By using this site, you agree to the Privacy Policy and Terms of Use.
Accept
Health Works CollectiveHealth Works CollectiveHealth Works Collective
  • Health
    • Mental Health
    Health
    Healthcare organizations are operating on slimmer profit margins than ever. One report in August showed that they are even lower than the beginning of the…
    Show More
    Top News
    medicare part d benefits
    Everything that You Need to Know About Medicare Part D
    August 15, 2022
    Best Ways to Boost Your Immune System this Winter
    Best Ways to Boost Your Immune System this Winter
    November 15, 2022
    back pain issues
    Ways to Treat Constant Back Pain
    August 21, 2023
    Latest News
    How Probate Planning Shapes the Future of Your Estate and Family Care
    July 17, 2025
    Beyond Nutrition: Everyday Foods That Support Whole-Body Health
    June 15, 2025
    The Wide-Ranging Benefits of Magnesium Supplements
    June 11, 2025
    The Best Home Remedies for Migraines
    June 5, 2025
  • Policy and Law
    • Global Healthcare
    • Medical Ethics
    Policy and Law
    Get the latest updates about Insurance policies and Laws in the Healthcare industry for different geographical locations.
    Show More
    Top News
    More On Wellness Programs To Improve Health and Reduce Costs
    January 25, 2012
    Privatizing Social Security and Medicare: Who Can Defuse Political Dynamite?
    June 12, 2011
    Study: Risk of Death in Elderly Patients with Dementia Doubled with Some Antipsychotic Medications
    February 26, 2012
    Latest News
    How IT and Marketing Teams Can Collaborate to Protect Patient Trust
    July 17, 2025
    How Health Choices and Legal Actions Intersect After an Injury
    July 17, 2025
    How communities and healthcare providers can address slip and fall injuries with legal awareness
    July 17, 2025
    Let Your Lawyer Handle the Work Before You Pay Medical Costs
    July 6, 2025
  • Medical Innovations
  • News
  • Wellness
  • Tech
Search
© 2023 HealthWorks Collective. All Rights Reserved.
Reading: Solutions for the Top 5 Security Vulnerabilities
Share
Notification Show More
Font ResizerAa
Health Works CollectiveHealth Works Collective
Font ResizerAa
Search
Follow US
  • About
  • Contact
  • Privacy
© 2023 HealthWorks Collective. All Rights Reserved.
Health Works Collective > eHealth > Solutions for the Top 5 Security Vulnerabilities
eHealth

Solutions for the Top 5 Security Vulnerabilities

onlinetech
onlinetech
Share
6 Min Read
SHARE

A recent article from HealthCareITNews.com details the top five security vulnerabilities that “could mean trouble” – that is, result in a data breach. While these risks are entirely valid, the article doesn’t offer tactical solutions or alternatives to reduce said risks. [Note: these security vulnerabilities should be of concern in any industry, not just healthcare – i.e., financial, ecommerce, software, etc.].

So I thought I would respond:

A recent article from HealthCareITNews.com details the top five security vulnerabilities that “could mean trouble” – that is, result in a data breach. While these risks are entirely valid, the article doesn’t offer tactical solutions or alternatives to reduce said risks. [Note: these security vulnerabilities should be of concern in any industry, not just healthcare – i.e., financial, ecommerce, software, etc.].

So I thought I would respond:

More Read

Tips to Create Unique Social Media Content for Your Hospital
Are Decision Support Tools Turning Doctors into Idiots?
New Policy Statement on Online Medical Professionalism
Gazing into the Future for Social Media in Health Care
Breach of UofM Health System: 4K Affected

Theft.
The article acknowledges that lost or stolen media, often in the form of a backup tape or laptop, were the culprit for a data breach. The Sutter Health incident involving a break-in and theft of a desktop computer is used as an example. But the article fails to provide a way to prevent the loss of innumerable patient records by media theft.

Keeping ePHI (electronic protected health information) or other sensitive information on secure networks, and not physical devices can greatly decrease the potential risk of allowing thieves access to ePHI. With remote access to networks using mobile devices, the use of two-factor authentication is greatly recommended – it verifies the identity and access level of the user trying reach the data. Read more about this here: Keep ePHI on Secure Networks, Not Mobile Devices, Recommends OCR.

In addition to keeping data in HIPAA compliant data centers with standardized network security in place, investing in an offsite backup solution that doesn’t use tapes can help prevent a data breach.

