When converting from paper to electronic health record (EHR) systems, community clinics have opened themselves up to a new risk — the potential exposure of sensitive patient data. While the EHR can provide increased efficiencies, improved access to patient information, and help community clinics comply with legal requirements; they also bring a number of vulnerabilities. The Anchorage Neighborhood Health Center Data Breach, for instance, shows how fast patient data can be compromised during the EHR transition.
With paper records, an individual's information was secured passively. Paper records required physical access and locked cabinets, and thus, to gain access to the information, an individual had to physically break into a facility. With digital records, a medical organisation has an electronic record that can be accessed by anyone with a user account and password over a network whether at their facility or elsewhere.
Unfortunately, the convenience associated with accessing medical records electronically opens up new vulnerabilities to organisations as well as to the individuals they serve. For example, using a weak password may provide an opportunity for an attacker to access the organisation's medical records, and if an organisation has not taken the proper steps to secure its electronic record system by using encrypted email transmission or configuring access permissions correctly, then the EHR systems may be susceptible to compromise. Additionally, many community clinics do not have the resources available to provide the required IT security expertise necessary to adequately protect their EHR systems.
There are also certain circumstances related to the conversion from paper to electronic formats that have been overlooked, such as hidden metadata on a scanned document, outdated personal identification and sensitive identifiers, and this could create an opportunity for a breach of a patient's medical record if the document is not properly secured on a digital platform. It is therefore imperative for community clinics to use policies and procedures designed to protect the confidentiality and integrity of EHR technology.
The connectivity of EHR systems is one of their primary benefits; however, it also increases the risk of an EHR system being compromised because of the multiple points of access EHR systems create (e.g. Remote Provider Access, Cloud Storage Solutions, and Interoperability with pharmacies and labs). In other words, EHR Connectivity presents many opportunities for capturing and compromising patient data as well as establishing an expanding attack surface to access patient data. Within minutes, a single compromised workstation or poorly secured cloud folder can place potentially thousands of patient records at risk! Digital Breaches, unlike paper breaches, propagate faster and are more likely to result in longer-term consequences (e.g. Identity Theft and Fraudulent Insurance Claims).
Detecting breaches in community clinics can take a long time. Irregular log ins, unusual system behaviour or minor misconfigurations may not raise alarms for weeks or even months. Unfortunately, by the time the breach is discovered, patient data may reflect an unauthorised network that makes compliance more challenging.
Improving the cybersecurity of the EHR in community clinics needs to be a priority. Community clinics can improve EHR security through the implementation of access control policies, multi-factor authentication protocols and encryption practices. It is also essential that community clinic staff receive appropriate education concerning digital hygiene and secured methods for handling patient data. Routine audits of digitised records may reveal vulnerabilities that must be addressed, and partnering with experienced cybersecurity vendors will also allow community clinics to be compliant with healthcare regulations.
Modernizing Healthcare: The Digital Revolution of Patient Data
As the Anchorage Neighborhood Health Center (ANHC) data breach shows, moving away from a paper-based record-keeping system involves more than just implementing new technology; it comes with inherent risks to your clinic's data security. Therefore, clinics must take the initiative to manage these risks while ensuring that they can still utilize the efficiency and productivity benefits of having their electronic medical record (EMR) systems in place securely. Cybersecurity training for staff, vigilance against cyber threats, and an organizational culture that recognizes the importance of protecting patient data will help healthcare providers to remain safe in a more technologically advanced healthcare system.
