Mobile devices and HIPAA compliance

Posted on Monday November 06, 2017

Mobile devices have revolutionized the healthcare industry: They're convenient and significantly improve work efficiency and patients' satisfaction. Yet they also come with risks. Patient data handled by those devices can be leaked. That's why every healthcare provider needs to be extra careful about data security when using mobile devices.

Why does data security matter so much to healthcare providers?

As a healthcare provider, you're subject to regulations by the Health Insurance Portability and Accountability Act (HIPAA), which governs how medical data is stored, accessed, and transferred. HIPAA's objective is to protect patient privacy.

Under this regulation, you're required to take security measures to ensure your patient data -- including those handled by mobile devices -- are private and secure. If your practice suffers a data breach or fails to comply with HIPAA regulation, you will be subject to heavy fines ranging from $50,000 to $1.5 million.

Some tips to help you stay compliant

It's important to make sure your IT policies and practices adhere to HIPAA standards, and the following is what you have to do:

Risk assessment:

This is required under the HIPAA Security Rule. You must regularly audit your entire IT infrastructure, including the equipment and systems that store, transmit, or handle electronic Protected Health Information (ePHI) as well as your company policies.

Data encryption:

Even though encryption for data “at rest” isn't required by HIPAA (only data “in motion” is governed), encryption is one of the best ways to ensure data privacy and security. It's crucial to protect your patient data on all mobile devices with end-to-end encryptions.

Anti-virus software:

All mobile devices need to have the latest versions of antivirus software installed.

Information Access Controls:

It's recommended that you allow only devices that have security controls to connect to your healthcare data network, and all devices must be scanned before making the connection. For certain data -- especially one that is highly confidential -- you can prevent it from being accessed by certain staff or being downloaded into individual devices.

It's also a good practice to keep your employees' personal and work data separate, so when you eventually have to delete ePHI from their devices, you can do so without wiping out your employees' personal contacts and apps.

In case your employees' devices are lost or stolen, you also need an app that allows you to remotely delete data stored on mobile devices.

No to SMS:

Never pass ePHI and other critical information via Short Message Services (SMS) since SMS networks are not secure. If you need to send short messages, use secure text messaging apps instead.

Employees:

You need to enforce a secure password policy within your workplace, which compels your employees to create and maintain strong passwords. As for applications, since many apps may contain malware or security flaws, you also need to control which apps your employees can download.

What's more, public Wi-Fi networks are highly insecure, which means your employees need to be aware that accessing data via these networks are not safe and, if unavoidable, they must use VPN when accessing the data, and use secure text messaging apps to communicate via public networks to avoid communications being intercepted.

It's also recommended to have regular security awareness training seminars and build a strong, security-focused culture. When an employee resigns, you have to delete ePHI from their devices and terminate their access rights to data immediately.

Healthcare IT security is complex and the stakes of non-compliance are high. This is why it's important to partner with an experienced IT provider who can help protect your data and ensure your practice is cmpliant with HIPAA standards. Contact us today!