How do I secure patient data cheaply in a small doctor's office?

Question

I am a single practitioner with 3 work stations and a server. What is the best cost effective way to secure my data and I suppose encrypt it. The gov't wants us to prevent any unsecure access to patient records. They do not tell us the lengths we have to go to do this and basically leave it up to us. I figure my biggest weakness is someone just stealing my computer and hacking into it. I have the programs double passworded but that is not stopping a hacker. The next level I suspect is encryption but how easy is it to hack. We single practitioners can not afford an IT person like a hospital. I appreciate any feedback. Thanks

Answer 1

If you put your confidential files in a local hard drive disk I suggest you use file encryption software to help you protect these files. As far as I know there are many security programs at your choice, and you can select one of them to lock up all patients' record and stop any illegal access to these files.
Kakasoft Advanced Folder Encryption is a reliable program to prevent all kinds of hack attempts effectively.
Here is the site, so you can get more information about it: http://www.kakasoft.com/advanced-folder-lock/
Hope my answer will do you any help.

Answer 2

It really depends on your legal requirements, but I would suggest following steps as minimum:

• hire professional - that will prove your due care, if needed
• encrypt data at rest, including backups
• encrypt data in transit (i.e. if sending backups to remote site), unless sending already encrypted files.
• Limit number of people authorized to access the data
• Make sure you have audit trail of who and when accessed data
• Implement and display security policy. Even if you work alone, or with small number of staff, this is helpful, and another proof of your due care. "Enable Windows automatic updates. Always have valid anti-virus license. Shut down computer at the end of day. Close all drawers. Keep all desks clean. Use shredder. Report lost laptops and USB sticks".
• Use firewall. The best one, as mention by Andy Smith, is to unplug computers with sensitive data from Internet.

Answer 3

Hospitals (like the one I work at) have used hard drive encryption to prevent against data loss of ePHI for several years now. If a laptop/computer/server/drive/etc is lost but encrypted HIPAA and HITECH consider the data to be secured and therefore not subject to the Interim Breach Rule. To be honest, as an individual provider I will assume you are used a hosted EMR/EHR system (letting me know which one would be helpful). As you correctly pointed out HIPAA and HITECH don't stipulate how you are to encrypt but they do say WHAT you need to encrypt. The short answer is all ePHI and NPI (non-public information) must be encrypted (the long answer is you should be conducting a risk assessment and determining what to encrypt based on the risk associated with the potential loss of that data).

In short, you don't really have to encrypt everything if you find that too much/scary, etc. In my experience with hosted ePHI solutions all of your ePHI and NPI data is already encrypted and not stored locally. That would leave you with only the patient data that you are specifically saving locally on your PC's and server(s). If that data is your employee schedules, don't bother with encrypting. If it is NPI/ePHI then by all means encrypt. For Windows systems BitLocker (included in Windows 7) will allow you to encrypt the files and folders you specify. That in addition to the "double" password protection you mention is more than enough to satisfy a HIPAA auditor, should one come knocking. The key is to ensure that you have proof that your data has been encrypted should you incur a loss of equipment or data. To do so I would recommend a simple series of screenshots showing that you have encrypted your data.

In case it matters as the Information Security Architect for a hospital this is the advice I would give to our independent clinical practicitioners. I could offer some more specifics if I had some more details from you.

Hope this was helpful.

Answer 4

I have experience with Medisoft and Soapware which I have implemented in the same office scenario as yours, except they have 2 servers. What are you using for EHR/EMR ? If you are going to invest money in anything it should be the protection of your patient information and the ability to share that with pharmacies/hospitals/doctors etc. Companies like Soapware offer cloud solutions that can offer you security with your patient data. Since you are just using the client software on your office workstations and the database is sitting on the companies's cloud servers. The other benefit to this is that they cover anything that goes wrong so you would not need inhouse IT support to fix issues for this area.

