News | Cybersecurity | February 10, 2017

Logicalis Healthcare Solutions Focuses on Top Five Cybersecurity Issues for CIOs at HIMSS17

Solution provider examines cybersecurity for patient information

Logicalis Healthcare Solutions lists the top cybersecurity issues for CIOs at HIMSS17.

February 10, 2017 — With the Healthcare Information and Management Systems Society’s annual meeting (HIMSS17) scheduled for Feb. 19-23 in Orlando, Fla., Logicalis Healthcare Solutions outlined five of the top cybersecurity issues currently faced by healthcare chief information officers (CIOs).  

Cybersecurity has become an area of great interest in the health sector and a top priority for healthcare CIOs, according to Logicalis. With over 100 data breaches among healthcare organizations in the past year alone, industry experts estimate the cost for lost records in 2016 was nearly $3 billion.1 While all breaches are not directly related to the electronic health record (EHR) or billing systems, the company said that is where cybercriminals tend to go first to acquire valuable patient data.  As such, there are key aspects of securing patient information within the EHR and across the healthcare network that must be addressed holistically.

“We need to balance ease-of-use and ease-of-access to patient data with the ability to secure this information not just within the health entity itself, but across all member health organizations that support it. Understanding data flow and system connectivity is key,” said Ed Simcox, healthcare practice leader, Logicalis Healthcare Solutions. “As a result, healthcare CIOs must take a holistic, collaborative and consultative approach to security – examining the systems and human interaction of patient information throughout its entire lifecycle.”

“You have to take an architectural approach to healthcare security looking at the whole organization and all data interaction points, not just the sum of its parts,” said Ron Temske, vice president, security solutions, Logicalis US.  “Don’t fall prey to buying disparate best-of-breed solutions which are often deployed in isolation. Without proper integration and sharing of actionable threat intelligence, you won’t have an effective holistic view of your security.”

The five top security issues for healthcare CIOs, according to Logicalis, are:

1. Securing EHR Environments: Today’s top EHR providers – companies like Epic, Meditech and Cerner – offer very clear guidance to hospitals regarding the architecture of their computing environments. These prescriptive guidelines, while created to ensure the functionality of the EHR solution, can also constrain the healthcare CIO from enhancing security to protect the patient information contained within the EHR system. The burning question on many healthcare IT pros’ minds, according to Logicalis, is how to secure an EHR application and its associated data without interfering with or degrading the application itself. To build an effective data perimeter that works in cooperation with these top vendors’ EHR applications, healthcare CIOs may need an experienced solution provider’s help.

2. User Authentication: Think of the sheer number of users that legitimately log on to a hospital’s wireless network daily – patients, family members, visitors, physicians, subcontractors (i.e., visiting surgeons, for example) – extremely high volumes of network traffic to monitor. Which is better – knowing that “Guest 321” has just entered a secure area or that “John Smith” has entered it? Taking the issue of authentication a step further, since hospitals often have computing terminals in every patient room, if a doctor logs into the EHR system to upload patient notes, but forgets to log out, protected health information becomes easily penetrable by cyber adversaries as well as well-meaning patients, their family and guests.  Single-sign-on solutions with scheduled timeouts is an example of an effective tactic to help resolve these concerns.

3. Preservation of Identity: While authentication is critical, so too is the preservation of user identities. With the virtual desktop infrastructure (VDI) hospitals typically use in their EHR environments, user identity can be difficult to capture and audit. Solutions exist, but if the IT professional delivering the EHR implementation is not familiar with possible security protocols that can preserve the identity of users throughout the system, these safeguards will not be enacted.

4. Proliferation of End Points: In a hospital setting, there are a myriad of computing devices in play – desktop and mobile computers, tablets, smartphones – any of which can be used to deliver malware or even ransomware into the host network. The key is to gate access and deploy tighter controls on what users can see, how they are authenticated and what policies are deployed if a device is lost or stolen.

