Hacking, phishing, cybercrime… sophisticated methods for data breaches get a lot of attention in the news. But most of the time security issues are caused by simple human error- we leave laptops unattended or we use the word ‘password’ as our password. Yes, that really does happen. In fact, it’s the second most common password under 12345 (clearly passwords are not based on creativity).
According to Health and Human Services, the number one threat to medical data lies in most people’s homes and offices: laptop computers. Laptop theft is the most prevalent cause of health data breaches, with 189 breaches each affecting more than 500 people. Laptops account for 24 percent of data breaches, paper records at 22 percent, desktop computers at 16 percent and mobile devices at 14 percent.
I sat down with fellow EHR Blogger and Family Practitioner, Dr. Bob Rowley, who gave me this top three tips on how to keep your patient’s and office data secure.
1.Use a system that doesn’t store protected health information (PHI):
“Make sure that any PHI (patient health information) that’s uploaded to your EHR is deleted off of your computer and shredded. The benefit of using Practice Fusion is that there is no need to store anything information locally.”
Why store locally, when you are only increasing your risk for data breaches? Make sure that former employees’ log-ins are inactivated so they cannot access the program. Setting permission levels can help ensure that everyone has “need-to-know” access to sensitive data.
2. Know your encryption: “If you use an EHR system with PHI locally stored on a machine, use a program that encrypts the file and is password-protected.”
Here at Practice Fusion, our web-based model means nothing is stored locally on your machine. And we have to strict password rules for including a mix of numbers and letters to help ensure you’re keeping your account safe.
3. Store it in the cloud: “With web systems that meet the government’s privacy and security standards and certification (aka Practice Fusion), the risk for data intrusion is much less, there is no need to back up information when the security is handled by the vendor at levels a provider wouldn’t afford to do on their own”.
As Dr. Rowley brilliantly stated, “Physicians are the custodians of other people’s information and they have to protect that.”
What is your favorite tip for keeping medical data safe in your practice? Share your advice in the comments sections below.
-Shea Steinberg
Jr. Social Media Specialist
Practice Fusion EHRs
