Health
Informati
cs
BCA-2020: Semester-V
Module 5:
Chapter 1
INFORMATION BIOINFORMATICS
PRIVACY AND
SECURITY
Information Privacy and Security: The Value and
Importance of Health Information Privacy, security of
health data, potential technical approaches to health
data privacy and security.
Module
Bioinformatics: Bioinformatics, Healthcare
Informatics and Analytics for Improved Healthcare Content
System, Intelligent Monitoring and Control for
Improved Healthcare System.
Learning Objectives
The Value and Importance of Health
Information Privacy
Security of health data
Potential technical approaches to health
data privacy and security
With a verifiable need to protect health information
The Value well established, there is a need to cover the
information security aspects.
and How is health data protected against exposure?
Importance How does an increasingly targeted industry turn the
of Health tide against the news stories, hackers, criminals, and
identity thieves?
Information More importantly, what mechanisms are medical
Privacy professionals likely to witness firsthand in the battle
to keep the attacks at bay?
There are a variety of reasons for placing a high value on
protecting the privacy, confidentiality, and security of
health information.
Some theorists depict privacy as a basic human good or
The Value right with intrinsic value. They see privacy as being
objectively valuable in itself, as an essential component of
and human well-being.
Importance They believe that respecting privacy (and autonomy) is a
form of recognition of the attributes that give humans
of Health their moral uniqueness.
The more common view is that privacy is valuable
Information because it facilitates or promotes other fundamental
values, including ideals of personhood such as:
Privacy Personal autonomy (the ability to make personal
decisions)
Individuality
Respect
Dignity and worth as human beings
The shift towards electronic health records, personal
health records, health information exchanges, and
web- based health applications creates a security
challenge of incredible proportions.
How does one secure the most private of personal
information, health data?
Basic According to the International Information Systems
Security Security Certification Consortium (ISC), among others,
there are three pillars of information security
Principles (confidentiality, availability, and integrity) that are
fundamental to protecting information technology
solutions such as health information technology (HIT).
Security measures are instituted collectively to meet
one or more of these primary goals, with the end
result being one where confidentiality, availability and
integrity are all covered.
The CIA Security Triad.
This concept combines three components—confidentiality,
integrity, and availability—to help guide security measures,
controls, and overall strategy.
The CIA security triad is
comprised of three functions:
Basic Confidentiality. A system’s
Security ability to ensure that only the
correct, authorized
Principles user/system/resource can view,
access, change, or otherwise
use data.
Integrity. A system’s ability to
ensure that the system and
information is accurate and
correct.
Availability. A system’s ability
to ensure that systems,
information, and services are
In a non-security sense, confidentiality is your ability to keep
something secret. In the real world, we might hang up blinds or
put curtains on our windows. We might ask a friend to keep a
secret.
Confidentiality also comes into play with technology. It can play
out differently on a personal-use level, where we use VPNs or
encryption for our own privacy-seeking sake. We might turn off
in-home devices that are always listening.
Confidential But in enterprise security, confidentiality is breached when an
unauthorized person can view, take, and/or change your files.
ity Confidentiality is significant because your company wants to
protect its competitive edge—the intangible assets that make
your company stand out from your competition.
Confidentiality is roughly equivalent to privacy. Confidentiality
measures are designed to prevent sensitive information from
unauthorized access attempts. It is common for data to be
categorized according to the amount and type of damage that
could be done if it fell into the wrong hands. More or less
stringent measures can then be implemented according to those
categories.
In computer systems, integrity means that the results
of that system are precise and factual.
In the data world, it’s known as data trustworthiness
—can you trust the results of your data, of your
computer systems?
When securing any information system, integrity is
one function that you’re trying to protect.
Integrity You don’t want bad actors or human error to, on
purpose or accidentally, ruin the integrity of your
computer systems and their results.
Integrity involves maintaining the consistency,
accuracy and trustworthiness of data over its entire
lifecycle. Data must not be changed in transit, and
steps must be taken to ensure data cannot be altered
by unauthorized people (for example, in a breach of
confidentiality).
Availability is a term widely used in IT—the availability
of resources to support your services. In security,
availability means that the right people have access
to your information systems.
If a user with privilege access has no access to her
dedicated computer, then there is no availability.
Availability is a large issue in security because it can
be attacked.
