You may not think of telehealth and cybersecurity as being linked, but the very technology you and your patients are relying on to stay connected and healthy is also one of the biggest risks you have for your practice.
What Are the Privacy Risks for Telehealth and Cybersecurity?
The technology you use to connect with your patients include tapping into the internet for applications such as streaming, wireless communication, and video conferencing. The risk of “zoom bombing” is still very real, and data breaches via networks that connect to medical devices are always a threat.
Some other cybersecurity threats in telehealth include access security, storage of PHI, and the security of medical devices themselves.
How Can My Practice Increase Cybersecurity for Telehealth?
There are steps you can take to protect your patient data during telehealth sessions. Many of them are easy to implement and addressing these will help your practice remain HIPAA compliant.
Identity Verification
In the past, verifying patient identity was as easy as asking for a driver’s license and an insurance card. Further verifications would include dates of birth, social security numbers, and physical addresses.
It’s important to remember that, without these in-person verifications, you will need to establish a form of identity verification to be sure the person on the computer screen or phone is who they claim to be. Multi-factor authentication is a valuable step here, and remember it goes both ways: your practitioners should verify their identity to their patient as well.
Encryption is King
Any information that is being transmitted, whether it is a photograph or a monitor, should be encrypted. There are three encryption methods:
- Encryption of data “at rest”: This scrambles all data so if a bad actor gains access to your stored information, it will be useless
- Encryption of data “in transit”: This means that data is scrambled as it is being sent so that if a bad actor intercepts it, it will be useless
- End-to-end encryption: This is the strongest method, and ensures that the unscrambled data can only be accessed by the person sending it and the person receiving it
Device Protections
This is another “two-way street”; even if you have protected your practices’ devices, there is no guarantee that your patients’ devices are. Your best protection is to install comprehensive firewalls or even intrusion detection systems to keep bad actors at bay.
Telehealth and Cybersecurity? Close the Door!
This may be a no-brainer, but a telehealth appointment should be conducted as privately as an in-person appointment. Doors closed, headphones on, no one else in the office…the same common- sense approaches to physical security apply, no matter how the appointment is conducted.
HIPAA and Business Associate Agreement
In other industries, these would be considered third-party vendor management plans. HIPAA further defines what entities must have Business Associate Agreements, and what those agreements will cover. Basically, any service that touches your practice in any way (i.e., supply chain, medical devices, office supplies) must have a Business Associate Agreement with your practice. This will help protect you from a third-party breach of your patient data, although the end responsibility will always belong to the practice itself.
Integris is a HIPAA Compliant IT Services Provider: We Know Telehealth and Cybersecurity
Integris not only understands HIPAA compliance for medical practices, we are also a recognized HIPAA provider of IT Services ourselves.
You have questions about telehealth and cybersecurity concerns, and we have the answers you need. Contact us know for a free, no obligation, short consultation of your cybersecurity strategies to ensure you are protecting your patient data and remaining HIPAA compliant.
Need more information? Download our Healthcare Essentials Kit, full of the information you need to keep your practice running smoothly, securely, and compliantly. This bundle includes valuable eBooks, checklists, HIPAA compliant policy templates, access to exclusive on-demand webinars, and much more.
