Whether you’re a curious patient or are ready to graduate with an online BSN to DNP PMHNP, it’s important to understand the need for medical data security. If you’re not in the industry, the array of regulations, products, and best practices that ensure patient data remains private and secure may seem overwhelming and unnecessary, but those with experience in the field, or even in cybersecurity generally, will confirm that it’s far from overkill. Encryption, authentication, and secure applications and networks are the cornerstones of keeping any type of data secure, and they are all required and made liberal use of by any practice entrusted with the well-being of the public.
Encryption
Encryption is a broad term for a wide array of techniques that serve to obscure sensitive information from comprehension by any party that might intercept an attempt to transmit it. The practice of cryptography can be dated back as far as ancient Egypt. While the principle of modern technology is the same, the digital encryption used in modern cybersecurity might be more directly traced to the rotor machines used by militaries to scramble communications transmitted via telegraph beginning in WWI. Invented first by American Edward Hebern in 1917, and quickly duplicated and improved upon by Arthur Scherbius as the infamous German Enigma machine, these early mechanical contraptions used systems of rotors to substitute characters for one another to obscure messages. The recipient would need to use the same machine to reverse engineer the cipher in order to decode and read the message, as the rotors enabled a dynamic substitution of characters that prevented the use of a simple key to decode the encrypted messages.
Modern encryption systems preserve this principle, but take it to an extreme made possible only by the wonders of high-frequency, high-density transistors on modern silicon computer chips. The global standard for high-security encryption, AES-256, used a 256-bit key to transmute the input data by breaking it into a series of tables and mixing up the characters. You can visualize how this process works by imagining a string of text having each individual character swapped with a predetermined substitute, placed on a side of a giant rubik’s cube, and then having the rubik’s cube completely scrambled. The patterns used to substitute and scramble the characters are separated from the message itself, and are stored in a separate file known as the key, which can be used to unscramble and re-translate the encrypted message.
The Health Insurance Portability and Accountability Act, or HIPAA, is the American system and now the global golden standard for data security in the medical industry. Originally passed in 1996 but updated regularly to ensure compliance with modern standards, HIPAA outlines guidelines for data privacy and protection that must be undertaken by healthcare providers. HIPAA compliance requires that data is encrypted when being transmitted and at rest. That means that medical data needs to be secure even when it’s simply sitting within the system in which it was recorded.
In order to accomplish this, security keys must be stored in separate partitions or modules from the data itself, and are themselves encrypted. In modern systems, this is often accomplished using a Trusted Platform Module, or TPM, an onboard module programmed to only output its keys when provided with a specific password. Keys can also be stored in separate hardware, like a key card or USB drive. Regardless of which method of separating the key from encrypted data is selected, it’s important that the two never be combined unless the person attempting to do so is authorized to manage that data.
Authentication
These mechanisms for limiting access to the keys used to encrypt and decrypt messages require some form of verification that the person requesting access to them actually should have that access. This is referred to as authentication. At this point, we’re all familiar with the 4-6 digit numbers we pull from emails, text messages, or authenticator applications, and as much of a pain as they are, they’re absolutely necessary in ensuring that encrypted data can only be accessed by those with a legitimate reason for having it. Medical information is some of the most sensitive data that we have, so carefully limiting who has access to it is vital.
HIPAA requires two factor authentication be implemented in any system storing customer data. Authentication applications are often considered the most secure, as the systems they use to generate one-time tokens utilize encryption keys stored on Trusted Platform Modules, which are much more difficult to fraudulently duplicate than hardware proximity keys since they do not emit radio frequencies that can be captured by devices like radio frequency identification device copiers, and are more difficult to intercept than emails or text messages. They also have the added benefit of being not only guarded closely by their holders by default as a result of being located on the user’s valuable personal smartphone, but are also normally behind a PIN code assigned by that user. But no matter what form of authentication is employed, it is only as secure as the system it interacts with.
Secure Software and Hardware
The systems that medical data is stored on also have to meet exacting specifications. Software systems managing patient data must encrypt data at rest, and require authentication. They must also be tested against potential vulnerabilities that might be used to transmit or intercept data before it is encrypted (e.g. while it is being entered or retrieved), including memory safety testing. Hardware systems, including the computers and networks that patient data is stored and transmitted on, must remain up to date and be audited regularly to ensure that their built-in mechanisms for resisting hacking retain their integrity.
As a result of these lofty requirements, cloud-based systems managed by large multinational corporations are increasingly preferred as a result of their ability to take advantage of their vast scale to drive down the costs associated with producing the high quality, high security systems needed for storing medical data.
Best Practices
The most likely way for a security breach to occur is not actually hacking or any other form of fancy technological engineering — on the contrary, social engineering is a much more common source of breach. Employees granted access to sensitive patient data must undergo training on data security best practices to ensure that they are aware of the risks and the stakes inherent in the work they are engaging in, and to ensure that they follow best practices including not granting others access to their mobile phone or personal computer if it contains sensitive information or authentication methods to systems containing sensitive medical data. There are also strict hiring requirements that must be followed by medical organizations to ensure that people likely to commit any sort of crime don’t have exposure to sensitive data.
All of these pieces need to come together to ensure that sensitive patient data is protected. While the standards for technical requirements are high, they are nearly useless if the people operating and maintaining them aren’t aware of their responsibilities. At the end of the day, all of the fancy high-tech systems in the world can’t protect data from carelessness.