Availability An attack on your availability could limit user access
to some or all of your services, leaving your
scrambling to clean up the mess and limit the
downtime.
Availability means information should be
consistently and readily accessible for authorized
parties. This involves properly maintaining hardware
and technical infrastructure and systems that hold
and display the information.
Protecting data in the healthcare industry is no easy feat.
Healthcare providers and their business associates must balance
protecting patient privacy while delivering quality patient care and
meeting the strict regulatory requirements. Because protected
health information (PHI) is among an individual’s most sensitive
(and for criminals, valuable) private data, the guidelines for
healthcare providers and other organizations that handle, use, or
transmit patient information include strict data protection
requirements that come with hefty penalties and fines if they’re not
met.
Security of The data protection best practices for healthcare organizations
health data including:
1. Educating Healthcare Staff
2. Restricting Access to Data and Applications
3. Implementing Data Usage Controls
4. Logging and Monitoring Use
5. Encrypting Data
6. Securing Mobile Devices
7. Mitigating Connected Device Risks
8. Conducting Regular Risk Assessments
9. Utilizing Off-Site Data Backup
[Link] Evaluating the Compliance of Business Associates
1. EDUCATE HEALTHCARE STAFF
Security of The human element remains one of the biggest
health data: threats to security across all industries, but
particularly in the healthcare field. Simple human
HOW TO error or negligence can result in disastrous and
PROTECT expensive consequences for healthcare organizations.
Security awareness training equips healthcare
HEALTHCARE employees with the requisite knowledge necessary
DATA for making smart decisions and using appropriate
caution when handling patient data.
2. RESTRICT ACCESS TO DATA AND
APPLICATIONS
Implementing access controls bolsters healthcare
data protection by restricting access to patient
information and certain applications to only those
users who require access to perform their jobs.
Security of Access restrictions require user authentication,
health data: ensuring that only authorized users have access to
protected data. Multi-factor authentication is a
HOW TO recommended approach, requiring users to validate
PROTECT that they are in fact the person authorized to access
certain data and applications using two or more
HEALTHCARE validation methods including:
DATA Information known only to the user, such as a password
or PIN number
Something that only the authorized user would
possess, such as a card or key
Something unique to the authorized user, such as
biometrics (facial recognition, fingerprints, eye
scanning)
3. IMPLEMENT DATA USAGE CONTROLS
Protective data controls go beyond the benefits of
Security of access controls and monitoring to ensure that risky or
health data: malicious data activity can be flagged and/or blocked
in real time. Healthcare organizations can use data
HOW TO controls to block specific actions involving sensitive
PROTECT data, such as web uploads, unauthorized email sends,
copying to external drives, or printing. Data discovery
HEALTHCARE and classification play an important supporting role in
DATA this process by ensuring that sensitive data can be
identified and tagged to receive the proper level of
protection.
4. LOG AND MONITOR USE
Logging all access and usage data is also crucial,
Security of enabling providers and business associates to monitor
health data: which users are accessing what information,
applications, and other resources, when, and from
HOW TO what devices and locations. These logs prove valuable
PROTECT for auditing purposes, helping organizations identify
areas of concern and strengthen protective measures
HEALTHCARE when necessary. When an incident occurs, an audit
DATA trail may enable organizations to pinpoint precise
entry points, determine the cause, and evaluate
damages.
5. ENCRYPT DATA AT REST AND IN TRANSIT
Encryption is one of the most useful data protection
methods for healthcare organizations. By encrypting
data in transit and at rest, healthcare providers and
business associates make it more difficult (ideally
Security of impossible) for attackers to decipher patient
health data: information even if they gain access to the data. HIPAA
offers recommendations but doesn’t specifically require
HOW TO healthcare organizations to implement data encryption
measures; instead, the rule leaves it up to healthcare
PROTECT providers and business associates to determine what
HEALTHCARE encryption methods and other measures are necessary
DATA or appropriate given the organization’s workflow and
other needs.
Health IT Security outlines the two key questions
that healthcare organizations should ask in
determining an appropriate level of encryption and
when encryption is needed.
