Question
What are security best practices for telehealth?
Answer
I want to highlight first that there are security best practices that you should do, regardless of telehealth. Especially because telehealth is something that you are considering, you can do four things that will greatly lower your computer's risk of infection, which supports good secure telehealth.
Follow Security Best Practices
- Keep software updated
- Install turn on antivirus software
- Keep data encrypted
- Use two-factor authentication
Number one, ensure that the software on your computer is up to date. That it has all the patches installed that it can have. This is becoming a little bit easier in some cases. For example, on Windows iPhone, you can turn on automatic updates. This means the device will check for you to see if there is an update and install it automatically. You do not necessarily have to look for updates all the time. It is free. It is a load cost it requires very little expertise. That is often something I hear from health providers I do not have time, I do not have money, I do not have expertise. Software updates all four things on the screen are low cost, low time, and low expertise required.
Check the software on your computer. Make sure it is updated. This is not only about the operating system, Windows, and Zoom. Is your Zoom client up to date? Whatever software you use is a potential way an attacker could take advantage of unsecured software. Attackers love software that is not patched. If we use old, outdated software that is a very common mechanism for attackers to try to access our devices, the highly patched well, secured software is much more difficult for them. It is very easy for you, very difficult for them. That is an excellent combo in your favor.
Number two, ensure you have installed, enabled turned on the antivirus software on your computer. Antivirus these days is very effective at helping mitigate problems if they happen. If we accidentally visit a website that tries to attack our computer, the antivirus is one way to detect and block that kind of attempt automatically. We have to make sure it is installed. We have to make sure it is turned on. There are some free antivirus options. Windows has a built-in firewall called Windows Defender. Windows Defender is free again. As long as it is turned on, it will provide you with a level of protection. If you work for a company, ensure they have also considered the paid services. In some sense, you get the protection you pay for. Any antivirus is better than no antivirus. Make sure that that is turned on.
Number three is another HIPAA requirement, which is to keep data encrypted. We discussed picking end-to-end encryption for your telehealth software a few slides ago. We also want to ensure that the files and the data that live on our devices or in our cloud storage are encrypted. If heaven forbid, somebody should steal our information. We want to help limit the availability of the attacker to read the information. Making sure that it is encrypted helps that goal. You can turn on BitLocker encryption in Windows with just a few clicks. You can probably Google this and figure out how to do it on your own. It is transparent to you. The hard drive where the files stored locally on your device exist is automatically encrypted. You never have to do anything. If the device is lost or stolen, the person who steals that data cannot read it. It is all scrambled. Turning on data encryption is a HIPAA requirement. Relatively easy to do and certainly supports good telehealth.
The last thing I want to advocate here is using two-factor authentication, sometimes called multi-factor authentication. By Microsoft's estimate, multi-factor authentication could block 99.9% of account compromises. If the attacker steals your password or guesses it, they do not have the code that goes to your phone or another second factor. Then they still cannot get into your account. Our accounts are the lock that goes to much-protected information, whether email, social media, cloud storage, EHRs, or anything. It is worth the extra 30 seconds it takes to use two-factor to ensure that that is turned on everywhere possible for your accounts, particularly those like banking, email, and EHRs. That provides excellent protection for you in general. It is good cyber hygiene. It also helps protect telehealth.
This Ask the Expert is an edited excerpt from the course, Cybersecurity for Telehealth, presented by Josiah Dykstra, Ph.D.