Security and Integrity of Health Care Information Systems - Term Paper Example

? Security and Integrity of HIS (Health Care Information Systems) al Affiliation In the recent past, different fields have evolved with the evolution in technology. Informatics has been an agent of change in various fields. In the field of nursing, informatics has been introduced in order to improve efficiency. This has prompted the introduction of health information systems in healthcare. Health information systems deal with a lot of operations involved in managing sensitive medical information for different patients. Unfortunately, maintaining security and integrity of the information systems and applications is still a challenge to many hospitals and associated organizations that handle patients’ records, even after changeover to electronic storage and operations. In the healthcare industry, different stakeholders such hospitals, governments, insurance companies, pharmaceutical agencies, and the patients have various privileges to the electronic records where necessary, in order to accomplish their duties. Access to the HIS, information exchange, and disclosure of confidential data becomes prone to attack from multiple threats. This paper discusses change in the field of nursing, the use, security, and integrity of health information systems, potential threats to the HIS and EPR as identified in various researches, and their effects. It also discusses some measures to insecurity and poor integrity of health information systems. Keywords: Nursing Informatics, Healthcare Information System, Change Theory, Electronic Patient Record, Medical Identity Theft, Threats, Vulnerabilities, HIPAA, HITECH, Information Exchange, Frauds, Security, Integrity, Privacy, Confidentiality, Authorization, Authentication, Technical And Administrative Safeguards, Information Flow, Audit Logs, Healthcare Organizations, Medical Records, Business Associates, Patients, Stakeholders 1. Introduction With the changes taking place around the globe and especially changes in technology “informatics is no longer an option for nurses and other health care providers. It is a requirement” (Ball, DuLong &Hannah, 2011, p. 5). The use of computerized information systems in healthcare has undoubtedly increased the efficiency of medical record keeping, but contributed to the risk of security exposure. Sensitive personal and medical information on patients that requires privacy, risks being compromised incase of security breaches on the healthcare information systems. Protecting the healthcare information systems and data is therefore an important factor in improving healthcare quality. The increasing need for information sharing between the healthcare stakeholders (patients, providers, and payers) and the modern digital trend in record keeping create a need for better security of information. Whenever insecurity of IS exists, unauthorized access, dissemination of information, and operations on data and systems can occur, whose effect could not only affect the patients, but the healthcare providers and physicians decisions. Medical identity theft is one of the major frauds in cases of IS insecurity. Although the EHR pose various benefits to the patients, such that they can routinely review their health records electronically, it’s a fact that numerous people can view the EHR simultaneously. The systems is built on a number of compatible information technology tools, whose corruption or hacking is a lead to healthcare IS breaches. Patients’ information can be stolen for personal gains, or falsified for wrong diagnosis among other effects. Security, privacy, confidentiality, data availability, and integrity are the ethical priorities in EHR. Medical identity theft and other breaches can be detected and prevented under various procedures to secure healthcare information and IS against fraud. Several laws have been enacted and continue to be implemented ways to enforce security in healthcare IS and their content. The HITECH Act and HIPAA security rules are various government legislations that assist in securing the IS and private medical data and information. HIPAA comes with a set of privacy and security rules to aid in standardizing information transactions and ensuring implementation of administrative safeguards in information infrastructure and access. The technology also provides certain ways to support security and integrity in the healthcare sector by providing various mechanisms in system usability and data manipulation. Past research on the security and integrity of healthcare Information System reveals evidence of security breaches and opportunities caused by individuals or professionals within and outside the health care domains. Some of these behaviors are conducted intentionally and end up costing the patients lives and financial costs to the healthcare organizations and practitioners. Numerous healthcare facilities have tightened their security and invested in it to ensure their patients’ privacy and trust is not violated. Various preventive approaches towards security and integrity violations are recommended as policies and measures to counter any related threat before or when it presents itself. 