Security for Your Medical Centre – Part 2

Statistics of IT Security Threats

This article is a continuation of Security for Your Medical Centre – Part 1. We will discuss various statistics related IT threats and security concerns. This article points out clearly the importance and significance of securing your IT infrastructure. Do not hesitate in any way from ensuring proper security measures, as not doing so can lead to damage and theft of your medical data.

Phishing Scams

Phishing scams come under social engineering attacks. They provide a fake e-mail or website that looks like an authentic one and tricks you into putting your username and password. Once they capture your username and password, they now have access to your bank account or whatever website they are pretending to be.

A disputed study by Trusteer showed that spear phishing a hundred LinkedIn users resulted in a failure rate of 68%. That would mean that around 30% of those targeted with phishing attempts disclosed their personal data. That is significant enough for medical centres to lose a substantial amount of money once their bank account information has been captured.

Cnet interviewed Michael Barrett, chief information security officer at PayPal (online payment processor) in April, 2011. This is what he had to say regarding the question of PayPal’s weakness to phishing attempts:

“I joined PayPal almost exactly five years ago and it’s fair to say the company had not realized at that point the true significance of phishing. But since that time we’ve put in place a number of defenses against it. It probably will never go away completely as a problem, but it can be substantially minimized. We’re at No. 8 on a list of most phishing sites, which is better than being No. 1. I’m not satisfied with being No. 8 and I’d really like to obliterate the crime completely, but I realize that will take another five years to get to that state. A few years ago we started digitally signing all our outbound e-mail and we worked with Yahoo and Google so if they saw e-mail that purported to come from us but wasn’t signed they would block it. That has been stunningly successful. Now we’re trying to get the whole industry to take up that type of approach. But it will take several more years of pushing to get the rest of the industry to do that.” (1)

Malware

Malware is software that is damaging to your computer in various ways. Spyware is a type of malware that infects a computer and relays information of your computer use to different parties.

In 2007, Kaspersky Labs was seeing new malware samples every two minutes, but in 2010, just three years later, that had increased to one new sample every two seconds.

This is what InformationWeek has to say about small organizations and virus threats:

“Small organization respondents’ other top concerns were Trojan applications (60%), malware designed by criminals expressly to steal data (59%), data leaks (56%), spyware (55%), and fake AV (52%). Spam and phishing threats ranked lowest. Most of today’s antivirus software suites protect against many viruses and worms. But when it comes to data-stealing malware, 21% of small U.S. organization respondents said that their IT department could do a better job of protecting end users. Notably, only 47% of small organizations install security software to help stop such malware, 30% offer related security policies, and 28% provide relevant education or guidance.” (2)

Some are touting Cloud resources as the answer to fighting back malware spread. That remains to be seen.

Security Breaches – Hacks

It’s interesting to note that organizations attribute 59% of all security breaches to human error. This can occur if the network administrator has failed to set up the proper security barriers, or it can occur by inadvertently giving our information that a hacker can use to compromise the system.

About half of all organizations consider IT security a top priority. This stat indicates two scenarios. One, namely that there are pockets of IT infrastructures that don’t need high security. Perhaps these are small organizations and medical centres that have a wireless network setup, and they don’t see themselves as a potential target from hackers. The network is small and their data isn’t all that critical. The second is that IT security is seen as a big issue for larger organizations. They have important data that cannot be leaked and as such they are prime targets for hackers. Hackers use stolen company data to sell to competitors and it is quickly becoming a lucrative business. Larger organizations need security for their systems and that entails purchasing the right equipment and having it administered properly.

The cost of an individual data breach – including lost business and the burden of responding to the incident – in 2010 increased 13% year-over-year for U.K. companies. That roughly equals $3 million for each breach, which is quite substantial. Needless to say, every organization, small or big, should pay close attention to its IT security needs.

Viruses

Medical centres still fear the virus according to a new survey of 1,600 end users in Germany, Japan, the United Kingdom, and United States. Conducted by antivirus vendor Trend Micro, viruses are the leading concern for 63% of small organizations.

A CompTIA stat shows that 33% of law firms admit to experiencing a security issue such as a virus. That’s only law firms, if you total firms from other fields the number is much higher.

