By Alek Pirkhalo, Infiniwiz
A key to medicine is prevention and treatment. The same is true for computer technology. Many medical offices assume that their technology is protected and secure, but even those offices that take accepted protective measures may be leaving their patient data vulnerable.
As medical offices become more reliant on technology for patient portals, e-mail reminders and automated patient appointment reminders, the most vulnerable part of any medical practice is protecting are patient information.
If your system goes down, you will lose vital data including patient appointments, which will create chaos for your office staff.
Here is the prescription for securing data.
- Update your current technologies to protect log-ins
Many medical offices assume that once they invested in anti-virus technology, they are protected against any malware incursions. This is usually not the case as anti-virus technology must be constantly updated to keep pace with the technologies used by those who seek to steal information or threaten practices with malware or ransomware.
Medical offices should upgrade to the next generation of AI (artificial intelligence)-based antivirus software. AI-based antivirus can make decisions based on what it learns, or experiences. It is effective as part of a cybersecurity platform because it can use “reason” to evaluate network threats.
Those practices that have upgraded their cybersecurity have elected to depend on SOC, also known as a security operations center. This combines people, technologies, and processes to keep safeguard your network by receiving and analyzing reports regarding your information systems. This, combined with a SIEM (security information and event management) solution, combines various cybersecurity tools, to enable IT professionals to quickly identify and remediate threats.
Essentially, relying on threat monitoring SOC/SIEM gives practices the added benefit of behavioral analysis on top of the cybersecurity tools in place – meaning breaches cab be detected instantly while ensuring that all critical and high alerts are handled immediately. SOC/SIEM gives practices a new arsenal of cybersecurity capabilities, including forensic analysis, malware reverse engineering and cryptanalysis.
It is also critical that your office relies on 2FA (Second Factor Authentication), which is designed to prevent unauthorized users from gaining access to an account with nothing more than a stolen password. Users may be at greater risk of compromised passwords than they realize, particularly if they use the same password on more than one website. Downloading software and clicking on links in emails can also expose an individual to password theft.
What is entailed is a password or personal identification number (PIN), but then a code is sent to the user’s email or smartphone to verify their identity. A one-step log-in is often not enough to ensure security.
- Use a two-phase back-up system for data
A recent survey found that 89 percent of healthcare organizations are currently using cloud-based health IT infrastructure, including cloud-based apps. That is a smart idea to back up files in the cloud, since it enhances security, operational efficiency and allows medical offices to scale up to support growth and changing business needs.
But an office needs a second backup in the form of a real time local back-up box system. Real-time data backup means that files are saved automatically making a backup copy of every change made to your Box files. It allows the Box admin to restore data (or create a snapshot of your system) to any point in time.
You may not realize it, but if your cloud files are compromised, you may be required to delete all your files. Recovery can take days or even longer, putting patients at risk that are unable to make appointments to see a practitioner. Maintaining a local box file speeds recovery and ensure that all files are saved and can be accessed.
- Supplement your IT staff with an MSP
Your IT staff can usually handle most security threats, but sometimes, the threat—especially ransomware—can overwhelm the capabilities of your IT staff. For example, a smaller, 20-30 staff practice normally can’t afford to hire more than one IT person, so if that person gets sick, takes vacations or is not available after-hours, the practice’s system can shut down for extended periods. That is when you need to have a relationship with a managed service provider (MSP), a company that remotely manages a customer’s IT infrastructure and/or end-user systems, typically on a proactive basis and under a subscription model.
An MSP can also assist in training staff to recognize threats and vulnerabilities to the office’s security system.
