[ad_1]
– NIST and the National Cybersecurity Center of Excellence (NCCoE) have released a guide on how providers can improve healthcare mobile device security to better protect PHI.
The guidance, Securing Electronic Records on Mobile Devices, provides IT professionals and security engineers with a security architecture that they can copy or recreate.
“Healthcare providers increasingly use mobile devices to store, process, and transmit patient information. When health information is stolen, inappropriately made public, or altered, healthcare organizations can face penalties and lose consumer trust, and patient care and safety may be compromised,” the guide explained.
Mobile device security is a top concern of healthcare providers when it comes to their mobile programs, according to a recent survey of 600 healthcare IT decision makers conducted by Vanson Bourne on behalf of mobile device management provider Jamf.
Despite their concern, a full 90 percent of respondents said their institution is implementing or planning to implement a mobile initiative. And nearly half plan to increase mobile device usage within the next two years.
The guide shows how healthcare providers, using open-source and commercially available tools and technologies, can more securely share patient information among caregivers who are using mobile devices.
Specifically, the guide’s security architecture provides a number of benefits to healthcare organizations:
- Defends PHI and the systems that facilitate its use without getting in the way of delivering quality care
- Offers a straightforward, in-depth approach to securing EHR on mobile devices
- Takes into account the need for different types of implementation for different circumstances
- Enables organizations to build on existing infrastructure and incorporate commercially available technologies
The security architecture maps to standards and best practices from NIST, including the NIST Cybersecurity Framework, and to the HIPAA Privacy and Security Rules.
The guide was developed by industry and academic cybersecurity experts, with the input of healthcare providers who first identified the challenge. The center then invited technology providers with relevant commercial products to partner with NIST through cooperative research and development agreements and collected public feedback along the way.
The team at the NCCoE built a virtual environment that simulates interaction among mobile devices and an EHR system supported by the IT infrastructure of a medical organization. NCCoE was founded in 2012 by NIST, the state of Maryland, and Montgomery County, Maryland.
The high-level abstract security architecture involves a four-step information transfer process: 1) a physician uses a mobile device application to send a referral to another physician, 2) the application sends the referral to a server running a certified EHR application, 3) the server routes the referral to the referred physician, and 4) the referred physician uses a mobile device to receive the referral.
The architecture uses commercially available tools. When there were no commercial products to address specific needs, NIST and NCCoE researchers used open-source products. Commercial and open-source standards-based products are available and interoperable with commonly used IT infrastructure and investments. The architecture has a modular design, allowing organizations to adopt as much or as little of the reference design as suits their needs.
“All healthcare organizations need to fully understand their potential cybersecurity risks, the bottom-line implications of those vulnerabilities, and the lengths that attackers will go to exploit vulnerabilities,” the guide observed.
“Assessing risks and making decisions about how to mitigate them should be continuous to account for the dynamic nature of business processes and technologies, the threat landscape, and the data itself. The guide describes [the NIST] approach to risk assessment. We recommend that organizations implement a continuous risk management process as a starting point for adopting this or other approaches that will increase the security of EHRs. It is important for management to perform regular periodic risk review, as determined by the needs of the business,” the guide concluded.
[ad_2]
Source link Google News
