Você está na página 1de 7

34%03



4/
()0!!
3%#52)49
#/-0,)!.#%
0ROTECTINGYOURPATIENTSHEALTH
INFORMATIONISMOREDIFlCULT
ANDMOREIMPORTANTTHANEVER
4HEAUTHORSSTRATEGYWILLHELP
YOUMEETTHISMONTHSDEADLINE

$AVID#+IBBE -$ -"!

4HElNALRULEADOPTING()0!!STANDARDSFORTHESECURITYOFELECTRONICHEALTHINFORMATIONWASPUBLISHEDINTHE&EDER
AL2EGISTERON&EB ;ANDGOESINTOEFFECT!PRIL =4HISlNALRULESPECIlESASERIESOFADMINISTRATIVE
TECHNICALANDPHYSICALSECURITYPROCEDURESFORCOVEREDENTITIESTOUSETOASSURETHECONlDENTIALITYOFELECTRONICPROTECTED
HEALTHINFORMATION4HESTANDARDSAREDELINEATEDINTOEITHERREQUIREDORADDRESSABLEIMPLEMENTATIONSPECIlCATIONS
n3TATEMENTONTHE#ENTERSFOR-EDICARE-EDICAID3ERVICES7EBSITE
REGARDINGTHE(EALTH)NSURANCE0ORTABILITYAND!CCOUNTABILITY!CT 

!
SFAMILYPHYSICIAN$AN"REWER -$ ONCEWROTE ANDTHECOSTSORHASSLESASSOCIATEDWITHINADEQUATE
ONANE MAILDISCUSSIONLIST h)BELIEVE)WOULD PROTECTIONTHANYOUREALIZE
RATHEREATLIVECOCKROACHESTHANLEARNABOUT #ONSIDERTHESEEXAMPLES
()0!!SECURITYv.OTHING ITSEEMS COULD s(AVEYOUEVERBEENTHEVICTIMOFACOMPUTERVIRUS
BEMOREBORINGANDLESSRELATEDTOTHEPRACTICEOFFAMILY ORDOYOUKNOWSOMEONEWHOHAS
MEDICINETHANCOMPUTERSECURITY s!REYOUCONCERNEDABOUTWHATWOULDHAPPENIF
"UTDONTBEFOOLEDINTOCOMPLACENCY9OUANDYOUR THECOMPUTERHARDDISKSTORINGYOURPATIENTSMEDICAL
) , , 5 3 4 2 !4 ) / . " 9* / ( . 5 % , ! . $

PATIENTSAREPROBABLYMOREFAMILIARWITHSECURITYRISKS INFORMATIONFAILED

$R+IBBEISDIRECTOROFTHE!!&0S#ENTERFOR(EALTH)NFORMATION4ECHNOLOGY#(I4 (ETHANKS3TEVEN%7ALDREN -$ #(I4SASSISTANTDIRECTOR FORHIS