2. Background of Security and Integrity in Healthcare IS Before the use of information systems, patients’ medical information used to be in form of paper based documentations. This can be better understood through the change theories propagated by Everett Rogers and Kurt Lewin. The computerization of information and operations in nursing has been as a result of change. The former storage system was limited in accessibility and posed very weak security to the private and medical records. This had to shift to electronic records, so that data and information could be well structured and classified. The use of healthcare information systems provided most solutions to the challenges posed by paper based systems, and benefits from manipulation of consolidated records. The IS have been ensuring data and system integrity to reduce errors and promote consistency in use of electronic medical information (Harman, 2012). However, though real time access of medical information by multiple individuals in various locations and easy update of information in medical databases is now possible in the current technologies, information systems continue to face insecurity challenges. Zerwekh & Garneau point out that “the effects of change range from positive to negative, from minor to major, from predictable to unpredictable” (2013, p. 519). Insecurity in health information systems arises from hacking of the systems, intentional or unintentionally damage, or corruption of the systems. When the systems are insecure, this means that the data or information content risks being interfered with (accessed, viewed, or changed). In many of these cases, it ends up being a violation of the patient’s right to privacy, where the offense can be prosecuted for civil penalties or criminal charges, depending on who is the perpetrator and the reasons for the action. Security of information systems is a great concern in modern healthcare industries. More private information is being fed and distributed across the electronic applications. Administrative and financial health systems, E-pharmacy, E-care, EHR systems, and consumer health information systems among others have to deal with insecurity issues, ranging from lack of confidentiality and authentication, poor data integrity, insecure storage, processing, and transmission among others. Security is concerned with preservation of confidentiality, integrity, availability, and accountability of the healthcare information and information systems, while integrity is its feature; it deals with ensuring the IS and the information asset is whole and complete, not altered or corrupt from any unauthorized manner (Cooper and Collman, n.d.). The threats to healthcare information systems can occur through any of their electronic components; whether servers, Operating systems, other installed applications, workstations, or the highly targeted storage devices and networks. Sensitive information can be easily passed along to various stakeholders, provided they have the access (see figure1). Because of the security breach of the IS and its components, even the contained assets (large quantities of data and information) in the system risk being attacked. Figure 1. Illustrations of stakeholders and information exchange in the healthcare system. Adapted from “Information Security and Privacy in Healthcare: Current State of Research,” by Appari and Johnson, 2008, p. 4. Copyright 2008 by Tuck Dartmouth. Adapted with Permission. In the past, various cases dealing with breaches of confidentiality, privacy and integrity of classified medical health information, not to mention of the various attempts of attack on healthcare IS have been reported in the US. Most healthcare facilities or organizations handling sensitive medical information have deployed security programs, yet most fail to optimize their systems for more protective measures. Some of the reported cases are the data breaches from California department of child support services dealing with loss of backup tapes containing records of about 800000 individuals enrolled to the program, and Howard University Hospital dealing with exposure of unencrypted records of about 35000 patients in 2012 (Versel, 2012). According to Tyson and Slocum, between 2011 and 2009, protected health information of over 18 million patients’ was compromised due to health care breaches arising from lack of effective security resources and leadership to protect the crucial records (2012). Security is not just an implementation of technologies, standards, and protocols, but requires further proactive measures for greater visibility of any potential emergence, to ensure continuous security of healthcare assets. Negligence to take security measures comes with a cost to the handling organizations, clinicians, and the patients. In the US, based on the trend of the analyzed data breach cases in the healthcare sector, the industry suffered a cost of about $240 per record in 2011 (Shaw and Harley, 2011). So far, there lots of efforts ranging from developing strategies to counter integrity and security breaches, compliance with technology standards, to government regulations in protection of the IS and medical records. 3. Concern over Healthcare Information Systems Securities Today, security in healthcare information systems cannot be separated from database protection. Because information systems cover diverse aspects in operations, security has to begin from the systems platform, applications and operations, to management. Physical, database, procedural, communication, and computer securities are the subdivision of the large IS security, which face threats either from the internal or external factors of the system (SEISMED Consortium, 1996). Different forms of attacks may be used to execute the crime for each, and ho w best they can be prevented depends on the allocated effort to secure the healthcare systems and the information. Considering that different organizations may need to share this information in the systems, there are different security misconceptions in how information should be availed or used in healthcare operations. Suppose healthcare organizations loose an asset for any action the IS, then it would be right to state that total security has not been reached. 