5. Internet of Things: One of the newest challenges for healthcare CIOs is the vulnerability inherent in connecting to Internet of Things (IoT) devices; any piece of medical equipment with a built-in operating system – even if it does not have patient data stored on it – can become a “zombie” used for nefarious purposes by a would-be attacker. This challenge is similar to the EHR security issue in that IoT devices are often too small for a security software agent to be loaded onto the device requiring the healthcare CIO to consider a protective data barrier around the organization’s IoT infrastructure.

Logicalis suggests healthcare CIOs open an internal dialogue, explore questions with colleagues and engage an experienced solution provider who understands the complexities of security and healthcare information technology (IT). Taking a proactive approach to complex issues will ensure healthcare IT leaders ask the right questions and implement effective strategies to avoid costly breaches before they occur, the company said.

For more information: www.us.logicalis.com/healthcareit

1. Modern Healthcare, Jan. 20, 2017; “Vital Signs: How America’s Youth is Key to Fixing the Sad State of Cybersecurity.”

 

Related Healthcare Cybersecurity Content:

Raising the Bar for Medical Device Cyber Security

FDA Seeks Management of Cybersecurity in Medical Devices

Healthcare Industry Lacking in Basic Cybersecurity Awareness Among Staff

Market Report Calls Into Question St. Jude Medical EP Device Safety, Cybersecurity

FDA Harshly Criticizes Abbott, St. Jude For Failure to Address EP Device Safety

Healthcare 2015 Data Breaches - Why the Cloud Is Not Responsible

HIMSS: Two-Thirds of Healthcare Organizations Experienced a Recent, Significant Security Incident

How You Should – and Should Not – Be Sharing Medical Information With Patients

How Can Doctors Practice Better Security?

U.S. Department of Health and Human Services, Office for Civil Rights, Breach Portal: Notice to the Secretary of HHS Breach of Unsecured Protected Health Information

Related Content

New Siemens Healthineers Dashboard Application Provides Insights into Cardiology Operations
Technology | Analytics Software| December 11, 2017
Siemens Healthineers has launched teamplay Cardio, a new cardiology dashboard application within the Siemens...
Fujifilm Introduces Artificial Intelligence Initiative for U.S. Market at RSNA 2017
News | Artificial Intelligence| December 04, 2017
Fujifilm Medical Systems U.S.A. Inc. announced the expansion of the company's artificial intelligence (AI) development...
Vital Unveils Newest Vitrea Advanced Visualization Release at RSNA 2017
Technology | Advanced Visualization| December 04, 2017
December 4, 2017 — Vital Images unveiled the newest version of Vitrea...
News | Cardiac PACS| November 22, 2017
Lumedx Corp. will present the latest in cardiovascular (CV) imaging, data management and next-generation analytics...
Siemens Healthineers Introduces Share360 Tailored Service Portfolio
News | Cardiac Imaging| November 10, 2017
To address the specific needs of medical imaging clinical engineering departments nationwide, Siemens Healthineers has...
TeraRecon Introduces 175-Plus New Features in iNtuition 4.4.13
Technology | Advanced Visualization| November 06, 2017
November 6, 2017 — TeraRecton announced the launch of version 4.4.13 of its iNtuition...
Philips IntelliSpace cardiovascular information system (CVIS)

The Philips IntelliSpace is an example of the newer generation of cardiovascular information systems (CVIS) that can consolidate all cardiology department data sources into one location.

Feature | Cardiac PACS| October 04, 2017 | Dave Fornell
Consolidation of data in one location to improve efficiency and enable data analytics, as well as smooth integration
Medical Metrics Taps Digisonics Cardiovascular Information Systems for Clinical Trials
News | Cardiac PACS| October 03, 2017
October 3, 2017 – Medical Metrics, an experienced core laboratory for multi-center clinical trials, has implemented t
ScImage and Invia Partnership Announced
News | Cardiac PACS| September 19, 2017
ScImage Inc. and Invia Imaging Solutions recently announced formation of a joint partnership at the American Society of...
Abbott. St. Jude Medical has updated its firmware to address cybersecurity issues with its Allure Quadra MP and other EP devices

Abbott. St. Jude Medical has updated its firmware to address cybersecurity issues with its Allure Quadra MP and other EP devices.

Feature | EP Lab| August 29, 2017 | Dave Fornell
August 29, 2017 — The U.S.
Overlay Init