Mobile devices.
Similar to the theft issue, mobile devices “don’t have the same level of security controls as computer systems,” the article claims. In addition to keeping ePHI/sensitive data off of physical devices, a BYOD (Bring Your Own Device) and mobile policy can standardize users’ behavior when it comes to transmitting, storing and accessing data.

A solid set of policies and procedures, as well as a security awareness and training program can ensure your employees know what is expected when it comes to the use of mobile devices.

Dissemination of data.
Target data sharing between healthcare organizations and third-parties, the article claims the lack of security, tracking and auditing capabilities as a source of data breaches. The article states those that transmit data must “invest in technology and processes that protect the data in transit and at rest.” But what kind of specific technology could do that?

SSL certificates can secure the transit of information from a web server to the user by starting a secure session and encrypting shared data. Encryption for data at rest and in transit should follow the U.S. government, NIST-approved (National Institute of Standards and Technology) AES-256 (Advanced Encryption Standard). Additionally, using SFTP (Secure File Transfer Protocol) to transfer files can help secure and validate the identity of users.

Outsourcing to business associates or third-party vendors.
The article mentions the growth in outsourcing, and the need for business associates, vendors and partners to follow national regulations (HIPAA, PCI, SOX, etc.). The article mentions pre-contract assessments of business associates, and post-contract compliance assessments, but more due diligence should be done pre-contract to minimize as much risk as possible.

Start by asking managed hosting providers for a copy of their Report on Compliance (ROC), for any type of compliance. This means they’ve invested in an independent audit of their facilities and services and were found to be operating at 100% compliance with the standards.

A HIPAA hosting provider should also be able to provide documented policies and procedures of their security practices, dates and signed documentation of employee training, and a comprehensive Business Associate Agreement (BAA) outlining their responsibilities and incident response protocol.

The cloud.
The article gets kind of vague here, stating that cloud computing is popular because it’s cost-efficient to outsource both storage and compliance out to a provider, yet it “adds another layer of potential breach exposure to a healthcare organization.” The article concludes by stating the responsibility of securing information in the cloud is ultimately on the shoulders of a covered entity, which is true, but can be alleviated by doing their due diligence as described above.

Another article I wrote, Outsourcing Cloud Computing Security, outlines sample questions to ask your potential new HIPAA cloud hosting provider. Cloud Computing and Compliance also explains the difference between Software/Infrastructure-as-a-Service.

Healthcare Organizations: Seeking a Cloud Provider? BAAs Required quotes David S. Holtzman of the HIPAA enforcement entity, OCR (Office of Civil Rights):

If you use a cloud service, it should be your business associate. If they refuse to sign a business associate agreement, don’t use the cloud service.

The article also lists important provisions in your cloud contract to minimize security vulnerabilities and ultimately protect your PHI.

References
5 Security Vulnerabilities That Could Mean Trouble

TAGGED:HITsecurity
Share This Article
Facebook Copy Link Print
Share

Stay Connected

1.5kFollowersLike
4.5kFollowersFollow
2.8kFollowersPin
136kSubscribersSubscribe

Latest News

Grounded Healing: A Natural Ally for Sustainable Healthcare Systems
How IT and Marketing Teams Can Collaborate to Protect Patient Trust
Global Healthcare Policy & Law
July 17, 2025
paramedics in surgical gloves and masks
How Health Choices and Legal Actions Intersect After an Injury
Health care
July 16, 2025
a woman giving a key
How Probate Planning Shapes the Future of Your Estate and Family Care
Health
July 16, 2025
a woman with kinesio tapes on her back arm
How communities and healthcare providers can address slip and fall injuries with legal awareness
Health care
July 16, 2025

You Might also Like

StethoCloud–A $20 Stethoscope Attachment for a Smartphone to Diagnose Pneumonia In the Works

August 27, 2012
eHealthMobile HealthTechnology

4 Important Ways Virtual Reality Is Impacting Healthcare

January 12, 2019

Is Patient Privacy Endangered by Online Search?

July 12, 2013

ATA Looks to New Forum to Connect the Telemedicine Dots

August 31, 2012
Subscribe
Subscribe to our newsletter to get our newest articles instantly!
Follow US
© 2008-2025 HealthWorks Collective. All Rights Reserved.
  • About
  • Contact
  • Privacy
Welcome Back!

Sign in to your account

Username or Email Address
Password

Lost your password?