3.1 Physical Security of the Healthcare IS Healthcare facilities have invested heavily in electronic systems for their medical related functions, from the personnel level to top administration. Physical security is the easiest measure in protection of the healthcare IS hardware and software, and communication infrastructure. It may seem as a rather discouraging strategy when a threat cannot be prevented or detected, but when considering the various countermeasures it brings, organizations can have physical security as first step safeguard against careless and physical threats that would harm IS. Physical security is diverse; the computers or workstations, servers, networking infrastructure, organizations storage devices among other physical IS equipments need total protection by all means, whether armed guards to prevent unauthorized access and modifications, to use of electronic locks and latches against IS intrusions and other measures to prevent insecurity in cases of natural disasters (Giannoulis and Northcutt, n.d.). Temporary power shutdown and use of personal laptops and USB drives in healthcare IS are some of the highly ignored actions that allow tampering with security. 3.2 Procedural Security of Healthcare IS The users of healthcare data and IS are potential threats to insecurity. For security reasons, each should have strict access to what they are authorized to access, in their levels of work. In line of work, each staff needs to follow the established security processes to accomplish their assigned role. This is usually a challenging task for medical practitioners, who at times may have to bypass the security rules in extreme cases with urgency of work (Jafari et al, 2010). Legitimate users (managers, staff, coordinating organizations, patients, medical officers among other stakeholders authorized to certain operations in healthcare IS) can create significant threats through intentional or unintentional abuse of healthcare data and IS. Their errors in operations, such as omissions in entering data, failure to log out once done, and viewing unauthorized information without clearance contribute to compromise on the integrity of PHI, and create vulnerabilities to problems in IS security, simply because procedures were not followed properly. 3.3 Communication and Network Security of Healthcare IS There is always demand of information from healthcare organizations concerned with the health issues of a particular patient. Therefore, sharing of data along the Information System is inevitable because these organizations may require certain access level to use the medical files. It is vital that transmission security be enforced for PHI and other confidential information moving in and out of healthcare organizations through the networks (internets, emails etc) and other telecommunication channels like telephone, satellite, and messages against unauthorized access, disclosure, and alteration (AHIMA, 2010). When the transmission system is secure, issues of eaves dropping can be eradicated and allow the intended information to reach the purposed stakeholders accurately and without a breach. 3.4 Computer and Database Security They are the most essential targets of the crimes in healthcare IS because they hold sensitive information storage, updated and processed repeatedly. Attacks on healthcare workstations and servers can paralyze the healthcare organizations’ functions easily, when the Operating systems, other applications and the data backups are crashed. Hence, it is necessary to take caution on who can access the computers or servers, to prevent corruption of healthcare applications and the data they contain. The severity of their obstruction demands that only professionals in information and IS security employ their technical knowledge and expertise, to ensure that required operational and technical controls are enforced to maintain integrity of medical databases and systems. Most hospitals prefer to use a decentralized over centralized storage of medical data, but allow authorized organization access to them. Despite this, it’s necessary that the owner of the data decide which information can be stored in the databases, who has access to them, and what other privileges they have over the medical records. 