Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am a single practitioner with 3 work stations and a server. What is the best cost effective way to secure my data and I suppose encrypt it. The gov't wants us to prevent any unsecure access to patient records. They do not tell us the lengths we have to go to do this and basically leave it up to us. I figure my biggest weakness is someone just stealing my computer and hacking into it. I have the programs double passworded but that is not stopping a hacker. The next level I suspect is encryption but how easy is it to hack. We single practitioners can not afford an IT person like a hospital. I appreciate any feedback. Thanks

share|improve this question
This would be a good question for the Healthcare Industry stack exchange proposal. –  Oleksi Oct 11 '12 at 5:17
Depending on which country you're in, you should have a set of information security guidelines to which you must be compliant. HCCA may be of some help if you're in America. Those guidelines are an absolute minimum, and compliance != security, so remember that you become compliant as a by-product of implementing proper security measures. –  Polynomial Oct 11 '12 at 7:35
Unplug your systems from the internet, if you can –  Andy Smith Oct 11 '12 at 8:44
You need to determine what you are required to do. What the government wants you to do, to protect your patient records, is CLEARLY DEFINED. My suggestion would be to avoid your own solution and find a professional service that meets those requirements. You might save some money today but if you lose patient records, you will lose a great deal MORE money, if you implement your own solution. –  Ramhound Oct 11 '12 at 12:50

7 Answers 7

I think TrueCrypt is the best choice for you. It is an application that is able to encrypt whole drives or file containers. If your critical documents (i.e. patient data) comprises of a directory of files and are "not that large", I suggest a file container. If your data is stored on its own at another hard drive, I suggest encrypting that entire disk.

What you do is simply select the drive that you want encrypted, or create a new file container. A file container will look like any other file, but be as large as you want it to be (it must have room for all your data).

When you have got your container or drive ready, it will ask you for a password. This is where YOU define YOUR degree of security, so choose wisely. Writing down the password could be done if that password is STORED SECURELY, i.e. your customers should not be able to locate them. Anyhow, you will be entering the password for each session you want to access the data. This means that you could either start your computer in the morning, unlock access to the files and leave it open, or you could indeed disable access ("unmount" in the application). Since this doesn't seem like military-grade security requirements, I suggest the first, to make the system as usable as it is today.

Please ask more if I'm being unclear or too technical about anything.


The backup must then of course be deleted - for this, you could look into "secure deletion" programs, such as the Secure Shredder bundled with Spybot Search & Destroy (Advanced mode)

Note that TrueCrypt is free and open source, which is really great. If you can afford it, you should donate some of the money you saved from not going with a paid service. (I am not with TrueCrypt ;))

share|improve this answer
It seems to me that your target is to be compliant to the new rules and get it over with. However, in addition to encryption, discussed above, I suggest you keep in mind that any system that is online should be updated, i.e. all applications must be of latest version and an antivirus application in place (Microsoft's Security Essentials is fine.). There's a good application for monitoring your other applications soundness called Secunia PSI: secunia.com/vulnerability_scanning/personal –  Henning Klevjer Oct 11 '12 at 7:07
You have to be careful with these solutions. The backups themselves need to be stored securely as well, because they can reveal the same amount of PHI. Further, if you should ever lose your password, you will be locked out of your patient's data. Without a "break-the-glass" option, you will have effectively lost all your patient's data. An EMR is really the way to go because it provides safeguards for these sorts of problems. –  Oleksi Oct 11 '12 at 15:29

The easiest method would be to just use AES 128 bit full drive encryption + good passwords + pc lock timeouts. This has the added benefit of encrypting all the temp files and recycle bin too so you don't really need a secure file shredder.

One thing you have to remember is to make sure doctors don't take files home with them to work on, this has happened over here in the UK before with NHS and military files and then they had their laptops stolen from their cars.

share|improve this answer

You could encrypt your hard drive to prevent attacks involving your machine being compromised, but I don't think this is enough to meet basic HIPPA (in the USA) requirements. You also need to provide a way of auditing all access to PHI, and you don't talk about whether or not you do this yet.

Looking into a small EMR might make your life easier in the long run. This solution will not only be more secure (and more likely to meet government healthcare regulation), but also more future-proof. What if you need to send that PHI to another healthcare provider? This would involve a lot of work for you because you'd have to decrypt the data locally, re-encrypt it in a way the participating organization can decrypt it, and send it along. And EMR can simplify that workflow for you.

For those interested in questions like these, the Healthcare Industry SE would be a good resource in the future.

share|improve this answer

I'll also mention TrueCrypt, since it's a fairly simple (and free!) solution. Or, if you use Macs, use the built-in 'FileVault.'