ASSISTANCEONTHISARTICLE#ONmICTSOFINTERESTNONEREPORTED

!PRILNWWWAAFPORG FPMN& ! - ) , 9 0 2 ! # 4 ) # % - ! . ! ' % - % . 4 N  


$OWNLOADEDFROMTHE&AMILY0RACTICE-ANAGEMENT7EBSITEATWWWAAFPORGFPM#OPYRIGHT¥ 2005!MERICAN!CADEMYOF
&AMILY0HYSICIANS&ORTHEPRIVATE NONCOMMERCIALUSEOFONEINDIVIDUALUSEROFTHE7EBSITE!LLOTHERRIGHTSRESERVED
30%%$"!2š s$OYOUWORRYTHATSOMEONEMIGHTEAVES +%90/).43
DROPONYOURWIRELESSCOMMUNICATIONS
s7EREYOUCONCERNEDWHENAMAJORPHAR s0RACTICESWILLNEEDTOENSURETHATTHEIRCURRENT
°° MACEUTICALCOMPANYUNINTENTIONALLYDISTRIBUT COMPUTERSECURITYCOMPLIESWITHTHE()0!!
EDTHEE MAILADDRESSESOFHUNDREDSOFPATIENTS
9OUAREPROBABLYMORE STANDARDSTHATTAKEEFFECT!PRIL
TAKINGANANTIDEPRESSANTMEDICATION
FAMILIARWITHSECURITY s0HYSICIANSSHOULDTAKERESPONSIBILITYFORUNDER
)NADDITIONTOHELPINGRAISEYOURAWARE
RISKSTHANYOUTHINK STANDINGHOWHEALTHINFORMATIONTECHNOLOGYIS
NESSOFWHATSATSTAKE THISARTICLEWILLMAKE
USEDINTHEIRPRACTICE
COMPUTERSECURITYMOREUNDERSTANDABLEAND
RELEVANTTOYOURPRACTICE ANDPUTYOUON s"YTAKINGAPROACTIVEAPPROACHTOYOURCOMPUTER
THEPATHTOWARDCOMPLYINGWITHTHE()0!! SECURITYNOW YOUWILLBEABLETODETECTAND
°° SECURITYSTANDARDS PREVENTTROUBLELATER
!FTERREADINGTHROUGHTHESESTEPS
4OLEARNWHETHERYOUR s4HEREISNOONE SIZE lTS ALLAPPROACHFOR
YOUSHOULDBEABLETOCOMPAREYOUROFlCES
COMPUTERSECURITY COMPUTERSECURITY
CURRENTCOMPUTERSECURITY ORLACKTHEREOF
MEETS()0!!REQUIRE
WITHTHATREQUIREDBY()0!!4HISTYPEOF
MENT YOUSHOULDPER
COMPARISONISKNOWNASAhGAPANALYSISvAND WAREANDNETWORKSTOEXCHANGEDIGITIZED
FORMAhGAPANALYSISv
ISANIMPORTANTCOMPONENTOFMEETINGTHE DATACREATESNEWVULNERABILITIES)TALSO
OFYOURCURRENTSETUP
()0!!REQUIREMENTS REVEALSNEWDIMENSIONSTOOLDRISKS-UCH
!LSOBEAWARETHAT()0!!SECURITYCOM OFTHEPROBLEMWITHCOMPUTERSECURITYISOF
PLIANCEISLIKEACLINICALENCOUNTER)FITSNOT OUROWNMAKING THERESULTOFOURLOVEOF
DOCUMENTED THENITDIDNTHAPPEN4HERE CONVENIENCEANDOURDRIVETOBEMOREEFl
°° FORE DOCUMENTEVERYTHINGANDMAKEITPART CIENT#OMPUTERSAUTOMATEROUTINE MUN
OFASECURITYMANUAL DANETASKS"YSTORINGCOMPACTED BITE SIZED
!SYOUMOVETOWARD
INFORMATIONINSIDEMACHINES WEAREABLETO
()0!!COMPLIANCE
ITISIMPORTANTTO
 5NDERSTANDWHYCOMPUTERSECURITY COLLECTDATAMOREEASILYANDCUTDOWNON
ISIMPORTANT)FYOUNEEDASIMPLEANSWER STORAGECOSTS
DOCUMENTTHEENTIRE
TOTHEQUESTION h7HYISCOMPUTERSECURITY "UTCOMPUTERSTORAGEDEVICESCANBE
PROCESS
NECESSARYANDIMPORTANTvTHEANSWERIS BROKENORDAMAGED ANDTHEINFORMATION
hBECAUSEEVERYONECARESABOUTTHEPRIVACY INTHEMCANBEERASEDORCORRUPTED EXPOS
ANDINTEGRITYOFTHEIRHEALTHINFORMATIONv INGTHEDATATOUNEXPECTEDCHANGEORLOSS
)NMOSTCASES THEPOINTOFCOMPUTERSECURI )TISPOSSIBLETOSTEALTHOUSANDSOFMEDICAL
°° TYISTOPREVENTPERSONALHEALTHINFORMATION RECORDSBYDOWNLOADINGTHEMONTOASMALL
FROMFALLINGINTOTHEWRONGHANDSORBEING STORAGEDEVICE WHICHCANEASILYBEHIDDEN
4HEGOALOFCOMPUTER
INADVERTENTLYALTEREDORDESTROYED INAPOCKET
SECURITYINMOSTCASES
4HE()0!!SECURITYSTANDARDSAPPLYTO 3IMILARLY WElNDNETWORKSOFCOMPUTERS
ISTOPREVENTPERSONAL
PROTECTEDHEALTHINFORMATION0() THATIS WONDERFULLYCONVENIENTFORSENDINGMES
HEALTHINFORMATION
EITHERSTOREDORTRANSMITTEDELECTRONICALLY SAGESACROSSANYDISTANCEATALMOSTTHESPEED
FROMBEINGSTOLEN
0()ISHEALTHINFORMATIONINANYFORMTHAT OFLIGHT7EDELIGHTINE MAIL lLEDOWNLOADS
ALTEREDORDESTROYED
PERSONALLYIDENTIlESAPATIENT&ORMOREON ANDINSTANTMESSAGING"UTTHE)NTERNETHAS
0() SEEANEARLIERSECURITYARTICLE)WROTE NOBORDERSORNATURALBOUNDARIES MAKINGIT
FOR&0-h!0ROBLEM /RIENTED!PPROACH EASYFORATTACKERSTOSTRIKEFROMADISTANCE
TOTHE()0!!3ECURITY3TANDARDS v*ULY ANDTOHIDETHEIRWHEREABOUTS!NYTIMEWE
!UGUST PAGE CONNECTOURCOMPUTERSTOTHE)NTERNET WE
4HESESECURITYSTANDARDSWILLAPPLYTO INSTANTLYBECOMEVULNERABLETONEWKINDSOF
YOUON!PRILIFANYOFTHESESITUATIONS ATTACKS SUCHASVIRUSESANDWORMSTHATCAN
EXISTINYOURPRACTICE LITERALLYGETINSIDEOURCOMPUTERSANDALTER
s9OUUSECOMPUTERSINTHEOFlCETO DESTROYORRELEASECONlDENTIALINFORMATION
STOREANDMANAGEADMINISTRATIVEORCLINICAL /NEPROBLEMMERITSSPECIALMENTION
INFORMATION #OMPUTERSHAVEMADETHEISSUEOFIDENTITY
s9OUHAVEACOMPUTERORNETWORK MUCHMOREPROBLEMATIC0EOPLEHAVEALWAYS
CONNECTEDTOTHE)NTERNET BEENABLETOUSESOMEONEELSESIDENTITYFOR
s9OUUSEE MAILOROTHERFORMSOF CRIMINALPURPOSES BUTTHEPROBLEMISEXAC
ELECTRONICMESSAGINGINSIDEANDOUTSIDE ERBATEDWHENWECANTUSEAPERSONSFACE
THEPRACTICE SIGNATUREOROTHERPHYSICALMEANSTOCONlRM
4HEWIDESPREADUSEOFCOMPUTERS SOFT THEIRIDENTITY(OWDOYOUKNOWTHEPERSON
  N & ! - ) , 9 0 2 ! # 4 ) # % - ! . ! ' % - % . 4 NWWWAAFPORG FPMN!PRIL
( ) 0! ! 3 % # 5 2 ) 4 9 # / - 0 , ) ! . # %