4. HIPAA and HITECH Regulations supporting Integrity and Security of HIS The federal regulations HIPAA act establishes a baseline for securing patients’ electronic information in the healthcare electronic systems. Its security and privacy policies seek to ensure the design and implementation of computerized IS guarantees security and privacy of the patient’s medical records, used in providing healthcare (“HIPAA compliance,” 2003). The security rules provide the medical determiners with resources on the way forward to ensure integrity and security of the healthcare information by applying the administrative, technical, and physical controls. The health plans, healthcare providers and clearing houses, medical officers, and hospitals must comply with the HIPAA and facilitate the safeguard measures as the law requires. The technical safeguards established apply to all electronic patient health information (EPHI), and lay out five standards; Audit controls for recording, examining and reporting information systems activities, transmission security, integrity, entity authentication seeking to confirm claim over access to EPHI, and access controls dealing with access rights (Department of Health and Human Services, 2007). The administrative safeguards are the majority and HIPAA requirements, and attach the responsibility of security and integrity of HIS and EPHI to the healthcare organizations’ management and its regulations of operation on its workforce. It covers workforce security to access of EPHI, the assigned security responsibility dealing with identification of officers to ensure covered entities comply with security rule, information access management, security management process to facilitate security program implementation, security awareness and training of the healthcare workforce, standards on procedures to address security incidents, evaluation of the security plans and procedures, and contingency plan for recovering access to EPHI in case of disruptive emergencies (Department of Health and Human Services, 2007). Physicals safeguards as earlier discussed deal with policies and measures to control access to information assets namely the workstations, networks, servers, storage locations among others. It gives the patients authority to view and amend their health records and rights to receive information on how their health information is secured and used. These rights provide them with an opportunity for close monitoring on alteration of their records against EPHI integrity. HITECH (Health Information Technology for Economic and Clinical Health) Act extends the security rules to the business associates of the healthcare organizations. As an enforcement of the HIPAA rule, HITECH attaches increased minimum monetary penalties to HIPAA violations. The act places an upper limit penalty of $1.5 million for any identical provision violation, and provides room for covered entities to correct an unknown violation within thirty days, otherwise obligation to pay civil money penalty for the violation cannot be barred (SecureIT, 2011). It also enhances their liabilities for impermissible operations on protected health information, and breach of notification provisions among others. 5. Security and Integrity Threats on Healthcare IS Data mining and inside healthcare operations have significant history to prove most of the planned and unintentional associated threats to EPR. Potential threats may change over time and when they come across vulnerable opportunities in healthcare information systems (HIS), they exploit them further. 5.1 Research on Security and Integrity Threats on Healthcare IS The violations of the systems’ security and integrity are caused by numerous threats; malicious codes (worms, Trojans, and virus in the IS), unintentional activities of privileged users and intentional harm caused by disgruntled employees, theft, hacking, and physical disruption from disaster that pose security threats (Cooper and Collman, n.d.). In recent years, medical identity theft leading to impersonation is an increasing health care fraud affecting healthcare stakeholders substantially. It is not a shock that most of these threats are initiated by human beings and associated with technological factors to execute the perpetrator’s wishes. The complexity of the healthcare IS and how many organizations list patients and their employees create information security and integrity risks. With the constant information flows between the numerous branches of the organizations, it would be impossible to limit where the information goes. In a case study conducted in hospital ABC (real name unrevealed) in New York and New Jersey metropolitan areas, there was evidence that Hospital ABC had partnered with numerous medical schools and universities in various research activities, and associated with other healthcare entities which it had direct data flows with; not to mention that these affiliated entities also had direct flows with other healthcare and commercial partners downstream (Lechler et al, 2011). It acts as a threat to data integrity due to intense access and certain disclosure. At times, individuals access the sensitive data in the healthcare delivery chain and can inappropriately use it unlawfully. The patient as the consumer may not be aware or probably operate on negligence of the identity theft. A survey conducted by Ponemon Institute gathered that theft of individuals’ medical identification credentials were caused by family members, healthcare providers to execute fraudulent billing, malicious employees in healthcare organizations, data breach by insurers or hospitals, criminal interception of mailed statements, criminal attacks and misplacement by individuals (2012) among others. Ideally, it’s a costly crime; some may not take it with urgency when they compare it with financial identity theft, buts it is of much greater importance. Over time, operating systems on computers systems have become difficult crack, instead, hackers opt for applications that run in the system because they are less systematically patched and securely coded. Nowadays, mobile devices (laptops, USBs, and iPods, external hard disk etc) are highly used in organizations. A survey by Manhattan Research revealed that data breaches in healthcare are on the rise with the increase of ‘bring your own devices’ (BYOD) approach and their use on the HIS; above 81 percent of physicians were reported to use smart phones in operations dealing with healthcare data (Sophos, 2012). Authenticated medical officers and research vendors can access and use patients’ records depending on their privileges; in the mode of use and mobile transition, malwares easily get into the HIS. The mobile malwares disguise into healthcare running applications online or in computer and can be used to intercept authentication token codes for HIS and databases, or fetch patient credentials and redirect to an intended IP address without consequent users’ awareness in their operations. 