Conclusion

The presentation of stats and facts in this article is only intended to create an awareness of various cyber threats. Cyber security is a huge issue and should not be taken lightly.

References

(1) http://news.cnet.com/8301-27080_3-20052310-245.html#ixzz1MvDmlGv5
(2) http://www.informationweek.com/news/security/vulnerabilities/228200171

Security for Your Medical Centre – Part 1

Security is essential for any medical centre running IT systems. These days there are more threats than ever before, and to keep guard is one of the requirements for any health IT infrastructure. This series on data security measures for your medical centre entails topics such as basic terminology of attackers, different attacking methods, statistics of IT security, and how to secure your network.  There are many types and classifications of threats and we will go through some of them in this part of the series so your organization has the insight and knowledge to properly understand these critical issues.

Why is Security for Your IT Systems Important?

If your security is breached it means that your data can be stolen, altered, or destroyed. Serious issues such as the loss of privacy and theft of information can land your company in legal turmoil. It is hard to determine how secure your network should be because the more secure your network is, the less accessible are the resources on the network. Your organization has to determine the fine balance between having more access to certain network resources, but having less security, or having less access to network resources and having more security.

Security Threats are Rising

Attack tools and methods have drastically evolved and have become easier for even novice users to break through data security walls using the simplest of tools. Here is a brief look at how attacks have evolved over the years:

  • 1985: Password guessing and code replication
  • 1990: Password cracking and war dialing (calling lists of numbers to hack into phone systems, fax machines, and computers)
  • 1995: Viruses, including Love Bug, Nimda, and Code Red
  • 2000: Trojan horses such as Back Orifice
  • 2005: Worms including Blaster, MyDoom, and Slammer
  • 2010: Packet sniffing, social engineering, and phishing

Attacks that once involved deep knowledge of computer and computer systems can now be performed by entry level computer enthusiasts. This is because many of the attack tools, such as password cracking, have been simplified to the extent where even beginners can take advantage of them. Some of these tools come with easy-to-use graphical user interfaces that make them easy to understand and use for beginners. This has resulted in people committing computer crime where they previously would not have.

Terminology You Should Know

White Hat: A hacker who seeks vulnerabilities in systems and exposes them for the purpose of having them be fixed. A white hat hacker is a good guy who uses his or her knowledge to improve the security of a system.

Hacker: A computer programming expert who can use his/her computing knowledge to bypass systems. This term is usually associated with a negative connotation and generally refers to anyone who bypasses security systems.

Black Hat: A hacker who gains unauthorized access to systems and uses it in a negative way. For example, one who steals information for monetary gains or compromises systems with a malicious intent.

Phisher: A person who sets up fake links to websites and dupes people into giving their personal information, such as passwords, and then uses that information for personal gain, i.e. stealing money from their bank account.

Attack Methods

There are many types of attacks and they can get confusing. A few attacking methods mentioned here are intended to give you a “heads up” on how these attacks are executed.

  1. Social Engineering: This is one of the simplest of attack methods. One simply dupes the other party into giving critical information that is in turn used to gain access. Phishing, as mentioned above, is of this classification. I have heard of companies who have had their security systems compromised simply by a phone call of a person pretending to be the president of the company, who had forgotten his/her password. The employee on the other end believes it is the actual president and offers him/ her access to the computer systems. This attack can be mitigated by constructing and following a security policy for your company.
  2. Viruses: These little pieces of software code can do a lot of damage to the integrity of your computer systems. These codes are written to infect computer systems and to either render them useless or take over the systems. Some of them ask for money in return for leaving the system unharmed. I would include worms, Trojan horses, and malware in this category as well. This attack method can be mitigated by using an up-to-date virus scanner.
  3. Password-cracking: One of the most used password-cracking methods is known as Brute Force. Basically this techniques cycles through different combinations of characters hoping that eventually it will get the right combination and break through the system. It is always recommended that the password you set should be a “strong” password, meaning that it should contain small and large letters, numbers, and unique characters, such as “$”, “@”, or “&”. Setting a strong password will hinder the brute force method.
  4. Sniffing: This method commonly refers to the ability of the hacker to “listen” in on network traffic and thereby discover the passwords. This can be easily accomplished by using network tools (i.e. WireShark) to drop in on computer conversations on the network and capture the usernames and passwords. There are many other techniques that allow the hacker to gain access, such as the man-in-the-middle technique that places the hacker in the middle of the conversation of two network computers, and then the hacker is able to intercept the username and password to gain unauthorized access.