SENDINGYOUE MAILISTRULYTHEPERSONHEOR ACOMPUTERORMONITORANDSEEWHATSONTHE 30%%$"!2š


SHECLAIMSTOBE(OWDOYOUKNOWTHEPER SCREEN$OYOUWANTEVERYONEINTHEOFlCE
SONWHOSENAMEISATTACHEDTOANELECTRONIC INCLUDINGPATIENTS FAMILYMEMBERSORYOUR
HEALTHRECORD%(2 ENTRYREALLYMADEIT CLEANINGCREWTOBEABLESEEWHATISDIS °°
)TSDIFlCULT(ACKERSUSECOMPUTERVIRUSES PLAYEDONACOMPUTERSCREEN/FCOURSENOT
)NADDITIONTOPROTECT
TOGETINTOE MAILPROGRAMSANDPROPAGATE "UTYOUPROBABLYWORKINABUSY SOMETIMES
INGIMPORTANTDATA
THEIRNASTINESSBYSENDINGNEWE MAILSTHAT HECTIC ENVIRONMENTTHATMAKESITDIFlCULT
COMPUTERSECURITYIS
APPEARTOCOMEFROMAFRIEND!STHEPUBLIC TOCLOSELYMONITORTHEmOWOFPEOPLEAND
ALSONEEDEDTOPROTECT
DOESMOREONLINESHOPPING IDENTITYTHEFT INFORMATIONATALLTIMES
YOUANDYOURPRACTICE
USINGCOMPUTERSHASBECOMEACOMMONWAY 4HISMEANSTWOTHINGS&IRST YOU
FROMTHERISKOFLEGAL
FORCRIMINALSTOSTEALMONEYANDGOODS SHOULDCAREFULLYCONSIDERTHELOCATIONAND
LIABILITY
4HEBOTTOMLINEISTHIS#OMPUTERSECU DESIGNOFDISPLAYDEVICESINYOUROFlCE
RITYISAREQUIREMENTFORANYSOUNDBUSINESS $ONTPLACEMONITORSINBUSYCORRIDORS AND
INCLUDINGYOURMEDICALPRACTICE#OMPUTER ENSURETHATTHEDISPLAYIMAGEHASA SEC
SECURITYISNEEDEDTOPROTECTTHEPRIVACYOF ONDTIME OUTFEATURE3ECOND EMPLOYEES
THOSEWHOSEINFORMATIONYOUSTOREANDMAN ANDSTAFFMUSTHAVEAHEIGHTENEDAWARENESS °°
AGE)TISALSONEEDEDTOPROTECTYOUANDYOURREGARDINGACCESSTOCOMPUTERS MONITORS
-OSTCOMPUTERSECU
PRACTICEFROMTHERISKOFPENALTYANDLEGAL PRINTERS FAXMACHINESANDOTHERDISPLAY
RITYBREACHESOCCUR
LIABILITYIFPRIVATEINFORMATIONISUSEDOR DEVICES4HEYSHOULDSTRIVETOAVOIDCREAT
WHENINSIDERSEXERCISE
RELEASEDBYYOURPRACTICE INGINSECURESITUATIONS
BADJUDGMENTORFAIL
9OUHAVETWOCHOICES%ITHERDELAYLEARN 0ASSWORDMANAGEMENTISANOTHERAREA
TOFOLLOWESTABLISHED
INGABOUTCOMPUTERSECURITYANDRISKPLAYING THATREQUIRESSTAFFTOBESECURITYCONSCIOUS
PROTOCOLS
CATCH UPWHENANATTACKORACCIDENTCAUSES 0ASSWORDSAND)$SALLOWCOMPUTERSTO
HARMTOAPATIENTORYOURPRACTICE ORBE CONTROLACCESSTOPERSONALHEALTHINFORMA
PROACTIVEANDBEGINTOINSTALLPROTECTIONS TIONBASEDONAPERSONSROLE AUTHORITYOR
THATWILLALLOWYOUTODETECTANDPREVENT NEEDTOKNOW4HEYIDENTIFYORAUTHENTICATE
TROUBLEDOWNTHEROAD ACOMPUTERUSERVIAASECRETPASSWORD °°
/BVIOUSLY PASSWORDSSHOULDBEKEPTSECRET
 -AKECERTAINYOURCOLLEAGUESAND TOAVOIDUNAUTHORIZEDACCESSTOORMANIPU
-ONITORSSHOULDNOT
BEPLACEDINHIGH
STAFFTAKESECURITYASSERIOUSLYASYOUDO LATIONOFPROTECTEDINFORMATION"UTPASS
TRAFlCAREAS AND
4HE()0!!SECURITYSTANDARDSREQUIREYOUR WORDSARECLUMSYTOUSEANDDIFlCULTTO
TIME OUTFEATURES
PRACTICETOHAVEWRITTENSECURITYPOLICIES REMEMBER ESPECIALLYASTHEYBECOMEMORE
SHOULDBEUSED
ANDPROCEDURES INCLUDINGTHOSETHATCOVER COMPLICATEDTHUSINCREASINGTHEIRSECRECY 
PERSONNELTRAININGANDSANCTIONSFORSECURITY )TSTEMPTINGFORUSERSINSMALLOFlCESTO
POLICYVIOLATIONS9OUROFlCESTAFFANDCOL SHAREPASSWORDSORKEEPTHEMWRITTENONA
LEAGUESMUSTTRULYUNDERSTANDBASICSECU PIECEOFPAPERTUCKEDINTOTHETOPDRAWER °°
RITYLOGICANDTAKETHEIRROLEINPROTECTING NEXTTOTHECOMPUTERSTATION)VEEVEN
#OMPUTERPASSWORDS
SHOULDNEVERBE
SHAREDORKEPTNEAR

9OURCOMPUTERSECURITYISONLYASGOODAS THECOMPUTER EVENIN


SMALLOFlCES
THEWEAKESTHUMANLINKINYOUROFlCE

PATIENTSPRIVACYVERY VERYSERIOUSLY-OST FOUNDPASSWORDSONSTICKYNOTESATTACHED


SECURITYBREECHESOCCURWHENINSIDERSnPEO TOCOMPUTERMONITORS
PLEWORKINGFORTHEORGANIZATIONnEXERCISE 4HESEACTIONSCOMPLETELYUNDERMINETHE
FAULTYJUDGMENTORFAILTOFOLLOWPROTOCOLSIN SECURITYSYSTEM7HYPAYFORASOFTWARE
WHICHTHEYVEBEENTRAINED SYSTEMTHATUSESPASSWORDSIFYOUDONTTAKE
#ONSIDERTWOHIGHLYPEOPLE DEPENDENT THEPROTECTIONTHEYPROVIDESERIOUSLY
AREASOFCOMPUTERSECURITYPHYSICALACCESS 3OWHILEITDOESMAKESENSETOWORRY
ANDPASSWORDMANAGEMENT ABOUTHACKERSANDINTRUSIONSFROMOUTSIDE
0HYSICALACCESSTOCOMPUTERSANDSOFTWARE YOUROFlCEWALLS REMEMBERTHATYOUR
ISAFOUNDATIONOFCOMPUTERSECURITY0HYSI CO WORKERSPOSETHEMOSTLIKELYSECURITY
CALACCESSMEANSTHATSOMEONECANAPPROACH RISK9OURCOMPUTERSECURITYISONLYAS
!PRILNWWWAAFPORG FPMN& ! - ) , 9 0 2 ! # 4 ) # % - ! . ! ' % - % . 4 N  
30%%$"!2š GOODASTHEWEAKESTHUMANLINKIN ANDPROCEDURESONTHISANALYSIS WHICHMUST
YOUROFlCE BESPECIlCTOYOURPRACTICE3ECOND ITSTHE
ONLYREASONABLEWAYTOASSESSYOURRISKOF
°°