Beyond file encryption, you should also look into other areas that could benefit from encryption, or pose a risk to the data: * Email encryption -- Here's a relevant lifehacker article. Your should also look up your email client and provider's policies/features in this regard. * VPNs for any remote workers; something like logmein's hamachi or similar. * Backups, Dropbox, etc.: Review the policies and encryption-features of any backup or file sync programs you use, too.

Finally, be restrictive with file-access/sharing permissions. Deny 'Everybody' from any windows fileshares and, if possible -- I know my users balk at this -- make sure anyone who does have access to that information has a strong password.

That said, a technical solution alone is not enough; make sure your coworkers understand what needs to be protected and /why/. (Something other than 'because the government us tells us to.') This way, they can help identify data that should be secured but has somehow missed your initial review. You might also want to get them to sign some policies, too, just in case: Internet/Email use and the like: After all, encryption is pointless if the attacker knows the key, like a disgruntled or clueless employee who sends confidential/protected data by insecure means.

Have similar discussions with any service-suppliers that might handle the sensitive data. For instance, in order to ensure compliance with a local privacy regulation, we emailed our off-site backup provider asking, "Hey, we need to be XXX-compliant; do you guys do that?"

There are other things that come to mind, but I'm more a sys-admin than a sec-admin right now (thought not for lack of trying!) -- but I don't want to overload you. (Plus, I have to get back to work.)

share|improve this answer
+1 for signed policies and employee awareness of what they must protect and why. A nice EMR and Truecrypt doesn't mean much if your people are leaving unencrypted USB sticks around or emailing things to their Hotmail account. –  hwilbanks Oct 11 '12 at 15:29

I have experience with Medisoft and Soapware which I have implemented in the same office scenario as yours, except they have 2 servers. What are you using for EHR/EMR ? If you are going to invest money in anything it should be the protection of your patient information and the ability to share that with pharmacies/hospitals/doctors etc. Companies like Soapware offer cloud solutions that can offer you security with your patient data. Since you are just using the client software on your office workstations and the database is sitting on the companies's cloud servers. The other benefit to this is that they cover anything that goes wrong so you would not need inhouse IT support to fix issues for this area.

share|improve this answer

Hospitals (like the one I work at) have used hard drive encryption to prevent against data loss of ePHI for several years now. If a laptop/computer/server/drive/etc is lost but encrypted HIPAA and HITECH consider the data to be secured and therefore not subject to the Interim Breach Rule. To be honest, as an individual provider I will assume you are used a hosted EMR/EHR system (letting me know which one would be helpful). As you correctly pointed out HIPAA and HITECH don't stipulate how you are to encrypt but they do say WHAT you need to encrypt. The short answer is all ePHI and NPI (non-public information) must be encrypted (the long answer is you should be conducting a risk assessment and determining what to encrypt based on the risk associated with the potential loss of that data).

In short, you don't really have to encrypt everything if you find that too much/scary, etc. In my experience with hosted ePHI solutions all of your ePHI and NPI data is already encrypted and not stored locally. That would leave you with only the patient data that you are specifically saving locally on your PC's and server(s). If that data is your employee schedules, don't bother with encrypting. If it is NPI/ePHI then by all means encrypt. For Windows systems BitLocker (included in Windows 7) will allow you to encrypt the files and folders you specify. That in addition to the "double" password protection you mention is more than enough to satisfy a HIPAA auditor, should one come knocking. The key is to ensure that you have proof that your data has been encrypted should you incur a loss of equipment or data. To do so I would recommend a simple series of screenshots showing that you have encrypted your data.

In case it matters as the Information Security Architect for a hospital this is the advice I would give to our independent clinical practicitioners. I could offer some more specifics if I had some more details from you.

Hope this was helpful.

share|improve this answer

It really depends on your legal requirements, but I would suggest following steps as minimum:

  • hire professional - that will prove your due care, if needed
  • encrypt data at rest, including backups
  • encrypt data in transit (i.e. if sending backups to remote site), unless sending already encrypted files.
  • Limit number of people authorized to access the data
  • Make sure you have audit trail of who and when accessed data
  • Implement and display security policy. Even if you work alone, or with small number of staff, this is helpful, and another proof of your due care. "Enable Windows automatic updates. Always have valid anti-virus license. Shut down computer at the end of day. Close all drawers. Keep all desks clean. Use shredder. Report lost laptops and USB sticks".
  • Use firewall. The best one, as mention by Andy Smith, is to unplug computers with sensitive data from Internet.
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.