you prepared to defend your business? If you’re not sure, keep these tips in mind:
Stay informed about phishing and spoofing techniques. Regular security awareness training should be a top priority for your organization.
Stop and think before you click a link. Don’t click on links from random emails or text messages. Hover your mouse arrow over a link to see who sent it. Most phishing emails begin with “Dear Customer”, so watch out for these. Verify the website’s phone number before placing any calls. Remember, a secure website always starts with “https”.
Never divulge personal information requested by email. Phishing attempts try to send you to a webpage to enter your financial or personal information. If you suspect this, give the company a call. Never send sensitive information in an email to anyone.
Be skeptical of messages that contain an urgent call to action:

With an immediate need to address a problem that requires you to verify information.
That urgently asks for your help.
Asking you to donate to a charitable cause.
Indicating you are a “Winner” in a lottery or other contest, or that you’ve inherited money from a deceased relative.

Consider installing an anti-phishing toolbar and security tools. Some Internet browsers offer free, anti-phishing toolbars that can run quick checks on the sites you visit. If a malicious site shows up, the toolbar will alert you.
Never download files from suspicious emails or websites. Double check the website URL for legitimacy by typing the actual address into your Web browser. Check the site’s security certificate. Also, beware of pop-ups as they may be phishing attempts.
Block pop-ups via your browser settings. You can allow them on a case-by-case basis if you decide to.
Most importantly? Be sure you’re working with a trusted, reliable cybersecurity service provider. We have the industry experience and expertise needed to keep you and your business secure against today’s cyber threats.