 #ATALOGALLTHEINFORMATIONSYSTEM SECURITYBREECHESINYOURCURRENTSYSTEMS
COMPONENTSTHATINTERACTWITHPROTECTED ANDPROTOCOLS&INALLY THISEXERCISECANBE
()0!!REQUIREMENTS
HEALTHINFORMATIONINYOUROFlCE4O VALUABLEINTHEACQUISITIONANDUSEOF%(2
INCLUDEADETAILED
ASSESSYOUROFlCESCURRENTSECURITYRISK SYSTEMSIFYOURPRACTICEISMOVINGINTHAT
DESCRIPTIONOFHOW
YOUHAVETOKNOW INDETAIL THECAPABILI DIRECTION
YOURHARDWARE SOFT
TIESANDWEAKNESSESOFYOURINFORMATION 4HE()0!!SECURITYSTANDARDSREQUIRE
WAREANDNETWORK
SYSTEMS.OTWOMEDICALPRACTICESHAVE YOURPRACTICETOAPPOINTSOMEONEASTHE
COMPONENTSCOLLECT
EXACTLYTHESAMEINFORMATIONSYSTEMCOM SECURITYMANAGER SOYOUMIGHTWANTTO
ACCESS STOREAND
PONENTS NORDOTHEYMANAGETHEmOWOF ASSIGNTHESETASKSTOTHATPERSON(OWEVER
TRANSMITPATIENT
INFORMATIONPRECISELYTHESAMEWAY3OME )CANTSTRESSENOUGHTHENEEDFORPHYSICIANS
HEALTHINFORMATION
PRACTICESSTILLMANAGEMOSTINFORMATIONON TOTAKERESPONSIBILITYFORUNDERSTANDINGHOW
PAPERANDHAVEASINGLECOMPUTERFORBILLING HEALTHINFORMATIONTECHNOLOGYISUSEDIN
ANDACCOUNTINGPURPOSES(OWEVER MOST THEIRPRACTICE ESPECIALLYSMALLANDINDEPEN
PRACTICES EVENSMALLONES HAVECOMPLICATED DENTLYOWNEDONES
INFORMATIONTECHNOLOGYENVIRONMENTSTHAT
°°

4HE()0!!SECURITY
INCLUDEMULTIPLECOMPONENTS4HESEMIGHT  0REPAREFORDISASTERBEFOREITOCCURS
INCLUDETHEFOLLOWING !NIMPORTANTASPECTOFCOMPUTERSECURITY
STANDARDSALSOREQUIRE
s(ARDWAREn#OMPUTERWORKSTATIONS INVOLVESPROTECTINGELECTRONICDATAFROMLOSS
YOURPRACTICETO
INTHEFRONTOFlCE TABLETCOMPUTERSINTHE ORCORRUPTIONnTHATIS ENSURINGITSINTEGRITY
APPOINTASECURITY
CLINICALAREAS PRINTERSINTHEBACKOFlCE !LTHOUGHTHEREAREMANYWAYSDATAINTEG
MANAGER
SERVERINTHECOMPUTERCLOSET PERSONALDIGI RITYCANBEAFFECTED THEMOSTCOMMONIS
TALASSISTANTS SCANNINGDEVICESANDMODEMS LOSSOFDATAFROMSOMESORTOFEMERGENCYOR
USEDTOCONNECTTOTHE)NTERNET DISASTER INCLUDINGHUMANERROR MECHANICAL
s3OFTWAREn/PERATINGSYSTEMS BILLING HARDDISKFAILURE EQUIPMENTDAMAGEDUETO
°° SOFTWARE PRACTICEMANAGEMENTSOFTWARE mOODING ORCOMPUTERVIRUSINFECTION
BROWSERS E MAILCLIENTSOFTWARE %(2SOFT !SOLIDCOMPUTER SYSTEMCONTINGENCY
%VENIFSOMEONEELSEIS
WARE ANDDATABASEANDOFlCEPRODUCTIVITY PLANISCOMPOSEDOFANUMBEROFSTEPS
NAMEDASTHESECURITY
SOFTWARE INCLUDINGPERFORMINGBACKUPS PREPARINGFOR
MANAGER PHYSICIANS
s.ETWORKCOMPONENTSn2OUTERSAND CONTINUEDOPERATIONSINANEMERGENCYAND
NEEDTOUNDERSTAND
HUBS DEDICATEDPHONEORCABLELINES WIRE RECOVERINGFROMADISASTER
COMPLETELYHOWHEALTH
LESSSYSTEMS lREWALLSOFTWAREANDlREWALL 4HEMOSTIMPORTANTPARTOFACONTIN
INFORMATIONTECHNOL
HARDWARE GENCYPLANISHAVINGABACKUPSYSTEM!
OGYISUSEDINTHEIR
9OUSHOULDMAKEADETAILEDLISTOFALLOF BACKUPSYSTEMISACOMBINATIONOFHARDWARE
PRACTICES
THECOMPONENTSTHATPLAYAROLEINEITHER ANDSOFTWARETHATLETSYOURETRIEVEEXACTCOP

