There is a growing trend in using Electronic Medical Records in all advanced hospitals. EMR has provided tremendous advantages in keep track of patient health records. As technology has advanced so is the threat to exploit this highly sensitive data has grown exponentially. Data breaches in Healthcare industry has seen steep growth. To protect highly sensitive data traditional approach is not sufficient. Defense in depth approach is essential to protect against data breaches, as each layer offer unique protection mechanism.
Data Protection Mechanism
Standard approach to Data Protection are
Backup of the data
Access control on the data
Governance of the data
Protection of the backup data by encrypting the backup copy
Encryption of data while it is as rest to protection against drive theft
Each of the approaches has the direct impact on protection level of the data. All EMR data must be backed up and encrypted. Encryption provides the extra layer of security against physical theft. Apart from backing up the data, it must be sent off site or tape out. An offsite copy of data protects against any tampering of data, a practice usually observed by Ransomware attacks.
Access control on the data
Security controls on who can access the data, when she can access the data and why needs to access the data must be reviewed against all the highly sensitive data. Access to data must be logged for Auditing purpose. Any abnormal access of the data even by unauthorized personnel must be alerted. Examples of access control could be restricting access to files and folders to authorized personnel during particular time only. Complex password policies with password histories must be enabled. Single sign-on or biometric authentication solution can be a solid safeguard against unauthorized usage of the system. While data is accessed over networking, it must be guaranteed that data passes using encrypted channel e.g. SSL
Prevention Against Data Breaches
Data breaches could occur via end points. Antivirus and URL filtering is the must, but it is not enough in today world. The majority of attacks occur via the web browser in the form of Malware and Malvertising Servers and application must be patched periodically. Any vulnerability on the system provides an easy method for exploiting it and infecting the servers. Mail hygiene is another critical element which can guard IT system and filter all email attachment reaching in your inbox Admin privileges can create a disaster if Exploiting Kit finds a vulnerability in an application and implant malicious code. Limited privileges will safeguard against these attacks spreading across the systems and restrict the damage it could cause with admin privileges. Group policies could be used to restrict device access, restriction on USB access, disabling serial ports, camera on laptop must be a part of the security framework.