APMA News - July/August 2017 - S3

SUPPLEMENT TO APMA NEWS

YOUR APMA / PAGE 3

DATA BREACHES: PROTECT YOURSELF AND YOUR PRACTICE
By Michael Brody, DPM

How can you protect yourself from a data breach? There
are a number of steps you can take in your practice to
minimize the probability of experiencing a HIPAA breach.

Know where all of your computers,
laptops, backup devices, and all other
devices that may contain patient
information are at all times.
STEP 4: MONITOR YOUR DEVICES
*

STEP 1: KEEP YOUR TECHNOLOGY UP TO DATE
*

Make sure each and every computer in your office, including your
servers, has up-to-date antivirus software running.
Make sure you keep up with all security patches released by your
software vendors, including the software updates provided by the
vendor of your operating system.
If you use wireless networking, make sure you have the best possible encryption on your wireless network.
Have a properly configured firewall between the computers in your
office and the internet, including changing the default password on
your firewall from "password" to something more secure.

STEP 2: ENCRYPT YOUR DEVICES
*

All data stored on drives (data at rest) must be encrypted. This
requirement includes the hard drives in computers, fax machines,
printers, and scanners. Backup devices must also be encrypted.
Backup devices include:
- USB drives;
- removable hard drives;
- tapes; and
- CDs/DVDs.

STEP 3: COMMUNICATE WITH YOUR VENDORS
*

If you use a cloud-based EHR, contact your vendor(s) and ask
for written documentation on their current security procedures to
protect your data.

Know where all of your computers, laptops, backup devices, and
all other devices that may contain patient information are at all
times. A missing device that has patient information is considered
a breach of patient information.

This step brings us to the issue of patient information that may be
stored on smartphones. Smartphones have direct data connections
to the internet:
* They are not protected by firewalls
* They do not have antivirus software
* They are not encrypted (password protection is not encryption)
There are various encryption methods available for Windows and
Unix computers, but devices like smartphones have lagged behind.
I strongly recommend that doctors and staff not use smartphones
to store patient data of any type, including clinical images, even if the
device is encrypted. If your smartphone is encrypted and it is lost,
the person who finds the phone will not be able to access the data
on the phone. But, if you have entered your PIN on your phone, the
information is effectively decrypted, and any rogue software on your
phone will be able to expose that information to the internet. If you
need to take clinical photographs, use a digital camera connected
directly to your computer.
Never use the USB port on your computer to charge your smart
phone. You may have noticed that if you plug your smartphone into
your computer, your computer will discover and communicate with
the smartphone. Once this process has happened, it is possible that
a direct connection has been established from your computer to the
internet through your smartphone. This direct connection bypasses
all of the security measures put into place to protect your computer
network. Plugging your smartphone into your computer unlocks and
opens the back door to your patient data, placing you at significant
risk of a data breach.

Are you interested in volunteering your time for your
profession and serving on an APMA committee?
Submit your request to President-Elect Dennis Frisch,
DPM, by September 1. Send an email noting your
committee(s) of interest and your current CV to Dr. Frisch
at drfrisch@apma.org AND Stephanie Simmons, APMA
senior executive administrator, at srsimmons@apma.org.

Table of Contents for the Digital Edition of APMA News - July/August 2017