Health informatics security consists of protecting an individual’s medical information throughout the end-to-end cycle of patient care, ensuring authorized access, use, and modification for confidentiality and availability. The main threats and challenges to health informatics security include cyberattacks, the patient care cycle, collaborative parties such as medical practitioners and insurers, and access devices. Data breaches and unauthorized access lead to legal and financial implications, loss of trust and reputation, and risks to patients in the event of altered or inaccessible information. Ensuring data security to meet the needs of patients and collaborators requires a series of measures, including regulatory frameworks, internal security measures, and strict access controls.
Different health institutions and collaborative partners have varying capabilities, capacities, and knowledge regarding data security. However, the need for privacy should be a priority regardless of the status of the party handling the data at any given time. The United States Department of Health and Human Services has several robust agencies and institutions that provide standardized guidelines on best practices and adherence policies. One of the most dominant, the Health Insurance Portability and Accountability Act (HIPAA), mandated in 2003, sets standards and rules to protect an individual's personally identifiable health information, especially medical records transmitted electronically.
HIPAA safeguard guidelines apply to health care providers, clearinghouses, and insurance payers, and cover the administrative, technical, and physical handling of medical information. Further, HIPAA, through the Breach Notification Rule, requires relevant parties to notify affected patients, the Federal Trade Commission, and, in some cases, the media in the event of a mass medical data security or privacy breach. Other notable entities mandated to protect medical information include the Centers for Medicare & Medicaid Services and the Office of the National Coordinator for Health Information Technology.
Health institutions and collaborating partners in patients' health care should invest in robust internal systems to ensure medical data security and privacy. Health information exchanges provide a platform for the patient care collaborating team and the patient to share records. Typical installations include physical, administrative, and technical measures. Common physical requirements for data security and privacy include hardware and software, data centers, and access and transfer tools such as smart devices and portable drives.
Administrative measures include staff training on system use, policies, and the importance of adherence, as well as scheduled and unscheduled checks to assess system readiness and evaluate risk management protocols. The technical aspect relies on staff capabilities and available physical installations. Medical data typically requires encryption and storage in secure cloud-based electronic health record systems to limit access and interception, and to optimize interoperability in accordance with HIPAA recommendations. However, in some cases, some institutions, especially in remote areas, still require physical paperwork for recordkeeping.
Access control is also important in data security and privacy. Data trails, especially in chronic conditions, tend to be long, which attracts numerous unauthorized access loopholes. HIPAA mandates continuous data access control, with checks and periodic reviews to gauge effectiveness. Some common access control methods include multi-factor authentication, biometrics, role-based access control, attribute-based access control, and discretionary access control. However, access control via official channels may be compromised when patients have the information on their personal devices. In such cases, data breaches are beyond the liability of the health care practitioners and collaborating parties.