Data Security for Your Medical Centre – Part 2
The next article in this series takes a look at the statistics of IT security.

Managed Services for Medical Centres

IT Support System

Medical clinics running on IT infrastructure need certain support systems that can allow them to run more efficiently and reliably. Managed services, as offered by Soulistech, help ensure that the medical centre is being monitored 24/7 and that backups are taking place, not only locally, but remotely as well.

Remote Monitoring

When a full-time IT person cannot be hired, Remote Monitoring is the next best thing. This managed service monitors the computer systems of the clinic 24 hours a day, 7 days a week. It checks for system vitals and among other things for hard drive failure, low memory, updated antivirus, etc. As soon as there is a problem with any one of your computer’s services, Soulistech is notified and we can resolve the problem either remotely or through an on-site visit. Most managed service plans come with free antivirus and firewall solutions. This is great for medical centres on a budget, as they would not need to buy a separate antivirus solution every year.

Since the checks happen around the clock, it is quite possible that a problem can be detected before the clinic opens and therefore resolved in time for patients to check in the next day. Most of the time, Soulistech is notified of a problem before the clinic becomes aware of it and therefore speedy resolution of the problem can be carried out. Reporting can also be done daily, weekly, monthly, and yearly. These reports are free and can be delivered on a certain schedule. The reports indicate the availability of systems and services on the network as well as an executive summary of usage of computer vitals and services, such as CPU usage over time.

Backup Monitoring

Many, many organizations loose their data daily and have no backup plan in place to recover from the loss. This managed service of having a local and a remote backup plan is vital and crucial to all medical clinics, whether with EMR/EHR or not. Hard drives have a mean failure rate of 4 years and the longer the hard drive with the patient data runs, the more likely it is to fail. Backup monitoring not only backups up locally and remotely, but monitors the backups around the clock. This ensures that Soulistech is notified if a backup has been missed for any reason.

One of my personal experiences has been that a walk-in clinic lost their main computer with the patient scheduling data in it. When I asked for the backup, they gave me a file that was more than two years old! They had been backing up to the wrong destination, thinking that the actual backup was being done on their USB drive. Luckily I was able to extract data from the downed hard disk and restore it.

It just goes to show that backup is extremely necessary. Most clinics have local backup, but remote or off-site is equally needed to help data loss from fire or theft.

Benefits of MSPs with Soulistech

Clients who sign-on with both a Remote Monitoring plan and a Backup Monitoring plan are entered into a Partner program where they receive discounts in pricing. This helps clinics signed-on for both Remote Monitoring and Backup Monitoring get significant discount off of services.

Tablets for EMR/EHR

Portability in Motion

EMR/EHRs have various input methods like dictation, typing, scanning, and digital writing. The most convenient form factor in terms of portability and natural hand writing recognition is perhaps the tablet PC. This is so because to carry laptops, desktop computers, scanning hardware, or audio hardware isn’t very mobile. Tablets are carried in the same way a pen and pad are carried and this results in a very comfortable and natural form of using technology. Tablets are wireless in networking nature, and that adds further support to their mobility. Tablets come with rechargeable batteries that have many hours of duration, depending on the tablet model. The iPad, for example, has a touted battery life of ten hours. This includes periods of non-use. In full use, the iPad would last around four hours, which is still pretty good.

Data Structure

Although a stylus can imitate the pen, it is not a perfect fit. The touchscreen interface of a tablet, although good, is still somewhat weak on touch recognition. This leads to hard-to-read “writings” on a tablet. Some tablets are better than others. I’ve seen doctors fully utilizing their stylus with the touch recognition technology. There’s another small catch to using a tablet and that has to do with data structure. With a laptop, the notes are keyed into the EMR/EHR system and thus allows for the notes to be easily structured and search-able. Keyword searches can be made and the data entry that was performed on the computer would allow for proper indexing of the information as text. With a tablet, there are two options:

1) Use the handwriting recognition software
2) Use the “scribbles” in free-form

There are advantages and disadvantages to both forms. Using the handwriting recognition software will structure your data for indexing and easy searching, but it will slow down your writing speed as your words are carefully deciphered into readable text. If you’ve ever used a palm pilot or PDA, you would be familiar with the handwriting recognition feature. Many a times, the writing is misinterpreted into something else. For example, you could be writing “willow” and it could be interpreted it as “uuillav”. This can be very annoying.