6. SECURE MOBILE DEVICES
Increasingly, healthcare providers and covered entities utilize
mobile devices in the course of doing business, whether it’s a
physician using a smartphone to access information to help them
treat a patient or an administrative worker processing insurance
Security of claims. Mobile device security alone entails a multitude of
security measures, including:
health data:
Managing all devices, settings, and configurations
Enforcing the use of strong passwords
HOW TO
Enabling the ability to remotely wipe and lock lost or stolen devices
Encrypting application data
PROTECT Monitoring email accounts and attachments to prevent malware
infections or unauthorized data exfiltration
HEALTHCARE Educating users on mobile device security best practices
DATA Implementing guidelines or whitelisting policies to ensure that only
applications meeting pre-defined criteria or having been pre-vetted
can be installed
Requiring users to keep their devices updated with the latest
operating system and application updates
Requiring the installation of mobile security software, such as
mobile device management solutions
7. MITIGATE CONNECTED DEVICE RISKS
When you think of mobile devices, you probably think of
smartphones and tablets. But the rise of the Internet of
Things (IoT) means that connected devices are taking all
Security of kinds of forms. In the healthcare field, everything from
medical devices like blood pressure monitors to the
health data: cameras used to monitor physical security on the
premises may be connected to a network. To maintain
HOW TO adequate connected device security:
PROTECT Maintain IoT devices on their own separate network
Continuously monitor IoT device networks to identify sudden
HEALTHCARE changes in activity levels that may indicate a breach
DATA Disable non-essential services on devices before using them,
or remove non-essential services entirely before use
Use strong, multi-factor authentication whenever possible
Keep all connected devices up-to-date to ensure that all
available patches are implemented
8. CONDUCT REGULAR RISK ASSESSMENTS
While having an audit trail helps to identify the cause
and other valuable details of an incident after it
occurs, proactive prevention is equally important.
Security of Conducting regular risk assessments can identify
health data: vulnerabilities or weak points in a healthcare
organization’s security, shortcomings in employee
HOW TO education, inadequacies in the security posture of
PROTECT vendors and business associates, and other areas of
concern. By evaluating risk across a healthcare
HEALTHCARE organization periodically to proactively identify and
DATA mitigate potential risks, healthcare providers and
their business associates can better avoid costly data
breaches and the many other detrimental impacts of
a data breach, from reputation damage to penalties
from regulatory agencies.
9. BACK UP DATA TO A SECURE, OFFSITE
LOCATION
Cyberattacks can expose sensitive patient
Security of information but they can also compromise data
health data: integrity or availability – look no further
than ransomware for an example of the impact these
HOW TO incidents can have. Even a natural disaster impacting
PROTECT a healthcare organization’s data center can have
disastrous consequences if data isn’t properly backed
HEALTHCARE up. That’s why frequent offsite data backups are
DATA recommended, with strict controls for data
encryption, access, and other best practices to ensure
that data backups are secured. Offsite data backups
are an essential component of disaster recovery, too.
10. CAREFULLY EVALUATE THE SECURITY AND
COMPLIANCE POSTURE OF BUSINESS
ASSOCIATES
Because healthcare information is increasingly
transmitted between providers and among covered
Security of entities for the purposes of facilitating payments and
health data: delivering care, a careful evaluation of all potential
business associates is one of the most crucial security
HOW TO measures healthcare organizations can take. These
PROTECT clarifications and changes including:
Third-party applications and services such as Google
HEALTHCARE Apps are considered business associates when those
services or apps are used to maintain PHI. In such cases,
DATA the third-party service would be considered a business
associate, and therefore, a contract would be required.
Any subcontractors who create or maintain PHI are
subject to compliance regulations. This change alone
has a substantial trickle-down effect and is a serious
consideration for all healthcare organizations.
Technological security tools are essential components of
modern distributed health care information systems. At
the highest level, they serve five key functions:
1. Availability—ensuring that accurate and up-to-date
Potential information is available when needed at appropriate
places;
technical 2. Accountability—helping to ensure that health care
providers are responsible for their access to and use of
approaches information, based on a legitimate need and right to know;
3. Perimeter identification—knowing and controlling
to health the boundaries of trusted access to the information
system, both physically and logically;
data privacy 4. Controlling access—enabling access for health care
providers only to information essential to the performance
and security of their jobs and limiting the real or perceived temptation
to access information beyond a legitimate need; and
5. Comprehensibility and control—ensuring that record
owners, data stewards, and patients understand and have
effective control over appropriate aspects of information
privacy and access.
Thank You!