UNIT 3: COMPUTER SECURITY
3.1 Introduction
In today’s digital world, computer systems have become central to nearly every aspect of
professional and personal life. In the health sector, computers are used for maintaining patient
records, managing drug inventories, preparing reports, and facilitating communication between
health institutions. However, with these benefits come several risks. Computer systems and the
data they contain can be damaged, stolen, altered, or misused by unauthorized individuals. This
makes computer security a critical area of study for every health science student, especially
those preparing for careers as community health practitioners and pharmacists.
Computer security refers to the set of policies, practices, and technologies used to protect
computer systems and data from harm, loss, or unauthorized access. For those in health-related
professions, computer security is not merely a technical concern but also an ethical
responsibility—since protecting patients’ information is part of professional confidentiality and
public trust.
3.2 Learning Objectives
By the end of this unit, students should be able to:
1. Explain the concept and importance of computer security.
2. Identify various types of computer security threats.
3. Discuss preventive and control measures against computer attacks.
4. Understand the concept of data protection and privacy, especially in health institutions.
5. Demonstrate good security practices when using computers and mobile devices.
3.3 Meaning and Importance of Computer Security
Computer security, also called cybersecurity, is the process of safeguarding computers,
networks, and information from damage, unauthorized access, and misuse. It ensures that the
information stored or transmitted through computers remains confidential, accurate, and
available whenever needed.
In the health sector, computer security is vital because sensitive data—such as patient medical
histories, laboratory results, and prescriptions—are stored electronically. Any unauthorized
access or data loss could lead to legal, ethical, and clinical consequences.
For example, imagine a situation where a community health center’s computer system is
attacked by a virus, corrupting all immunization records. Such an event could disrupt service
delivery, lead to wrong treatment decisions, and damage the institution’s credibility.
Thus, computer security is important for the following reasons:
● It protects sensitive patient data from unauthorized access.
● It ensures the continuity of healthcare services.
● It prevents loss of valuable research and institutional data.
● It builds public trust in digital health systems.
● It safeguards equipment and software from damage or misuse.
3.4 Fundamental Concepts in Computer Security
Computer security rests on three main principles often summarized as the CIA Triad:
1. Confidentiality – ensuring that only authorized individuals can access specific
information. For instance, only a registered pharmacist should access the pharmacy’s
drug inventory database.
2. Integrity – maintaining the accuracy and consistency of data. A patient’s record must
not be altered by unauthorized persons.
3. Availability – ensuring that data and systems are accessible when needed. A hospital’s
electronic record system should not crash or become inaccessible during working hours.
Failure in any of these three areas leads to a breach of security.
3.5 Common Computer Security Threats
A security threat is any potential danger that can exploit a system’s vulnerability and cause
harm. Below are common threats encountered in both general and healthcare computing
environments.
a. Computer Viruses and Worms:
These are malicious programs that attach themselves to legitimate files and spread from one
computer to another, destroying data or slowing down operations. For example, a flash drive
infected with a virus could corrupt patient records in a clinic’s database.
b. Trojans and Spyware:
A Trojan appears to be a useful program but secretly performs harmful actions, such as
stealing passwords. Spyware secretly collects user information and transmits it to an attacker. In
a health context, spyware could capture a login used to access a hospital management system.
c. Phishing and Social Engineering:
Phishing involves fraudulent messages designed to trick users into revealing confidential
information, like passwords. Health workers who receive fake emails asking them to "verify their
hospital account" could unknowingly give hackers access to sensitive data.
d. Hacking:
Hacking is the unauthorized access to or manipulation of a computer system. A hacker could
break into a health information system to steal patient data or alter medical records.
e. Ransomware:
This is malicious software that locks users out of their systems until a ransom is paid. Hospitals
worldwide have experienced ransomware attacks that delayed medical treatments because
doctors could not access patient files.
f. Physical Threats:
Security is not only digital. Theft of laptops, hard drives, or mobile devices containing medical
records also compromises information security.
3.6 Security Measures and Preventive Practices
To minimize risks, computer users must adopt preventive and protective measures. These
include both technical and behavioral approaches.
1. Use of Strong Passwords:
Passwords should be complex and difficult to guess. A good password combines uppercase
and lowercase letters, numbers, and symbols. For example, instead of using “pharmacy123”, a
better password would be “Ph@rm2025!”. Passwords should be changed regularly and never
shared with others.