The second option, on the other hand, allows for quick notes to be made and saves more time than having the handwriting recognition software interpret what you’re writing. It saves the touch input from the stylus as more of an image format that can be viewed later and interpreted by the doctor when viewed. This doesn’t allow for the writing to be saved as text, and is therefore not search-able or index-able. Doctors using this method are still able to read their own writing and are able to read the patient’s history that was made prior to their current visit, but the encounters are not data organized as a keyboard text entry would be.

Slate or Convertible Style?

Tablets come in two styles: a slate or a convertible style. A slate is like an iPad where there is no keyboard attached and it is held like a pen and a pad writing tablet. A convertible on the other hand has a keyboard built into it and can switch from being a tablet to being a laptop. The convertible style can be very convenient in terms of entering in data that is structured through the keyboard, as well as flipping to the slate style for jotting down free-form notes. The drawback to the convertible style, though, is that it weighs more and can be hard to carry.

EMR/EHR Implementation Models for Medical Practice

Three Types of EMR/EHR System Models:

There are three topologies that a medical practice can choose to implement. One is the SaaS model, the second is the in-house server model, and the third is a hybrid of the earlier two. Your choice in selecting one of these models will determine who bears the responsibility of data security and its retrieval if in case the EMR/EHR vendor shuts down for any reason. This article will discuss each of these models, their benefits and shortcomings.

SaaS – ASP

SaaS stands for Software-as-a-Service, and that means the EMR/EHR application is hosted at the EMR/EHR vendor site on the Internet. They maintain control of the data that is being sent from your clinic or office to their servers on some physical location far from you. This means that you would have to entrust them with your patient data. It is our advice that you get in writing everything that relates to the ownership of that data in case that vendor goes down, i.e. bankruptcy. Also note, that some vendors engage with a third-party data centre to hold the patient data. This can be troubling for the medical practitioner as there could be a legal dispute between the vendor and the third-part data centre. It is best to have all of the necessary accommodations written down before signing with an EMR vendor.

In terms of IT infrastructure needed to run a SaaS, it is not as much as having an in-house server model, although you would need to contract IT support personnel for regular maintenance. One service you will need is to have a backup Internet connection in-case your primary Internet connection goes down for some reason taking your clinic or office with it. Really important to plan for a backup Internet connection.

In-house Server

This model requires your office/clinic to run the EMR/EHR vendor software on your own servers located in your clinic or office. This model requires a lot more investment in hardware and software and nearly daily upkeep measures would need to be contracted from IT support services such as Soulistech. This option does give you the control of keeping all of the EMR data on your own site instead of having it stored somewhere where it would be hard to retrieve the data, should any emergency happen. Also, not much data is transmitted on the Internet, making this a safer choice.

With the data in your possession, it becomes incumbent on your practice to ensure proper security measures are met to withstand attacks from hackers. Again, IT services from Soulistech can help in this regard. In terms of having an Internet connection. One line is good as you won’t be using the backup line anymore.

Hybrid Model

The hybrid model basically combines the in-house server with the SaaS input method on the client computers. The EMR application runs on the client computers either through a web browser or custom application and sends all of the data to the in-house web server. Instead of sending the web browser entered data to an off-site EMR/EHR vendor, all the data goes in to the in-house server like the in-house model.

This model requires just as much IT support as the in-house server model, but gives you the control of keeping the data on-site and off-site. It keeps the off-site data to a contracted place where it regularly backs up to the off-site location. Even if the Internet is down, the EMR/EHR will continue running as usual, and when the connection is set again, it will backup and sync automatically.

IBM’s Watson and the New Medical Diagnosis

IBM’s Watson

In February of 2011, IBM set a series of Jeopardy matches between the show’s highest ranked contestants against its $100 million computer named Watson. With the ability of natural speech recognition and specialized algorithms that could parse through 200 million pages of data in under three seconds, Watson was able to defeat the top contestants with a resounding win.

