Overview of the healthcare and security systems
Information security as well as well as privacy in the health sector is an issue whose prominence has been swelling day by day. Healthcare sectors have been called to adopt information technology systems to aid in speeding activities and securing records. Efforts to adopt information technology in healthcare have been practiced for a long time. Several developments point to the need for better security systems in healthcare.
These developments include the use of patient records that are digitalized, the consolidation of healthcare providers and the rise in healthcare regulation. Also, there has been an increasing need for the exchange of healthcare information between healthcare providers, patients and healthcare institutions. All these developments are strongly bonded on security thus making security a paramount issue in healthcare (Symantec, 2009).
Information systems are seen as the available and efficient options of improving the quality of services and security of information transfer and exchange in the healthcare sector. Many countries, including the United States, have created strategies to adopt automated systems in healthcare. Therefore, a lot of research has been done about how best information systems can be incorporated to improve information exchange and security (Appari & Johnson, 2010).
The requirements of HIPAA for network security to maintain confidentiality of patient records
Patient information is extremely valuable in healthcare. This information has become increasingly vital not only to the doctors but also to other healthcare givers providers like health insurance firms. The confidentiality of this information in the US was boosted through the formulation of a law in 1996.
This piece of legislation is referred to as the Health Insurance Portability and Accountability Act. This piece of legislation was formulated by the federal government hence it is applicable in all states. It regulates the security as well as privacy of health information. The key areas emphasized in this legislation are the maintenance of confidentiality, the protection of patient information and the respect of the rights to privacy of the patients (Keir & Keir, 2008).
HIPAA contains regulations on communication mediums to be used in medical institutions. These rules require staffs in the healthcare institutions to know privacy and security rules of the electronic media tools used. Under this piece of legislation, the securing of office computers must be a priority in healthcare institutions. Appropriate information technology safeguards must be acquired by the institutions.
They include virus protections, firewalls and antispyware which help in locking out cyber hackers. They also prevent virus attack on the downloaded information and even people with ill motives who may want to intercept in the exchange of information. The presence of the secured network systems provides the medical staffs with the green light of using their emails for sending and receiving of patient information (Keir & Keir, 2008).
The other regulation measurers in HIPAA are that emails must contain email notices. Email notices must be embedded on patient information. These caution users about sending messages to unintended people. It also helps senders in identifying messages that are sent to un-intended recipients. Other security measures include the encryption of the emails containing the information of patients. Subject lines in the emails have to be generic and not specific. Patient information is not to be included in the subject line of the emails (Keir & Keir, 2008).
HIPAA also contains auditing requirements for healthcare institutions. Healthcare organizations must enhance their capacity to control the people who access patient records. The code of control of access to patient records is contained in the American Academy of Family Physicians.
A system network is used in discharging this function. Such a system must have the ability to assign usernames and passwords that are unique and in accordance to the people who are allowed to access the accounts. The users are saved according to the access levels. Different user levels are assigned to different users. The security level limits the access of a person to a person. The legislation allows health organizations to develop their own system networks according to the way their activities are structured (Lindh, 2010).
Technical Risk Assessment of the healthcare security networks
Risks are inherent in security network systems. Therefore, risk management systems have to be put in place in order to help reduce the risks that can be posed in the implementation of security systems. The following risk reduction steps can be followed to ensure effective implementation of security systems (NEMA/COCIR/JIRA Security and Privacy Committee, 2007).
- The first step entails the listing of all the assets to be used in establishing health security systems. Each of the items in the security system has to define in terms of its uses.
- The second step entails the collections of the entire security-related requirement for the assets to be used in setting us the security system for the company. Most of the assets have various security specifications which must be availed for the proper working of the security system.
- The third step involves the identifying and elaborating on the threats and applying these threats to the system to determine the vulnerabilities of the system. Threat paths are easily identified.
- The probable risks are then scored.
- Mitigations measurers are then proposed for the inherent vulnerabilities in the healthcare security system.
Lastly, the residual risks are summarized and the details of coming up with details of coming up the
Compliance with state laws concerning privacy of patient records
The protection of health information is guarded by the federal government through the federal law. The federal government through the federal law defines how the information on patients should be protected by the actors in the healthcare sector. The federal law is affected or enforced in different states.
The states are the enforcers of the laws that are set by the federal government. The states set their own standards as well as sub-legislations to help them in enforcing the laws that are set by the federal government. The state laws may differ from the federal laws. However, the state laws are proactive.
When state privacy legislations promise to be more protective of patient information, then they are preferred over the state laws. Healthcare networks in such cases are implemented basing on the most proactive legislation. States pose detailed and private patient records which are the reason as to why they are better placed in enforcing the healthcare security network (NEMA/COCIR/JIRA Security and Privacy Committee, 2007).
Compliance with Meaningful Use requirements for managing IT security
For healthcare security systems have to be efficient and meaningful to the healthcare institutions, they must be implemented systematically. They must be coherent with information technology standards as per the standardizations of the International Standards Organization. Standardization of the systems is a crucial issue which will help in bringing about well-coordinated use of healthcare IT security networks.
The first consideration is the identification of IT security system which meets the industry standards. All the organizations in the healthcare sector must then be notified of It standards of the IT systems which will be required. The organizations must also be made to understand the regulations and how they can keep to the required stands.
This will help these organizations to equip themselves with the standard or right healthcare Information Technology tools to be used in implementing healthcare networks. The healthcare sector must also find proficient IT dealers to help them in the management of the Healthcare information security systems (NEMA/COCIR/JIRA Security and Privacy Committee, 2007).
Policy and procedures required to manage ongoing security principals and provided security guidance to staff
As mentioned earlier, there is a strong need to have the staffs in the healthcare sector informed of the policies that govern the use of healthcare security networks. This is because most of the staffs in this sector are not experts in information technology. Therefore, they must be guided on how to attain the best results out of the use of healthcare security networks (Cooper, 2007).
Therefore, three main key issues are addressed as it concerns to the adherence of the healthcare security principals by the healthcare staffs. The first thing that is addressed is the training of the staffs on the importance and the use of the security tools. The training on how to share patient information on a security networks then follows.
The staffs are made to understand all the regulations on information sharing and exchange including the risks that might be posed and remedies to these risks. The HIPAA clearly stipulates the guidelines on effective use of healthcare security networks (Cooper, 2007).
References
Appari, A & Johnson, M. E. (2010) “Information security and privacy in healthcare: current state of research”. International Journal of Internet and Enterprise Management, 6(4):pp. 279-314.
Cooper, T. (2007). Managing Information Privacy & Security in Healthcare Privacy and Security Principles. Web.
Keir, L., & Keir, L. (2008). Medical assisting: Administrative and clinical competencies. Clifton Park, NY: Thomson Delmar Learning.
Lindh, W. Q. (2010). Delmar’s comprehensive medical assisting: Administrative and clinical competencies. Clifton Park, NY: Delmar Cengage Learning.
NEMA/COCIR/JIRA Security and Privacy Committee. (2007). Information Security Risk Management for Healthcare Systems. Web.
Symantec. (2009). Security and Privacy for Healthcare Providers. White Paper: Best Practices Series for Healthcare. Web.