HIPAA and Network Security

If your practices’ network is hacked, could you say you took all reasonable precautions to prevent it?

Because according to HIPAA, if a reasonable precaution wasn’t taken, you could face a fine due to a HIPAA violation.

If you’re running low on time, here’s the quick answer to the question that probably brought you here: there’s no such thing as a HIPAA compliant network, just like there isn’t a HIPAA compliant copier. In short, it’s not what you have, it’s how you use it.

So, if a network itself can’t be HIPAA compliant, how do you ensure HIPAA Compliance on your network?

SET PERMISSIONS

If you worked at Fort Knox, but everyone had access to the gold bars, would it be Fort Knox? Probably not. The same goes for a network — if everyone had admin level access, it wouldn’t be very secure.

HIPAA regulations are certain policies that dictate who can access certain pieces of information, and once they gain access to that information, what they can do with it. 

HIPAA doesn’t dictate how you assign permissions, or what levels of security enforce those permissions — just simply that EPHI (Electronic Protected Health Information) is only viewed by people who have permission to do so.

GET HIPAA CERTIFIED

Your network can’t get HIPAA certified, but you can. Interestingly enough, you don’t need to be HIPAA certified to legally run a network in a practice or hospital or facility that works in medicine, but it does help.

While HIPAA certification does come with price tag (depending on the class you take, the price will vary), it’s easier to become HIPAA certified than you may think. HIPAA certificates are usually obtainable after about ten hours of classes, which precede a test that is taken online (some classes are only in person).

Be aware that there are different levels of HIPAA certification, each specializing in different aspects of an organization: HR, IT, Administration, and MDs themselves all have different HIPAA certifications.

GET ADVICE FROM SECURITY EXPERTS

The truth is, there’s no difference between a secured network, and a network that works within HIPAA guidelines.

Due to the danger every business — no matter what they sell, where they’re located, or what size they are — faces from cybercriminals, the truth remains the same: an unsecured network is bad for business.

Just like HIPAA has rules about what actions a medical provider must take if they experience a data breach due to intrusion, businesses must notify customers and employees if their company data is stolen by a cybercriminal.

And, just like organizations regulated by HIPAA, if businesses fail to disclose a breach in a certain period of time, they face fines that grow with the severity of the situation.

THE DANGERS YOUR EMPLOYEES FACE

The most important step you can take to ensure your network is secure is to train your employees on the dangers they face every time they interact with a device.

The number one danger organizations face today is ransomware. Ransomware is essentially a virus that encrypts your files with a key only accessible to the hacker or hackers responsible. Then, after locking you out of your entire network, the hackers will demand you pay an exorbitant fee to gain access again, usually by paying with Bitcoin or another blockchain-based cryptocurrency.

While ransomware is the most dangerous threat to organizations, phishing emails are the most common method of delivering ransomware. Phishing emails are designed to look like they are from a reliable sender, with a subject line that implies urgency, importance, and a task that needs to be completed now.

By tricking employees into rushing into action without a moment of consideration, phishing emails are an easy way for hackers to find backdoor access into your network.

In fact, most breaches are due to employee error or negligence. That’s why it is incredibly important to train your employees on how to spot phishing emails, and other forms of intrusion hackers use.

A firewall can be the most advanced and secure, state-of-the-art technology, but if an employee hands a cybercriminal the keys to the network, that firewall is incapable of stopping them.

This is why all businesses should make use of security awareness training.

YOUR NETWORK ISN’T HIPAA COMPLIANT — YOU ARE

It would be nice if technology could regulate itself to ensure HIPAA Compliance. However, until computers start thinking for themselves, this won’t be the case.

Creating a framework to ensure HIPPA compliance is a difficult task, however. If you’re stuck trying to figure out how to make sure you’re following HIPAA regulations, contact a managed service provider. 

Or, use the button below to schedule a call with one of our network security experts.