4HEMOSTIMPORTANTPARTOFACONTINGENCYPLAN
°°

4HEMOSTIMPORTANT
ISHAVINGABACKUPSYSTEM
PARTOFPREPARINGFOR
ADISASTERISHAVING
STORINGPATIENTHEALTHINFORMATIONORTRANS IESOFINFORMATIONIFTHEORIGINALSBECOME
ABACKUPSYSTEMIN
MITTINGITWITHINTHEPRACTICEORTOOUTSIDE LOSTORDAMAGED4HEREARESEVERALKINDSOF
PLACE
SETTINGS9OUTHENNEEDTOCREATEEITHERAmOW COMMONLYUSEDBACKUPSYSTEMS INCLUDING
DIAGRAMORADETAILEDDESCRIPTIONOFHOWTHIS THOSETHATSTOREDATATOTAPES COMPACTDISCS
COLLECTIONOFHARDWARE SOFTWAREANDNETWORK OROFF SITEDEVICES4HEEQUIPMENTANDSER
COMPONENTSCOLLECTS ACCESSES STORESAND VICECANCOSTFROMHUNDREDSTOTHOUSANDSOF
TRANSMITSPATIENTHEALTHINFORMATION DOLLARS ANDTHEBESTMETHODFORYOURPRAC
4HISDETAILEDEXAMINATIONOFYOURENTIRE TICECANONLYBEDETERMINEDAFTERYOUKNOW
SYSTEMISANIMPORTANTSTEPFORTHREEREA HOWMUCHDATANEEDSTOBEBACKEDUP9OUR
SONS&IRST ITSREQUIRED()0!!REQUIRES CHOICEALSOWILLBEINmUENCEDBYCOST CONVE
YOUTOCARRYOUTSUCHARISKANALYSISAND NIENCEANDEASEOFUSE
BASEYOURNEWCOMPUTERSECURITYPOLICIES !TAMINIMUM YOURPRACTICESBACKUP
  N & ! - ) , 9 0 2 ! # 4 ) # % - ! . ! ' % - % . 4 NWWWAAFPORG FPMN!PRIL
( ) 0! ! 3 % # 5 2 ) 4 9 # / - 0 , ) ! . # %

SYSTEMSHOULDSTOREALLOFTHECRITICALDATA AND7EBBROWSING)NTERMSOFRISKTOYOUR 30%%$"!2š


NEEDEDTORUNTHEPRACTICEINTHEEVENTOFA COMPUTERSDATA CONNECTINGTOTHE)NTERNET
DISASTER0RACTICESSHOULDCONDUCTANANALY ISTHEMOSTDANGEROUSACTIVITYINWHICHYOU
SISTOIDENTIFYTHESECRITICALDATA CANENGAGE °°
-ALICIOUSSOFTWARE SOMETIMESCALLED
 -AKESUREYOURNETWORKANDCOM MALWARE HASBECOMEAFAMILIARFORMOF
)FYOURCOMPUTERIS
ATTACHEDTOANETWORK
MUNICATIONSSAFEGUARDSAREINTACTAND COMPUTERATTACK6IRUSES WORMSANDh4RO
YOUNEEDTOMAKESURE
ROBUST)TISINCREASINGLYDIFlCULTTOlNDA JANHORSESvAREAMONGTHEMOSTCOMMON
THATNETWORKISPRO
COMPUTERTHATISNOTATTACHEDTOSOMESORT FORMSOFMALWARETHATYOURCOMPUTERSECU
TECTEDBYAlREWALL
OFNETWORK-OSTCOMPUTERSINYOURPRACTICE RITYMUSTPROTECTAGAINST

