Why Is Getting MFA Right a Challenge in Healthcare?
If we break down a hospital into four functional areas — clinical, operational, administrative and technological — those last three areas are typical to the lifecycle of any business. It’s the first one, the clinical aspect, that is unique to healthcare and requires specific workflow considerations for clinicians.
For example, first-shift nurses may have several devices that they need to log in and out of throughout the day in several locations. The amount of time it takes to reauthenticate to access critical applications, even if it’s only a minute and a half, can have a huge impact on patient care. That is the great challenge in the patient experience and within the clinical continuity of care model: Workflow is greatly impacted by MFA.
There is also the challenge of provisioning and deprovisioning user accounts within a healthcare organization. Think about pro re nata nursing: Organizations may occasionally require flex resourcing, and there are very few hospitals with mature enough onboarding processes that they can set up usable accounts that are discarded at the end of a shift. That is a fast-paced lifecycle for an account, and most providers are not equipped to do that.
The detailed compliance timelines proposed for the updated security rule, such as 1-hour access termination and 72-hour system restoration requirements, indicate a regulatory intent to impose a higher standard of operational agility and responsiveness. This reflects a recognition that traditional, less prescriptive approaches are insufficient against the speed and sophistication of modern cyberthreats. The burden shifts from merely having security controls to demonstrably operating them with specific, measurable performance metrics. This implies a significant need for highly automated processes, well-rehearsed incident response plans and continuous monitoring capabilities.
READ MORE: Here's what healthcare organizations should know about advanced persistent threats.
How Are Updated Auditing Expectations a Challenge for Healthcare?
Many organizations may be starting from zero because they have not been doing this level of auditing. They have to put a policy taxonomy in place for document retention. In many organizations, if you ask how long something should be kept, the answer is “forever.” This is because organizations want to ensure they have records available in case an issue arises, no matter how much time has passed since the original event. But there are elements in healthcare, such as imaging, that take up enormous storage space.
On the other hand, organizations planning to release documentation often lack a defined storage decay period and don't have the technological processes to manage storage or expenses over time.
Healthcare organizations can look to other industries to see how they approach data security. For example, the payment card industry has established data security standards and specifications that have been around for over a decade. Follow a financial organization. Patient records are even more important than financial information, so protect them at all costs.
Changes Are Not Just for Hospitals
We tend to focus on HIPAA as something that is only applicable to traditional providers. But think of a senior care organization with older adult residents: Protected health information matters there as well. While we look at this as a healthcare provider issue, HIPAA compliance and responsibility is all-encompassing within many environments, and anyone who handles healthcare data must adhere to it.
Compliance is necessary for anyone managing healthcare data, including those who may not have considered it relevant before. As the need to protect and transfer health information grows, HIPAA compliance now extends into financial and lifestyle management, not just clinical care.
This article is part of HealthTech’s MonITor blog series.