Games aside, the practical medical application of Watson goes far ahead. Where once Google substituted for quick searches on symptoms and possible causes, Watson has effectively replaced that search engine approach with a question and answer based diagnosis. Its diagnosis draws on the patient’s medical records as well as other combinations of scientific data that result in a ranking of possible diagnoses.

Different Than Google

Watson’s input is in plain English and not keywords. Moreover, it draws its possible diagnoses on the patient’s medical records, history of being prone to a disease, symptoms the patient is describing, and lab results. This technology doesn’t replace a doctor at all, it only aids the doctor. Remembering all of the results of certain symptoms and disease information can be overwhelming for doctors who are mostly already over-worked and on a tight schedule. Watson helps the doctor in picking up on certain clues and suggests a number of possible diagnoses. Dr. Herbert Chase, a professor of clinical medicine in biomedical informatics at Columbia University’s College of Physicians and Surgeons, says:

“There’s a lot of memorizing involved in medicine, and if you’re memorizing, you’re not analyzing…” (1)

Cost Savings

With Watson’s incredible success rate, it can reduce time and cost of diagnosis that otherwise would take doctors months to figure out. Dr. Chase suggests that Watson could also play a role in treatment and personalized medication. Watson’s ability to consult a database of genetic information and retrieve drug combinations that relate to the specific gene’s of the patient in question, result in greater efficiency for the medical practice.

Roll Out of Watson

IBM is working with several partners in trying to have Watson’s technology ready for medical use as early as 18 to 24 months from now. Watson’s potential of integrating with EMR/EHR systems can help propel medicine to a new field.

References
(1) http://www.backbonemag.com/Magazine/2011-05/watson-ibm-supercomputer-conquers-jeopardy.aspx

IT Needs for Medical Offices and Clinics

Medical clinics and doctor offices usually have a simplified IT infrastructure model as compared to businesses. The needs of a medical clinic and office revolve around the issues of redundancy, in terms of backup, and the health of the hardware and software of the computers. In addition to this, many clinics and offices use specialized patient database software to maintain their schedules and inventory. These specialized software may be purchased from independent developers from which IT support is also required from. IT consulting companies, such as Soulistech, have a role to play here as a managed service provider (MSP) and as an administrator in taking care of the PCs and the network, something that the developer cannot offer. Some clinics and offices are upgrading their infrastructure to EMR/EHR, and as such the demand for upkeep of all of the services mentioned above is increasing.

What Are the Primary IT Needs of a Clinic/Office?

There are three primary IT infrastructure needs that a clinic or medical office has to implement. These three needs are:

1. Computers
2. Network (printers, scanners, etc. included)
3. Backup Solution

Computers

The first primary need is of proper computer implementation. Computers can be custom built to match the needs of the clinic or office, or they can be purchased from computer manufacturers such as HP or Dell. I prefer to go after hardware over looks. Most computers in medical offices and clinics are not visible to the patients. Therefore, going after fancy cases should not be a concern. What matters more are the internal components that should run smoothly and efficiently. Fancy cases sometimes pose a problem when it comes to repair as their port structure and form factor hinder easy access to components. I suggest a range of $300 to $400 for a computer (without a monitor) that should be sufficient for a medical clinic or office.

Network

The second primary need is that of the network. The network infrastructure consists of switches, routers, and peripheral devices like the printer or scanner. Cisco offers the best networking solutions when it comes to switches and routers, but D-link and HP also offer good products for less of a cost. Ethernet wiring (cables for the network to connect all of the devices) should be at the very least Cat. 5e so that it can accommodate Gigabit speeds. I would prefer Cat. 6, as needs for the future should be considered when placing a network. Some clinics and offices don’t have Internet connection. This is something that needs to be thought out as remote support options aren’t available if there is no Internet connection, and the cost of on-site support can cost more than the remote support. As for printers and scanners, a Xerox device or any HP LaserJet can do the job. Support for these devices usually come with the manufacturer for a limited time.

