Integrators serving the healthcare industry must help institutions combat a variety of cybersecurity challenges, and the threats continue to grow and evolve.
Hospitals are particularly vulnerable to data breaches and ransomware attacks because of the high value of healthcare data. In addition, most doctors and hospitals now use electronic prescribing, which is vulnerable to theft and fraud.
Clearly, patient safety and data privacy come first, but at the same time, administrators are under intense cost pressures that can only be alleviated by improving operational security and the efficiency of clinical workflows.
They have some catching up to do. The American Medical Association reports that 8 in 10 doctors have experienced a cyberattack of some type in their practices. Meanwhile, healthcare organizations are also struggling to comply with regulatory frameworks for security. Aberdeen reports that only 61 percent have successfully complied with regulatory frameworks pertaining to personal health information (PHI) and GDPR, and the Department of Health and Human Services’ Office for Civil Rights (OCR) revealed in its second round of HIPAA desk audits in Sept.2017 that 94 percent of healthcare organizations had inadequate risk management plans, 89 percent were rated as inadequate on patients’ rights to access their PHI, and 83 percent had performed inadequate risk analyses.
Integrators can help healthcare organizations solve these challenges, and trusted identity solutions should be one of the tools. They enable a holistic, end-to-end approach to identity and authentication that spans multi-factor authentication, credential management, digital certificates and physical identity and access management (PIAM).
Today’s comprehensive solutions strengthen security while making it easier to comply with regulatory mandates aimed at protecting patient information and the integrity of healthcare delivery in a digital world. They also facilitate a more connected and efficient hospital in the Internet of Trusted Things (IoTT), and open the door to using big data and machine learning in ways that will fundamentally change how healthcare institutions operate, manage risk and deliver care and other services.
The Compliance Challenge/Opportunity
Trusted identities streamline regulatory compliance in two key ways. First, they enable physicians to complete an authentication process in compliance with the HIPAA Security Rule aimed at protecting patient health information. Additionally, they are used to comply with the U.S. Drug Enforcement Administration (DEA) mandate for a separate two-factor authentication when using electronic prescribing for controlled substances (EPCS) solutions – a key weapon in the opioids battle.
Rather than addressing these authentication requirements separately, administrators can cut costs by moving to integrated systems that extend multi-factor authentication across the entire identity and access management lifecycle.
Integrated systems can also elevate trust through digital certificates and signatures and signing backed by public key infrastructure (PKI) security. They can incorporate One Time Password (OTP) tokens and biometrics to comply with EPCS regulations. The same systems can also be used to protect patient records and data, implement secure access to facilities, and authenticate remotely to VPNs using mobile devices.
Truly converged access control will ultimately consist of a single security policy, one credential, and one audit log – and deliver an improved patient experience, more comprehensive security view and more coordinated approach to privacy protection. The goal is a fully interoperable, multi-layered security infrastructure that is based on a flexible and adaptable platform which enables hospital administrators to preserve investments as they grow, evolve, and continually improve their security capabilities.
The Power of Convergence
In much the same way that users are gravitating to mobile solutions, in part, because they like how it interconnects their digital world, so too are healthcare institutions embracing the combination of physical and data security onto a single credential. Users want to do far more with their trusted identity credentials than just open doors, especially when they also must access healthcare records, EPCS systems and other hospital systems many times each day.
Healthcare institutions are among the first to harness the power of converged credentials. Many are using a cloud-based model to provision IDs, perform authentication for physical and logical access control, and manage EPCS systems. The next step is to pull everything related to identity management into a unified system capable of granting and managing access rights.
The convergence trend will drive the adoption of PIAM software to unify identity lifecycle management by connecting multiple and disparate physical access control systems (PACS) and IT security systems to other parts of the IT ecosystem such as user directories and HR systems.
PIAM software becomes the hub for all these systems while also tying in key external services for running background checks or verifying the identities of visitors and others. A single PIAM solution standardizes identity management for employees, contractors, visitors, suppliers, tenants and vendors, enabling organizations to manage all identities and issue credential across all buildings, systems, permissions and associated workflows, regardless of the underlying access-control system at any given location.
Visitor management is a particularly important element to consider when assessing hospital security – ideally, hospitals should integrate visitor management software with real-time patient feeds, preregistration information and the hospital’s access control system, and then use PIAM software to standardize identity management while tying in external services.
PIAM software also enables PACS to connect to cloud-based card issuance systems and wireless locks, and to location-based services that enable healthcare institutions to know where people and assets are in the building. This improves efficiency and security while facilitating new IoT use cases that connect the world of people with the world of things.
Protecting the Connected Hospital
Today’s real-time and proximity-based location technologies create a trusted environment for connecting, monitoring and managing patients, mobile clinicians and staff. They include a cloud service, portals and Bluetooth beacons in the form of smart cards while providing a one-card solution for both indoor positioning services and physical access control.
The cloud-based model and minimal hardware requirements reduce total cost of ownership while creating RMR for the integrator – installation simply entails plugging in AC-powered BLE/WiFi gateways and then providing personnel with the smart card beacon.
A big benefit of location-based services is the deeper analytics they provide for optimizing usage of facilities, common areas and individual exam and other rooms, as well as workflows in emergency departments and clinical operations. Proximity-based services verify when personnel are nearby a given area for use cases such as monitoring staff check in and check out, and help organizations meet health and safety regulations by monitoring room occupancy.
Location-based services also can include visitor awareness capabilities to achieve a complete solution for checking in visitors, running background checks, managing identities and issuing credentials. They also provide wayfinding support and historical information about where visitors and other people have been should there be an emergency, security breach or theft. They also can help staff to more efficiently manage physical assets, including quickly locating critical medical equipment, beds, crash carts and other medical devices.
Another emerging IoT trend is the use of digital certificates to secure hospital assets such as IP-based video surveillance cameras that, until now, were vulnerable to hackers. Embedding digital certificates into these items provides a way to authenticate them and to encrypt the data traffic flowing between them.
For home healthcare, the combination of NFC tags, mobile apps, cloud authentication services and web applications simplifies “proof of presence” by making it easier to document the time, location and accurate delivery of prescribed care.
Reducing Risk While Spurring Innovation
One of the most promising weapons in the fight against healthcare fraud, malware and data breaches is real-time risk profiling technology that protects against both established and recent threats that target users both online and on mobile devices. They offer a highly promising way for hospitals to detect phishing, malware and fraudulent medical or financial transactions, and prevent medical account takeovers and session stealing.
Another big trend is the emerging ability to connect, on a very broad scale, the existing PACS infrastructure to the cloud and IoT while also enabling it to be leveraged as a common, open hardware platform upon which innovative new trusted healthcare solutions can built, delivered and managed.
Demand is rising to use trusted identity solutions in the cloud and benefit from its many advantages including ease of solution deployment, flexibility, connectivity options and productivity advantages. Cloud-based platforms will provide the backbone for adding new and emerging technologies while improving how identity solutions are delivered. Another benefit of the cloud is that it creates the opportunity for integrators to offer new managed services.
Healthcare organizations are racing to plug gaps in their cybersecurity defense while shoring up compliance processes and procedures. They will increasingly rely on integrators who can help them develop and deploy a seamless trusted identity management experience that defends against threats while streamlining compliance and ushering in exciting new connected health capabilities, from the hospital to the home.
Sheila Loy is Director of Healthcare and Insurance - Identity & Access Management for HID Global. Request more info about the company at www.securityinfowatch.com/10213866.