5.2 Solutions to Improving Information and HIS Integrity and Security Healthcare organizations have lot of options in the manner to exploit technology, so that it fits their function. Consider cases where hackers can remotely execute a denial of service attack on the HIS to delay their activities that cost them a lot by compromising their servers. Organizations with well experienced cyber security professionals can aid in detecting and handling vulnerabilities of the systems for such attacks. Having HIS firewalls installed and updated and using applications with security mechanisms better yet increase the effectiveness to address security and integrity threats. Privacy is the first measure to integrity of medical records and as long as the technology can provide a trusted execution environment, then healthcare data and application can run without interception. Intel provides a collection of hardware assisted security technologies to enforce privacy and security. The major interest here Intel TXT enabling trusted execution technologies to address integrity and confidentiality of healthcare systems and the critical data or information in the servers and PCs (Intel Corporation, 2011). Its security technologies support the performance of the deployed technical security control measures. Audit access and disclosure logs already exist, but can be made stricter. Probably, minimum time log in (like 10 minutes) can be set so that users can refresh their authentication code and the trailing system can capture the user identification and files accessed. However, privileges associated with the varying audit logs in HIS could be beneficial, but are potential leakages to systems’ information security. It should be designed in a manner that can strike a balance between need to provide access in emergency situations and securing medical information and EPRs against misuse. Authentication, encryption, and decryption mechanisms, states regulations and policies among others supplement the security and integrity measures in HIS. 6. Implications The above cases of threats reveal that the complexity of relations healthcare organizations maintain with distinct partners, and the limited exchanges of sensitive information across their boundaries accelerate the lack of integrity and insecurity in the electronic records. Chances of developing a complete patient data set where an entity receives partial or non redundant data flows, from several sources that in turn be received from different sources are high because of the data aggregation (Lechler et al, 2011). In the cases of medical identity theft, the public need to have full awareness of the theft, its causes, and effects. Regardless of a patient's relation with the perpetrators, they end up receiving various medical and government benefits, and medical insurance covers at the patients’ expense, not forgetting the potential compromise of patient care when their health information is altered and updated in the IS. More efforts are required to monitor and detect medical identity theft, especially on the healthcare providers and patients’ part. Besides the capitalist nature of healthcare organizations, the consumer should know they remain central to the issue. Similarly, consumerization of IT in HIS in the modern trend of globalization make healthcare functions easier, but make EHR and system vulnerable to attacks. The access to sensitive healthcare information remotely via personal mobile devices and from different web based consoles put patients’ data at risk. Personalized devices allowed in the healthcare organizations’ systems are great facilitators of malicious codes attacks on the health records, passages of confidential patients and healthcare organizations information, and a means from the organizations’ IS to further malicious activities. 7. Conclusion High quality healthcare IS will remain to be a vital aspect in the modern and future society, regarding the ever present potential threats and their costs to the healthcare organizations, associates, and the patients. Medical records may be changed from paper based to electronic forms, but even the HIS and the electronic data require secure practices and principles to maintain integrity. The legal framework and technical solutions applied right from development of the information systems, its management in healthcare to use by the healthcare workforce, and legitimate external users have commonly been used securing information, effective interoperation of the health information exchange, and systems. Security rules enabled by HIPAA and HITECH regulations assist healthcare IS and its operations to ensure a standard baseline of security is enforces. Threats to security and integrity breaches can attack at any vulnerable points of the HIS, which can be visualized earlier or after threat occurs. Due to this, it is necessary that accountability to security and integrity of healthcare systems be established, security measures to IS and information contained taken, and misuse of system and medical records reported, so that responsive measures can be taken solve the problem and ensure strong improvements to the HIS as a whole or its components. 