Backup Solution

Probably the most important need for medical offices and clinics is a proper backup solution. I’ve experienced a case where patient data had not been properly backed up for two years and when a problem hit, there was no recent backup for all of the patient data. Luckily I was able to extract the core files from the broken down computer’s hard drive and insert them into the new computer. If it wasn’t for that, that clinic would have lost crucial data that would have hurt them in many ways. I recommend on-site and off-site backup: a hybrid solution of backing up to an external drive or network share as well as backing up to the Internet, in case a fire or burglary hits. Having a backup solution that works is important and that requires proper checks. Daily checks of both the on-site and off-site backups should be done by an MSP like Soulistech to ensure proper security and availability of data.

Why is EMR Adoption So Slow?

For years doctors, clinics, hospitals, and nurses have been using the plain method of having written and paper documents for their patients’ records. This process is slow, inefficient, hard to manage, and can lead to poor health care because of its weakness to error. The solution to this problem has been the adoption of EMR – Electronic Health Record. These are digital documents linking to patients’ history that can extend several years back and have a dramatic effect on the efficient processing of patient data. With EMR, sharing of medical records and histories with other clinics and hospitals becomes easy as the records can be linked to other EMRs maintained by the other party or clinic. The sharing of such information leads to better health care as information is fast and accessible. So what’s slowing down the adoption of this great system? Let’s explore the issues around EMR.

EMR and Medical Usage

EMRs are created in a health-care facility such as a hospital or clinic. They contain patient data such as symptoms, diagnoses, and medication reports. These digital records are usually maintained in a database using SQL software or other database tools. A 2009 Deloitte survey indicated that two-thirds of Canadians want access to personal health records,

“…and 51 percent want to be able to schedule office visits, view test results, order prescription refills, find out about treatment options and check status payments securely online. And half of the survey respondents also want the ability to communicate with their health care providers by e-mail.”(1)

The benefit of inputting these records as digital is that they not only save on paper, but the records can be searched and scanned quite easily with any computer linked to the EMR system. Imagine having to go through thousands of pages to look up a certain patient’s history. This can all be made convenient with records that are computer-searchable and produce results in seconds.

“A 2007 National Physician Survey by the Canadian Medical Association (CMA) reported only 12 percent of family and general phsyicans use electronic charts, while 19.4 percent use a combination of paper charts and electronic records.” (2)

Benefits of EMR

The slow adoption can be seen with such stats as the above. The benefits have to be made clear to the physicians so that adoption of EMR increases. Saving on paper is a huge benefit of EMRs. The amount of space paper records take is sometimes debilitating for clinics to handle. Folders with patient data run into the hundreds of pages and with an increasing population, the room for such paper-rich records doesn’t exist in the office. EMRs eliminate this. All the records of the clinic can fit on to hard drives that are in expensive, and with regular backups they are safe. These backups can also be made online, such that if a fire was to result the files would also be stored off-site. X-Ray data can also be stored in the EMR and this helps save expensive film and developing costs. Doctors can view the X-Rays on their own computer.

As the cost of material is lower in EMR systems, paper records become inefficient and error prone due to poor legibility of the doctor’s or medical practitioner’s handwritten notes. This has resulted in cases where mistakes were made in patient care because of the poor legibility of the doctor’s handwriting. With EMR, errors of this nature are significantly reduced. Handwritten records are not as easily shareable with others (such as fax) because the risk of error still remains, while with EMR the database is dynamic and easily extendable to other computers outside the medical facility.

Main Reason for Slow Adoption

The main reason of slow adoption is not because it’s expensive (which it is not), or that the technology has not improved enough (it has), or that doctors are not computer literate (doesn’t require a lot of computer knowledge), but that the inputting of the data is slow. Doctors can quickly scribble down notes very fast with a pen and a pad, but to type in things into a computer takes a bit more time and time is something doctors don’t have much of. Believe it or not, but this is the main reason doctors are slow in adopting EMRs. In this case, yes, the technology has not advanced to the degree where doctors can input patient data fast; as fast or faster than writing with hand. Until we do find a way to input Doctor data in fast, EMRs may take up to forty to fifty years before complete adoption nationwide.

References
(1) Backbone Magazine: http://www.backbonemag.com/Magazine/2011-03/will-health-care-ever-go-digital.aspx
(2) Backbone Magazine: http://www.backbonemag.com/Magazine/2011-03/will-health-care-ever-go-digital.aspx

Follow

Get every new post delivered to your Inbox.

Join 402 other followers