4HEREISNOSINGLESOLUTIONTOTHEPROBLEMOF
°°
COMPUTERVIRUSES6IGILANCEISESSENTIAL
&IREWALLSAREHARDWARE
ANDSOFTWAREDEVICES
THATPROTECTANORGANI
ARECONNECTEDTOTHE)NTERNET APARTICULAR 6IRUSESCANATTACHTHEMSELVESTOE MAILS
ZATIONSNETWORKFROM
KINDOFPUBLICNETWORKTHATHASITSSPECIAL PROGRAMlLESANDDATAlLES4HEYCAN
UNAUTHORIZEDUSERS
RISKS!LTHOUGHNETWORKSECURITYISACOM INFECTALLYOURHARDDISKSANDCHANGEOR
PLEXSUBDOMAINOFCOMPUTERSECURITY THE ERASEDATAWHILESPREADINGTOmOPPYDISKS
BASICTHREATSANDPROTECTIVEDEVICESARENOT ANDE MAILSTOINFECTOTHERMACHINES
DIFlCULTTOUNDERSTAND 7ORMSARESELF REPLICATINGPROGRAMSTHAT
.ETWORKSWORKBYROUTINGPACKETSOF ATTACKNETWORKEDCOMPUTERS4HENOW °°
INFORMATIONAMONGANDBETWEENUSERSAT INFAMOUS.IMDAVIRUSWASAWORMSPREAD
%VENIFYOUAREINA
VARIOUSCOMPUTERS'ENERALLY NETWORKSUSE VIAE MAILATTACHMENTSNAMED2%!$-%
SOLOPRACTICEANDDONT
DEVICESKNOWNASROUTERSTOSENDTHEPACKETS %8%)TAFFECTEDAWIDEVARIETYOFOPERATING
REQUIREANETWORKlRE
TOCORRECTADDRESSES4HEREFORE NETWORKS SYSTEMS INCLUDINGSEVERALVERSIONSOF
WALL YOUMOSTLIKELY
NEEDTODEFENDTHEMSELVESAGAINSTATTACKS 7INDOWS.IMDAWASRESPONSIBLEFORTENS
STILLNEEDTOINSTALL
FROMUNAUTHORIZEDUSERSANDFROMINlLTRA OFMILLIONSOFhDENIALOFSERVICEvEVENTS
ANTI VIRUSSOFTWARE
TIONOFUNAUTHORIZEDINFORMATIONPACKETS THROUGHOUTTHE)NTERNET INLARGEPART
THROUGHTHEROUTERS BECAUSEITWASABLETOATTACKKEY7EB
&IREWALLSAREHARDWAREANDSOFTWARE SERVERSTHATDIRECTTRAFlCACROSSTHE)NTERNET
DEVICESTHATPROTECTANORGANIZATIONSNET )TISESTIMATEDTHATWORMSLIKETHE.IMDA
WORKFROMINTRUDERS SUCHASHACKERSOR COST53COMPANIESBILLIONSOFDOLLARSEACH °°
DATATHIEVES4HINKOFlREWALLSASSENTRIES YEARINREPAIRSANDLOSTPRODUCTIVITY
!NTI VIRUSSOFTWARE
ATTHEBOUNDARIESOFPRIVATENETWORKSAND 4HESOLUTIONTOMALWAREISINSTALLINGAND
NEEDSTOBEUPDATED
THEPUBLICNETWORKSTHEYARECONNECTEDTO UPDATINGANTI VIRUSSOFTWARE AVAILABLEFROM
FREQUENTLY
4HEYCHECKCREDENTIALS PERMITPASSAGEOF SPECIALIZEDSOFTWARECOMPANIES ONALLOF
AUTHORIZEDPARTIESANDCOMMUNICATIONS YOURCOMPUTERS!NTI VIRUSSOFTWAREWORKS
ANDKEEPARECORDOFWHATCROSSESTHE BYSCANNINGDIGITALDATA SUCHASINCOMING
BOUNDARY&IREWALLSDENYACCESSTOUNAU E MAILS lLES HARDDISKSAND#$S ANDTHEN
THORIZEDUSERSANDAPPLICATIONS ANDTHEY AUTOMATICALLYDELETINGORISOLATINGVIRUSES
CREATEAUDITTRAILSORLOGSTHATIDENTIFYWHO !NTI VIRUSSOFTWAREPROGRAMSAREGREATAT
ACCESSEDTHENETWORKANDWHEN&IREWALLS DETECTINGKNOWNVIRUSESBUTNOTSOGOODAT
MAYALSOISSUEALARMSWHENABNORMALACTIV DETECTINGNEWONES.EWMALWAREAPPEARS
ITYOCCURS SUCHASAREPEATEDUNSUCCESSFUL ALLTHETIME SOANTI VIRUSSOFTWARENEEDSTO
ATTEMPTTOENTERTHENETWORK BEUPDATEDFREQUENTLY
6IRUSES ESPECIALLYE MAILWORMS ARETHE
 "ECERTAINTHATYOUHAVEANTI VIRUS PRICEWEPAYFORUNIVERSALCONNECTIVITYAND
SOFTWAREANDKEEPITUPTODATE%VENIF COMMUNICATIONSOVEROPENNETWORKS ESPE
YOUAREINSOLOPRACTICEANDUSEONLYONE CIALLYOVERTHE)NTERNET4HEREISNOSINGLE
LAPTOPCOMPUTERFORALLYOURDATACAPTURE SOLUTIONTOTHEPROBLEMOFCOMPUTERVIRUSES
STORAGEANDTRANSMISSIONnANDTHEREFORE ANDTHEPROBLEMSEEMSTOBEGETTINGWORSE
MAYNOTREQUIREANETWORKlREWALLnYOU ASMOREINFORMATIONISDELIVEREDOVERTHE
PROBABLYCONNECTTOTHE)NTERNETFORE MAIL )NTERNETALLTHETIME6IGILANCEISESSENTIAL
!PRILNWWWAAFPORG FPMN& ! - ) , 9 0 2 ! # 4 ) # % - ! . ! ' % - % . 4 N  
30%%$"!2š 5NDERSTANDWHATENCRYPTIONWILL MON-ANYPATIENTSENJOYDIRECTONLINE
DOANDWHENITISNECESSARY#ONTRARYTO COMMUNICATIONSWITHTHEIRPHYSICIANSVIAE
WHATMANYPEOPLEARESAYING THE()0!! MAIL4HEPROBLEM OFCOURSE ISTHATE MAIL
°° SECURITYSTANDARDSDONOTREQUIREE MAILS ISTHEDIGITALEQUIVALENTOFAPOSTCARD!NY
ORANYOTHERTRANSMISSIONFROMADOCTORS ONEHANDLINGTHEMESSAGECANEASILYREADITS
4HE()0!!STANDARDS
OFlCE TOBEENCRYPTED4HESTANDARDSDO CONTENTS)TDOESNTEVENHAVEANENVELOPE
DONOTREQUIREE MAILS
REQUIREYOURPRACTICETOASSESSWHETHERITS !NDE MAILSARESUSCEPTIBLETOFORGERY(OW
TOBEENCRYPTED
UNENCRYPTEDTRANSMISSIONSOFHEALTHINFOR DOYOUKNOWFORSURETHATTHEPERSONLISTED
