Lecture Materials for the John Wiley & Sons book: Cyber Security: Managing Networks, Conducting Tests, and Investigating Intrusions October 7, 2015 DRAFT1 Chapter 13: Healthcare Information Technology Security

HIPAA Health Insurance Portability and Accountability Act (HIPAA) is part of the American Recovery and Reinvestment Act (ARRA) – A US Federal Law HIPAA defines Protected Health Information (PHI) –Including: name, locations, dates, phones/fax, addresses, Social Security numbers, medical record numbers, insurance plan numbers, accounts, licenses, vehicle numbers, URLs, IP addresses, biometrics, portraits, and other identifying informationf HIPAA establishes penalties and notification requirements in case of data spillaage 10/7/2015 DRAFT2 Cyber Security: Managing Networks, Conducting Tests, and Investigating Intrusions

Healthcare Risk Assessment Required by HIPAA Risks must be identified along with restricted data –Risk mitigation plans must be formulated and put into action Internet perimeter security alone is insufficient in healthcare –See Hard on the Outside, Gooey in the Middle in Chapter 2 Need to know is a key risk principle 10/7/2015 DRAFT3 Cyber Security: Managing Networks, Conducting Tests, and Investigating Intrusions

Healthcare Records Management Laptops and mobile devices are increasingly used and pose significant risks Records retention policies must be rigorously designed and implemented HIPAA makes this easier because Federal law trumps weaker state laws Retention times vary, typically 7 to 10 years –Vital records and surgical records must be retained indefinitely 10/7/2015 DRAFT4 Cyber Security: Managing Networks, Conducting Tests, and Investigating Intrusions

Healthcare IT and the Judicial Process More than 1,000,000 patients in US affected by PHI losses every year Support for medical court case is a key data management requirement If records are retained too long they pose a potential liability is a major risk because they are e- discoverable, and were considered private when they were composed Once a record is discovered its records lifecycle (i.e. retention policy) is suspended 10/7/2015 DRAFT5 Cyber Security: Managing Networks, Conducting Tests, and Investigating Intrusions

Data Loss Prevention (DLP) DLP is shifting focus from finding restricted data on servers to mobile devices Mobile devices are subject to physical loss and cyber attack from the Internet Encryption is essential on mobile devices and storage media (thumb drives, CDs, DVDs, removable hard drives, and tape backups) Clear data transfer policies should be established 10/7/2015 DRAFT6 Cyber Security: Managing Networks, Conducting Tests, and Investigating Intrusions

Managing Logs in Healthcare Organizations Healthcare organizations should create detailed logs across all forms of devices –Clocks should be synchronized Logs should be normalized and centralized for analysis and retention Logged events should indicate: what occurred, where, when, with what information Logs should support non-repudiation Logs should be handled with a formal chain of custody supporting judicial processes 10/7/2015 DRAFT7 Cyber Security: Managing Networks, Conducting Tests, and Investigating Intrusions

Authentication and Access Control Role based access control (RBAC) is usually not flexible enough for healthcare –Certain users may assume many roles: document, executive administrator, patient One shared account always logged in was standards practice –Now that data is life critical, individual accountability must be tracked and logged Password-based authentication is being replaced the multi-factor Usability is a critical issue, Single Sign On is one solution 10/7/2015 DRAFT8 Cyber Security: Managing Networks, Conducting Tests, and Investigating Intrusions

REVIEW CHAPTER SUMMARY Cyber Security: Managing Networks, Conducting Tests, and Investigating Intrusions 10/7/2015 DRAFT9