With the increased use of technologies in healthcare, the issue of security has become vital. In the healthcare setting, security refers to procedures intended to prevent unauthorized access to protected health information (PHI) (Moore & Frye, 2019). Security in healthcare is regulated by the HIPAA, which establishes national standards for dealing with PHI (Office for Civil Rights, 2020). This paper will outline a security plan for a medium-sized facility, which will help the organization comply with HIPAA rules.
The first part of the plan involves physical and administrative safeguards. Access to the facility should be authorized and monitored; moreover, it should be terminated for individuals that have ceased to work for the organization. Employee training should be implemented to educate workers on their access rights and duties when dealing with PHI, as well as sanctions for those violating security policies (Moore & Frye, 2019). Employees should also be informed of other critical security measures, such as password updates and computer log-in monitoring. The organization should assign individuals responsible for emergencies and instruct employees on how to respond to crises to ensure effective disaster recovery. When archiving, retrieving, and storing health information, the organization should ensure that the data does not reach unauthorized individuals. To do so, the organization should use encryption and avoid utilizing public email services, such as Gmail (Moore & Frye, 2019). When PHI is no longer needed, the organization should destroy it correctly, for example, by shredding or incinerating, to make the information unreadable.
The second part of the security plan is access safeguards. Employees should use strong passwords that do not include words from the dictionary or personal information but contain numbers, special characters, and lowercase and uppercase letters. Overall, the organization should develop policies that would regulate the creation, changing, and safeguarding of passwords (Office for Civil Rights, 2018). Such policies should also outline the course of action in situations when an employee’s password has been compromised (Office for Civil Rights, 2018). Furthermore, the organization should develop procedures for authentication, which would help it ensure that the person seeking access to healthcare information is the one whom he or she claims to be.
The third part of the security plan is network safeguards. The organization should use encryption of the messages containing PHI; these messages are decrypted when the authorized user enters the password. The facility may use a third-party encryption program when sending PHI via email, which is a common practice providing greater protection than passwords alone (Moore & Frye, 2019). Cloud computing can be used for information transfer; for example, there are HIPAA-compliant servers used for sending emails. However, they do not control the transmission of emails from the server to the recipient, which is why the facility may choose not to use emails altogether (Moore & Frye, 2019). When using mobile devices to deliver healthcare, workers should employ user authentication, install encryption tools and a firewall, and regularly update their security applications. Moreover, they should install remote disabling applications that will allow them to erase data remotely from the mobile device if it is lost.
The strengths of this plan are that it outlines measures that the facility should take to ensure the physical and technological security of PHI. The plan provides the basis for organizational policy development directed at preventing unauthorized access to healthcare data. One weakness of the plan is that it only briefly tackles the problem of emergencies in data security. In fact, the organization should develop policies on how to respond to such emergencies as cyber attacks and how to provide access to the necessary healthcare information during such situations. Another weakness is that it does not tackle an issue of integrity, which deals with preventing improper modification or disposal of healthcare information.
References
Moore, W., & Frye, S. (2019). Review of HIPAA, part 1: History, protected health information, and privacy and security rules. Journal of Nuclear Medicine Technology, 47(4), 269-272.
Office for Civil Rights. (2018). Audit protocol – Updated July 2018. US Department of Health and Human Services. Web.
Office for Civil Rights. (2020). HIPAA privacy, security, and breach notification audit program. US Department of Health and Human Services. Web.