2. Antivirus and Anti-Malware Software:
Installing and regularly updating antivirus software helps detect and remove malicious
programs. Programs like Avast, Kaspersky, and Windows Defender provide real-time protection.
3. Regular Software Updates:
Manufacturers often release updates to fix security vulnerabilities. Ignoring these updates
makes computers easy targets for attackers. Health institutions should ensure all systems and
applications are up to date.
4. Data Backup:
Important data should be backed up regularly to external drives or cloud storage. This ensures
that information can be recovered in case of accidental loss, system failure, or attack.
5. Access Control:
Restricting access ensures that only authorized personnel can view or edit sensitive data. For
instance, only nurses may input patient observations, while only doctors can edit diagnosis
fields.
6. Encryption:
Encryption is the process of converting data into a coded form that only authorized users can
read. In healthcare, encryption ensures that patient data transmitted between hospitals remains
confidential.
7. Firewalls:
A firewall acts as a barrier between a computer and the internet, filtering incoming and outgoing
traffic to prevent unauthorized access.
8. Secure Disposal of Data and Devices:
Before disposing of old computers or storage devices, all data should be permanently deleted.
Simply deleting files does not erase them completely.
9. Awareness and Training:
The human factor is often the weakest link in computer security. Regular training of staff and
students ensures awareness of threats like phishing or unsafe browsing habits.
10. Physical Security:
Computers should be kept in locked offices when not in use. Surge protectors should be used
to prevent damage from power surges, and screens should be turned off when unattended.
3.7 Data Protection and Privacy in Health Information Systems
In the health profession, maintaining the confidentiality of patient data is not just a security
requirement—it is a legal and ethical obligation. Many countries now have data protection laws
that guide how health information should be collected, stored, and shared.
For example, in Nigeria, the Nigeria Data Protection Act (NDPA) 2023 provides guidelines for
the collection and handling of personal data. Hospitals and community health centers must
ensure that patient data are:
● Collected only for legitimate purposes.
● Stored securely.
● Shared only with authorized individuals or institutions.
● Retained only for as long as necessary.
A breach of patient confidentiality, whether intentional or accidental, could lead to disciplinary
action, legal penalties, and loss of public trust.
Example:
If a community health worker shares a patient’s HIV status on a social media group, it
constitutes both an ethical violation and a data security breach.
3.8 Safe Internet and Email Practices
Many security incidents begin with careless internet usage.
Students and health professionals should follow the following safety habits:
● Avoid opening suspicious email attachments.
● Do not click on links from unknown senders.
● Always verify the authenticity of websites before entering login details.
● Avoid using public Wi-Fi for sensitive tasks like accessing hospital databases or online
banking.
● Log out properly after using shared systems.
These practices help minimize risks associated with online activities.
3.9 Role of the Individual in Computer Security
Computer security is not solely the responsibility of IT experts. Every user has a role to play. A
single careless act, such as using an infected flash drive or weak password, can endanger an
entire network.
As a student or health practitioner:
● Be alert when using computers in the lab or office.
● Report any strange computer behavior to the appropriate authority.
● Avoid installing unauthorized software.
● Always log off after completing your work.
3.10 Emerging Security Issues in Health Informatics
With the growth of telemedicine, mobile health apps, and electronic health records, new
challenges have emerged. Hackers now target cloud-based hospital systems and mobile apps
that store health information.
Pharmacies using online drug inventory platforms also face risks of unauthorized transactions.
Therefore, understanding cybersecurity principles has become as important as understanding
pharmacology or public health systems.
3.11 Summary
In this unit, students have learned that computer security involves protecting data, hardware,
and software from unauthorized access, damage, or theft. It is essential in all fields, especially
healthcare, where information sensitivity is high. Threats such as viruses, hacking, and phishing
can cause severe damage if preventive measures are ignored. By applying strong passwords,
antivirus software, backups, and responsible behavior, users can maintain data confidentiality,
integrity, and availability.
3.12 Assessment
Section A: Theory
1. Define computer security and explain its relevance to the health sector.
2. List and discuss three major principles of computer security.
3. Explain any four common computer threats and their effects.
4. Describe five preventive security practices a community health practitioner should adopt.
5. Briefly discuss the importance of the Nigeria Data Protection Act in health institutions.
Section B: Practical Tasks
1. On your personal computer, create a strong password following best practices.
2. Locate your system’s antivirus program and perform a quick scan.
3. Demonstrate how to back up important files to a flash drive or cloud account.
4. Identify and report one example of unsafe online behavior among your peers and
suggest corrective action.