MATIONAREATRISKOFBEINGACCESSEDBY INTHEhFROMvlELDOFANE MAILISTHEPERSON
UNAUTHORIZEDENTITIES)FTHEYARE YOU WHOACTUALLYMAILEDTHEMESSAGE
SHOULDCONSIDERSOMEFORMOFENCRYPTION 4HEPROBLEMWITHENCRYPTINGE MAILIS
°° 4HEBASICIDEABEHINDCRYPTOGRAPHY THATBOTHPARTIESOFTHEE MAILEXCHANGE
OFWHICHELECTRONICDATAENCRYPTIONISA NEEDTOBEUSINGCOMPATIBLEE MAILENCRYP
(OWEVER THESTAN
BRANCH ISTHATAGROUPNEEDSTOKEEPA TIONPRODUCTS4HISISCLUMSYAND SOFAR
DARDSDOREQUIREYOU
MESSAGESECRETFROMEVERYONEELSEAND RARELYUSED-ORECOMMONLY ENCRYPTED
TOASSESSWHETHERYOUR
THEREFOREENCRYPTSIT%NCRYPTIONISTHE E MAILMESSAGEEXCHANGESOCCURWHENBOTH
PRACTICESUNENCRYPTED
TRANSFORMATIONOFAMESSAGEFROMPLAIN PARTIESAGREETOUSEASECURESERVERORPOR
TRANSMISSIONSOF
TEXTINTONONSENSICALCIPHERTEXTBEFORE TALSYSTEMTHATREQUIRESBOTHPARTIESTOUSE
HEALTHINFORMATION
THEMESSAGEISSENT!NYONEWHOSTEALS PASSWORDSAND)$STOLOGON4HE!!&0HAS
AREATRISK
THECIPHERTEXTMESSAGEWILLNOTBEABLETO APARTNERSHIPWITH-EDFUSIONTHATPERMITS
UNDERSTANDIT/NLYTHOSEWHOHAVETHE !!&0MEMBERSFREEUSEOFSUCHASECURE
CODEUSEDTOENCRYPTTHEMESSAGECANCON PORTALSYSTEMFORMESSAGINGWITHPATIENTS
VERTITBACKFROMCIPHERTOPLAINTEXTAND &ORMOREINFORMATION SEEHTTPWWWAAFP
°° REVEALITSMEANING ORGXXML
&ORSEVERALREASONS ENCRYPTIONISGENER
%NCRYPTINGE MAILCAN
BETRICKYBECAUSEBOTH
ALLYNOTEMPLOYEDFORINFORMATIONSTOREDON  #ONSIDERCHAINSOFTRUSTANDYOUR
ACOMPUTERSHARDDISKORTRANSFERREDWITHIN BUSINESSRELATIONSHIPS9OURPRACTICE
PARTIESOFTHEE MAIL
ANOFlCESLOCALAREANETWORK&IRST THERISK SHARESSECURITYCONCERNSWITHANYBUSINESSES
EXCHANGENEEDTO
OFDISCLOSURETOUNAUTHORIZEDPARTIESISSMALL THATAREINVOLVEDINTHEELECTRONICTRANSMIS
BEUSINGCOMPATIBLE
INTHECLOSEDENVIRONMENT3ECOND ENCRYPT SIONOFYOURPATIENTSINFORMATION)NEFFECT
ENCRYPTIONPRODUCTS
INGDATAISCOSTLY4HIRD ENCRYPTIONGENERAL THESECURITYCAPABILITYOFINSURANCECOM
LYSLOWSDOWNTHEMOVEMENTOFINFORMATION PANIES TRANSCRIPTIONANDBILLINGSERVICES
WITHINSOFTWAREAPPLICATIONSANDDATABASES HOSPITALS LABSAND)NTERNETSERVICEPROVIDERS
(EREISALISTOFELECTRONICDATATRANSFERS ISYOURCONCERN
°° ANDCOMMUNICATIONSCOMMONLYUSEDIN h#HAINOFTRUSTvISACONCEPTUSEDINTHE
AMEDICALOFlCETHATCOULDBECONSIDERED COMPUTERSECURITYlELDTODESCRIBETHECON
4HE()0!!STANDARDS
FORENCRYPTION TRACTUALAGREEMENTSMADEBETWEENPARTIESTO
REQUIREYOURPRACTICE
s0ATIENTBILLINGANDADMINISTRATIVE ASSURETHATTHECONlDENTIALINFORMATIONTHEY
TOOBTAINASSURANCES
INFORMATIONEXCHANGEDWITHPAYERSAND SHAREREMAINSSECURETHROUGHOUTITSJOURNEY
FROMBUSINESSASSOCI
HEALTHPLANS 4HEREISNOSTANDARDSETOFOBLIGATIONSFOR
ATESTHATTHEYWILL
s5TILIZATIONANDCASEMANAGEMENTDATA CHAIN OF TRUSTAGREEMENTS(OWEVER SUCH
SECURETHEELECTRONIC
INCLUDINGAUTHORIZATIONSANDREFERRALSTHAT AGREEMENTSOBLIGATEBOTHPARTIESTOADOPTA
HEALTHINFORMATION
AREEXCHANGEDWITHPAYERS HOSPITALSAND FORMOFSTRONGAUTHENTICATIONSUCHTHATDATA
THEYCREATE MAINTAIN
UTILIZATIONMANAGEMENTORGANIZATIONS TRANSMISSIONSAREATTRIBUTABLEANDNONDENI
ORTRANSMITONBEHALF
s0ATIENTHEALTHINFORMATIONGATHERED ABLE/THERWISE ONEPARTYORTHEOTHER
OFYOURPRACTICE
FROMORDISPLAYEDONA7EBSITEORPORTAL COULDCLAIMNOTTOHAVERECEIVEDANIMPOR
s,ABANDOTHERCLINICALDATAELECTRONI TANTPIECEOFINFORMATIONSENTELECTRONICALLY
CALLYSENTTOANDRECEIVEDFROMOUTSIDELABS 4HE()0!!SECURITYSTANDARDSREQUIRE
s7ORD PROCESSINGlLESUSEDINTRANSCRIP YOURPRACTICETOOBTAINASSURANCESFROM
TIONANDOTHERKINDSOFPATIENTREPORTSTHAT BUSINESSASSOCIATESTHATTHEYWILLIMPLEMENT
ARETRANSFERREDELECTRONICALLY THENECESSARYSAFEGUARDSTOPROTECT
s% MAILSBETWEENPHYSICIANSAND THECONlDENTIALITY INTEGRITYANDAVAILABILITY
PATIENTS ANDBETWEENATTENDINGANDREFER OFTHEELECTRONICHEALTHINFORMATIONTHEY
RINGPHYSICIANSANDTHEIROFlCES CREATE MAINTAINORTRANSMITONBEHALF
%NCRYPTIONOFE MAILMESSAGESMERITS OFTHEPRACTICE
SPECIALATTENTIONBECAUSEE MAILISSOCOM 4HEIMPORTANTISSUEHEREISTOhKNOWTHY
  N & ! - ) , 9 0 2 ! # 4 ) # % - ! . ! ' % - % . 4 NWWWAAFPORG FPMN!PRIL
( ) 0! ! 3 % # 5 2 ) 4 9 # / - 0 , ) ! . # %

