Download the entire August 2010 issue of InformationWeek Healthcare, distributed in an all-digital format (registration required).

Many large healthcare organizations have been securing electronic health records for years. But now, industrywide adoption will include providers of all shapes and sizes—most of which don't have chief security officers, compliance specialists, CIOs, or even full-time IT staffs.

Helping them secure their electronic records is an unprecedented challenge. The products and technologies needed are available, but the trick is in getting all providers to understand what's required, prepare physicians and staff, and tap into the appropriate expertise.

The Health Insurance Portability And Accountability Act, or HIPAA, requires that EHRs and the data in them be guarded throughout their life cycles. Risk assessments must be performed and access privileges determined. You'll need policies to secure all possible points of data leakage, including desktops, servers, databases, mobile devices, and the Internet.

In short, you must protect data at rest and in motion, and prepare for the inevitable breaches.

Creation And Use

When a patient walks into a provider's office for the first time, the terminal at reception must be hardened, hosted on a trusted network, and continually scanned for viruses and malware. Receptionists should be able to add basic patient information but have limited access to executable files.

Access privileges should be assigned that strictly regulate employees' ability to view, enter, edit, and delete data based on what they need for their jobs. For example, billing personnel don't need to see the results of the medical tests that they're charging patients for.

Attending physicians should use unique credentials to access the EHR application to record diagnoses. E-medical records must be signed with electronic signatures, which include PIN codes and are saved in encrypted files. Signatures verify that information has been reviewed every time a physician signs off on an EHR. They also let the medical staff sign off on records from any location, expediting processing, reducing workflow costs, and maintaining HIPAA compliance.

Strategy Session

Securing EMR Systems

Become an InformationWeek Analytics subscriber: $99 per person per month, multiseat discounts available.

Subscribe and get our full report, "Electronic Medical Records Secured"

This report includes action-oriented analysis, including:

• Where personal health record portals fit in
• How to handle change management issues
• Secure EHR system costs for a three-provider practice

Get This And All Our Reports

InformationWeek has published an in-depth report on this year's Healthcare Information and Management Systems Society conference. This report offers the best healthcare IT advice, insight, and analysis coming out of that conference. Download the report here (registration required).