Answer 5

I'll also mention TrueCrypt, since it's a fairly simple (and free!) solution. Or, if you use Macs, use the built-in 'FileVault.'

Beyond file encryption, you should also look into other areas that could benefit from encryption, or pose a risk to the data: * Email encryption -- Here's a relevant lifehacker article. Your should also look up your email client and provider's policies/features in this regard. * VPNs for any remote workers; something like logmein's hamachi or similar. * Backups, Dropbox, etc.: Review the policies and encryption-features of any backup or file sync programs you use, too.

Finally, be restrictive with file-access/sharing permissions. Deny 'Everybody' from any windows fileshares and, if possible -- I know my users balk at this -- make sure anyone who does have access to that information has a strong password.

That said, a technical solution alone is not enough; make sure your coworkers understand what needs to be protected and /why/. (Something other than 'because the government us tells us to.') This way, they can help identify data that should be secured but has somehow missed your initial review. You might also want to get them to sign some policies, too, just in case: Internet/Email use and the like: After all, encryption is pointless if the attacker knows the key, like a disgruntled or clueless employee who sends confidential/protected data by insecure means.

Have similar discussions with any service-suppliers that might handle the sensitive data. For instance, in order to ensure compliance with a local privacy regulation, we emailed our off-site backup provider asking, "Hey, we need to be XXX-compliant; do you guys do that?"

There are other things that come to mind, but I'm more a sys-admin than a sec-admin right now (thought not for lack of trying!) -- but I don't want to overload you. (Plus, I have to get back to work.)

Answer 6

You could encrypt your hard drive to prevent attacks involving your machine being compromised, but I don't think this is enough to meet basic HIPPA (in the USA) requirements. You also need to provide a way of auditing all access to PHI, and you don't talk about whether or not you do this yet.

Looking into a small EMR might make your life easier in the long run. This solution will not only be more secure (and more likely to meet government healthcare regulation), but also more future-proof. What if you need to send that PHI to another healthcare provider? This would involve a lot of work for you because you'd have to decrypt the data locally, re-encrypt it in a way the participating organization can decrypt it, and send it along. And EMR can simplify that workflow for you.

For those interested in questions like these, the Healthcare Industry SE would be a good resource in the future.

Answer 7

The easiest method would be to just use AES 128 bit full drive encryption + good passwords + pc lock timeouts. This has the added benefit of encrypting all the temp files and recycle bin too so you don't really need a secure file shredder.

One thing you have to remember is to make sure doctors don't take files home with them to work on, this has happened over here in the UK before with NHS and military files and then they had their laptops stolen from their cars.

Answer 8

I think TrueCrypt is the best choice for you. It is an application that is able to encrypt whole drives or file containers. If your critical documents (i.e. patient data) comprises of a directory of files and are "not that large", I suggest a file container. If your data is stored on its own at another hard drive, I suggest encrypting that entire disk.

What you do is simply select the drive that you want encrypted, or create a new file container. A file container will look like any other file, but be as large as you want it to be (it must have room for all your data).

When you have got your container or drive ready, it will ask you for a password. This is where YOU define YOUR degree of security, so choose wisely. Writing down the password could be done if that password is STORED SECURELY, i.e. your customers should not be able to locate them. Anyhow, you will be entering the password for each session you want to access the data. This means that you could either start your computer in the morning, unlock access to the files and leave it open, or you could indeed disable access ("unmount" in the application). Since this doesn't seem like military-grade security requirements, I suggest the first, to make the system as usable as it is today.

Please ask more if I'm being unclear or too technical about anything.

REMEMBER TO BACKUP BEFORE ENCRYPTING

The backup must then of course be deleted - for this, you could look into "secure deletion" programs, such as the Secure Shredder bundled with Spybot Search & Destroy (Advanced mode)

Note that TrueCrypt is free and open source, which is really great. If you can afford it, you should donate some of the money you saved from not going with a paid service. (I am not with TrueCrypt ;))