8. Future directions Holding that the health of the patient exceeds all other functions of the healthcare coordinating organizations, patients stand a good chance to request for initial validation of the data integrity in their own records. There is a need for healthcare stakeholders to develop more effective measures by exploring the IT abilities to provide them (including the patient) with better measures to detect, prevent, recover from, and address medical identity theft (Hamilton 2009). Read only access through web enabled tools appear to be minimally privileged for patients to detect existing and potential medical identity theft that may inflict harm on them. The increasing use of audit trails in HIS to record trails of evidence in use of the systems and information raises concern over exceptional emergency access. Further investigations need to be conducted to minimize insecurity in health information systems. Appendix EPHI- Electronic patient health information EHR- Electronic Health Record HIS – Healthcare Information system PHI- Private Heath Information IS – Information System HITECH Act – Health Information Technology for Economic and Clinical Health HIPAA - Heath Insurance Portability and Accountability Act Reference List AHIMA. (2010, December). Information Security – An overview. Retrieved from http://library.ahima.org/xpedio/groups/public/documents/ahima/bok1_048962.hcsp?dDocName=bok1_048962 Appari, A. & Johnson M.E. (2008). Information Security and Privacy in Healthcare: Current State of Research. Retrieved from http://www.ists.dartmouth.edu/library/416.pdf Ball, Marion J., DuLong, D. & Hannah, Kathryn J. (Eds.). (2011). Nursing Informatics: Where Technology and Caring Meet. London: Springer-Verlag London Limited. Cooper, T. & Collman, J. (n.d.). Managing Information Security and Privacy in Healthcare Data Mining. Retrieved from http://ai.arizona.edu/mis596a/book_chapters/medinfo/Chapter_04.pdf Department of Health and Human Services. (2007). Security Standards: Technical Safeguards. CMS 2 (4). Retrieved from http://www.hhs.gov/ocr/privacy/hipaa/administrative/securityrule/techsafeguards.pdf Department of Health and Human Services. (2007). Security Standards: Administrative Safeguards. CMS 2 (2). Retrieved from http://www.hhs.gov/ocr/privacy/hipaa/administrative/securityrule/adminsafeguards.pdf Giannoulis, P. & Northcutt, S. (n.d.). Physical Security. Retrieved from http://www.sans.edu/research/security-laboratory/article/281 Hamilton, B. A. (2009, January 15). Medical Identity Theft Final Report: Contract Number HHSP233200045008XI. Retrieved from http://www.healthit.gov/sites/default/files/medidtheftreport011509_0.pdf Harman, L.B. (2012). Electronic Health Records: Privacy, Confidentiality and Security. Retrieved from http://virtualmentor.ama-assn.org/2012/09/stas1-1209.html HIPAA Compliance and Smart Cards: Solutions to Privacy and Security Requirements. (2003, September). Retrieved from http://www.smartcardalliance.org/pages/publications-hipaa-report Intel Corporation. (2011). Health Information at Risk: Successful Strategies for Healthcare Security and Privacy. Retrieved from http://www.intel.com/content/dam/www/public/us/en/documents/white-papers/strategies-for-healthcare-security-and-privacy-paper.pdf Jafari, S., Mtenzi, F., Fitzpatrick, R. & O’Shea, B. (2010, December). Security Metrics for e-Healthcare Information Systems: A Domain Specific Metrics Approach. International level of Digital Society (IJDS) 1(4). Retrieved from http://infonomics-society.org/IJDS/Security%20Metrics%20for%20e-Healthcare%20Information%20Systems_A%20Domain%20Specific%20Metrics%20Approach.pdf   Lechler, T., Wetzel, S. & Jankowski, R. (2011). Identifying and Evaluating the Threat of Transitive Information Leakage on Healthcare Systems. Retrieved from http://www.cs.stevens.edu/~swetzel/publications/hicss.pdf Ponemon Insitute LLC. (2012, June). Third Annual Survey on Medical Identity Theft. Retrieved from http://www.ponemon.org/local/upload/file/Third_Annual_Survey_on_Medical_Identity_Theft_FINAL.pdf SecureIT. (2011, July). Understanding the Security & Privacy Rules Associated with the HITECH and HIPAA Acts: Multifactor Authentication. Retrieved from http://www.secureit.com/resources/WP_HIPAA_HITECH_CMS_final_072811.pdf SEISMED Consortium. (1996). Data Security for Health Care: Technical guidelines. Amsterdam: IOS Press Shaw, E. D. & Harley, V.S. (2011). Data Breach Trends & Stats. Retrieved from http://www.indefenseofdata.com/data-breach-trends-stats/ Sophos. 2012. Security Threat Report 2012. Retrieved from http://www.sophos.com/medialibrary/PDFs/other/SophosSecurityThreatReport2012.pdf Tyson, K. & Slocum, R. (2012). Focus: Health Care Information Security. JHIM. V. 26. No 4. 38-43. Retrieved from http://i.dell.com/sites/doccontent/public/solutions/healthcare/en/Documents/focus-healthcare-information-security.pdf Versel, N. (2012, April). 2 healthcare data Breeches show Importance of Encryption. Retrieved from http://www.informationweek.com/healthcare/security-privacy/2-healthcare-data-breaches-show-importan/232800389 Zerwekh, J. & Garneau, A. Z. (Eds.). (2013). Nursing Today: Transition and Trends-Revised Reprint. Missouri: Elsevier Saunders. Read More