When it comes to preventing IT security breaches in the healthcare industry a little bit of diligence goes a long way. In an annual report to Congress covering breaches of unsecured PHI in 2011-2012, the Department of Health and Human Services established that most breaches could have been prevented with basic security protocols. The vast majority of breaches fall into one of three categories: theft, loss, or unauthorized access/disclosure. In...

The biggest cybersecurity threat facing healthcare organizations is a startling lack of proper security controls. Currently the areas of greatest vulnerability are medical devices, VPN applications, and other access points. Medical devices have been receiving increased attention from hackers and can pose a significant threat to hospitals and their patients PHI. The greatest risk that VPN technologies present is that once credentials are...

Phishing is one of the oldest scams in the hacker playbook. Sending fraudulent emails in an effort to obtain usernames, passwords and other sensitive information can be an extremely effective scam. It’s also one of the easiest to prevent through training and awareness. Recently ITPAC ran a phishing test for a local bank. 67.5% of the bank employees tested failed the test. 52.5% of bank employees gave up their username/password. 15% of the...

Is a third-party hosting your EHR or storing your medical records? Everyday, more and more healthcare providers are outsourcing or looking to outsource their electronic record storage and maintenance to third party technology companies. This is not in and of itself a problem, however, it’s important that all healthcare providers are mindful that any third party vendor that stores, creates transmits or maintains protected health information must...

Not staying up to date with your security responsibilities can have a huge impact on your practice. Not just in monetary punishments but in the lost trust of your patients and their families. Idaho State University recently agreed to pay $400,000 to the HHS Office for Civil Rights to settle allegations of HIPAA privacy and security rule violations. ISU had not conducted a HIPAA security risk analysis for more than five years, even after they...