BUSINESSPARTNERv%VERYENTITYWITHWHICH WORKMORECLOSELYWITHTHEVENDORTOENSURE 30%%$"!2š


YOUSHAREINFORMATIONELECTRONICALLYISAN THATALLTHEFACETSOFYOURCOMPUTERSYSTEM
EXTENSIONOFYOURPRACTICE WHETHERYOU SATISFYYOURPRACTICES()0!!SECURITYPLAN
WANTTHEMTOBEORNOT 3OME%(2VENDORSWILLEVENHELPYOUDOA °°
GAPANALYSISASPARTOFTHEIRPURCHASE
 $EMANDTHATYOURVENDORSFULLY PROGRAM"UTBECAUSEMOST%(2VENDORS
4HEINTEGRATION
OFFEREDBYSOME%(2S
UNDERSTANDTHE()0!!SECURITYSTAN DONTINSTALLTHEHARDWAREANDNETWORKING
CANSIMPLIFYYOUR
DARDS!SYOUBECOMEBETTERINFORMED COMPONENTS YOURCHOICEOFALOCALCONTRAC
PRACTICESEFFORTTO
ABOUTCOMPUTERSECURITYANDTHE()0!! TORFORTHESESERVICESSHOULDBEMADEWITH
COMPLYWITHTHE()0!!
SECURITYSTANDARDS YOUWILLREALIZETHE ()0!!INMIND"ECERTAINTHATYOURLOCAL
SECURITYSTANDARDS
EXTENTTOWHICHCOMPLIANCEMAKESYOU CONTRACTORISFULLYAWAREOFTHE()0!!
DEPENDENTONHARDWARE SOFTWARE NETWORK SECURITYSTANDARDSANDISWILLINGTOASSIST
ANDOTHERINFORMATIONTECHNOLOGY)4 YOUBEFOREYOUPROCEED
VENDORS4HEIRPRODUCTSANDSERVICES
WHETHEROUT OF THE BOXCOMPUTERHARDWARE  3TARTWITHAPLANnANDTHEENDn °°

ORHANDS ON IN THE OFlCE)4SERVICES WILL INMIND-YHOPEISTHATAFTERREADINGTO
3OME%(2VENDORS
ENABLEYOUTOMEETMANYOFTHESECURITY THISPOINTYOUHAVEAMUCHBETTERIDEAOF
WILLHELPYOUDOAGAP
STANDARDSnORNOT THEBREADTHANDSCOPEOFTHE()0!!SECU
ANALYSIS
!GOODEXAMPLEISTHEREQUIREMENTFOR RITYSTANDARDS ANDTHATYOUAREBETTERPRE
AUDITCONTROLS!UDITCONTROLSTHATPERMIT PAREDTOTACKLETHETASKOFASSESSINGYOUR
YOUTORECORDANDEXAMINEACTIVITYININFOR PRACTICESCURRENTSTATEOFCOMPUTERSECURITY
MATIONSYSTEMSCANREQUIREACOMBINATION 4HEREARESOMEEXCELLENTTOOLSTHATCANASSIST
OFHARDWARE SOFTWARE NETWORKANDPROCE YOUINPERFORMINGAGAPANALYSISFORTHIS °°
DURALMECHANISMSTOACTINCONCERT)FTHESE PURPOSEWITHOUTHAVINGTOHIREACONSULTANT
)FYOUARETHINKING
COMPONENTSHAVEBEENPURCHASEDFROMSEPA /NEPLACETOSTARTISTHE.EEDS!SSESSMENT
ABOUTCONVERTINGTO
RATEVENDORS ITMIGHTBENECESSARYTOCOOR PAGEONTHE#(I47EBSITE AVAILABLEAT
AN%(2 BESURETHAT
DINATETHEIRSETUPANDCONlGURATIONTOMEET HTTPWWWCENTERFORHITORGXXML
YOURHARDWAREAND
THEAUDITCONTROLREQUIREMENTOFTHE()0!! 2EMEMBERTHATTHEREISNOCOOKBOOK
NETWORKINGCONTRACTOR
SECURITYSTANDARDS7HOWILLPERFORMTHIS ORONE SIZE lTS ALLAPPROACHFORCOMPUTER
ISAWAREOFTHE()0!!
COORDINATIONINYOUROFlCE SECURITY7HATCOUNTSISBEINGhREASONABLE
STANDARDSBEFORE
PROCEEDING

)TMIGHTBEAFORTUNATECOINCIDENCETHATTHE
()0!!SECURITYSTANDARDSHAVEBEENMANDATEDJUST
°°
ASMANYFAMILYPHYSICIANSAREACQUIRING%(2S
4HEREISNOONE SIZE
lTS ALLPLANFORCOM
PUTERSECURITY
)TMIGHTBEAFORTUNATECOINCIDENCETHAT ANDAPPROPRIATEvWHENMATCHINGSECURITY
THE()0!!SECURITYSTANDARDSHAVEBEEN MEASURESWITHTHELEVELOFRISKTHATPERTAINS
MANDATEDJUSTASMANYFAMILYPHYSICIANS TOYOURSITUATION4HESESTEPSSHOULD
AREACQUIRING%(2SFORTHEIRPRACTICES HELPYOURECOGNIZEANUMBEROFPLACES
-ANYARECHOOSINGINTEGRATED%(2SYSTEMS WHEREYOURORGANIZATIONSCOMPUTERSECURITY
nTHATIS PRODUCTSTHATINCLUDEBILLING COULDBEIMPROVEDANDWHERESOMEDElCIEN
SCHEDULINGANDCLINICALINFORMATIONSOFT CIESMIGHTBEEASILYADDRESSED
WAREFROMTHESAMEVENDOR4HISINTEGRATION
CANGREATLYSIMPLIFYMEETINGTHE()0!! 3ENDCOMMENTSTOFPMEDIT AAFPORG
SECURITYCHALLENGEnIFYOUSELECTTHERIGHT
%(2VENDOR4OSEE%(2REVIEWSBYYOUR
COLLEAGUES CHECKOUTTHE!!&0S#ENTER
FOR(EALTH)NFORMATION4ECHNOLOGY#(I4 !VAILABLEATHTTPWWWCMSHHSGOVHIPAA
7EBSITEATHTTPWWWCENTERFORHITORG HIPAAREGULATIONSSECURITYDEFAULTASP!CCESSED
XXML -ARCH 
!SINGLE VENDORSOLUTIONFORSMALLAND /(ARROW2*R0ROZACMAKERREVEALSPATIENT
MEDIUMMEDICALPRACTICESALLOWSYOUTO E MAILADDRESSES7ASHINGTON0OST*ULY %
!PRILNWWWAAFPORG FPMN& ! - ) , 9 0 2 ! # 4 ) # % - ! . ! ' % - % . 4 N  

Você também pode gostar