Select Page
Protecting HIPAA Data On Mobile Devices

Protecting HIPAA Data On Mobile Devices

HIPAA stands for the Health Insurance Portability and Accountability Act that was passed by Congress in 1996.

Essentially, HIPAA enshrines the means by which American workers and their dependents can keep their health insurance coverage should they change or lose their jobs.


HIPAA also sets industry-wide standards for electronic billing of health care services. Additionally, this law mandates the confidential handling of an individual’s medical information.


So what does this have to do with mobile devices? Plenty.


Mobile devices have affected every industry sector. With each passing day, more and more professionals conduct their business using tablets, laptops, or smart phones. This includes the medical industry. Doctors, nurses, and physician’s assistants routinely send confidential (HIPAA) data over satellite data plans and WiFi.


Securing HIPAA Data Remotely

In most cases, the medical industry’s use of mobile devices translates into better patient care. But it also opens personal medical data to the threat of cyber theft.

To maintain HIPAA compliance, health care professionals and IT managers should implement the following best practices when handling health care data on mobile devices:

Obtain Written Permission Before Operating via Mobile

Make sure to document the fact that your patients have signed off on communicating with your office via email or any other electronic means. Documented consent is critical to HIPAA compliance. It’s also one of the simplest and best ways to avoid embarrassing misunderstandings and potential legal suits down the line.

Stick to Proper Professional Jargon

The ease and speed of mobile devices often results in users relying on abbreviations, emoticons, and other forms of internet vernacular. Put simply: DON’T DO THIS. Due to the nature of the field, any HIPAA data created should be kept appropriate for long-term records. Remember that communications, notes, and files that appear unprofessional can subject health care practitioners to confusion at best and malpractice suits at worst. Treat every character you type on behalf of your job as the valuable work product it is. Your company and the patients you treat depend on accurate communications scripted in proper industry vocabulary.

Everything Goes Into the File

Remember that every email you send or receive, every file you upload or download, every conversation you have by phone is part of your patient’s official medical record. Text messages, phone calls, and conversational asides might not seem important in the moment. However, they all form a piece of the overall puzzle a patient’s profile presents. Be sure to record every instance of communication diligently to prevent confusion and delays in treatment, as well as to maintain HIPAA compliance.

Encrypt Your Transmissions

No one leaves for work each day while the door to the house stands open wide. That’s just common sense. By the same token, no one using a mobile device in the 21st century should send any transmission without securing that message via data encryption. User passwords activate only one tier of proper data security. DON’T STOP THERE! Due to the sensitivity of medical information, add as many layers as you can in the form of personal questions, icons, PINs, and other challenge-response tests. Remember that there’s no such thing as too much security.


Managed IT Keeps HIPAA Data Safe

Our ComplianceCare service from EstesCloud can help you solve all of your HIPAA IT issues.

Get more tips on protecting HIPAA data on mobile devices with our comprehensive advice on remote worker security. Because mobility increases the risk of cyberattacks, our helpful IT security guides can keep your employees and clients safe. Fill out the form below to receive a presentation on remote workforce security. This presentation was an event in partnership with the Loveland Chamber of Commerce. EstesGroup’s headquarters is in Loveland, Colorado, where we help small and midsize businesses deploy mobile cybersecurity solutions.

HIPAA Technical Safeguards

HIPAA Technical Safeguards

HIPAA Technical safeguards are designed to decrease the possibility of a security issue or data breach in an organization.

Businesses handling protected health information (PHI) must have current and comprehensive technical safeguards in place to remain secure from any threats, whether internal or external. Organizations that require HIPAA technical safeguard compliance must determine the extent of their security measures and if they are reasonable and appropriately suited for the size of the organization. For example, internet filtering and full disk encryption may be appropriate and cost effective for entities with tens of thousands of records managed by multiple users, while a smaller organization may be sufficiently protected with a less complex antivirus, file encryption or simple firewalls.

What are HIPAA technical safeguards?

HIPAA technical safeguards are simply the policies and procedures for the use of technology put in place to protect patient health information. It includes the technology, software, hardware, administration and more. There are four main components:

HIPAA Access Control

This is a policy or procedure that controls who can access information. Only authorized people should be able to access certain information and all activity must be able to be tracked to a specific user. User verification and automatic log-off after times of inactivity, as well as emergency access procedures are addressed here.

HIPAA Audit Control

These controls are designed to record and examine activity where patient information is accessed or stored. The procedure should include a process that outlines the frequency, methods and scope of the audit, as well as processes for violations.

HIPAA Integrity Control

This control is in place to ensure patient data is not destroyed or altered. This typically begins with a risk assessment to determine how outside sources may be able to access the information and then addressing those areas of weakness. Protection for external storage of information is also included here. It can also include procedures, processes or software that authenticates information.

HIPAA Transmission Security

This technical HIPAA security safeguard addresses the concern of unauthorized access to patient information being transmitted over a network. The use of electronic medical records which allow medical personnel to access patient data inside an office or on the other side of the country, must be secure. Encryption is the key tool here.

Any technical safeguards will change as technology and threat landscape changes. But with HIPAA security safeguard components in place, the opportunities for cyber attacks and data loss can be reduced significantly. While medical providers are required to follow HIPAA regulations, any network can be made more secure with the very same guidelines. EstesCloud ComplianceCare offers the best-of-breed HIPAA compliance services, making sure your practice will pass any audit that might come your way!

Take the first step to reduce cost and increase the productivity of your business. Give us a call at 888.300.2340, and

Healthcare Cyber Security

Healthcare Cyber Security

Is your organization in the healthcare industry?

Are you worried, as a consumer, about your data being lost, stolen or publicized?

As a healthcare provider, are you concerned about the liability you could face as a result of an attack?

KPMG LLP, is an audit, tax and advisory firm helping their clients get insight so they can address industry specific concerns and opportunities. According to their 2015 Healthcare Cybersecurity Survey:

“Eighty-one percent of healthcare executives say their organizations have been compromised by at least one malware, botnet or other kind of cyberattack during the past two years, according to a survey by KPMG.

The KPMG report also states that only half of those executives feel that they are adequately prepared to prevent future attacks. The attacks place sensitive patient data at risk of exposure, KPMG said.” []

They stated the greatest risk in healthcare cybersecurity is in:

  • External Attacks
  • Sharing Data with Third-Parties
  • Employee Crime
  • Wireless Computing
  • And 27% from Inadequate Firewall protection

In February 2013, Red Spin, a Health IT security firm published a report that over 29 million patient records had been compromised due to healthcare cybersecurity breaches since 2009. Since then, we have experienced two of the largest known healthcare cybersecurity breaches. In the last two years, both CHS and Anthem were attacked.

In July 2014, the giant Community Health Systems (CHS) malware attack affected 4.5 million people. In February 2015, health care provider Anthem was hacked, impacting 80 million records, including the company’s own CEO. In both cases, it wasn’t medical information that was compromised, but rather patients’ private information including full names, addresses, social security numbers and more.

Spending has been increased to prevent attacks, but this trend is being seen more in large organizations rather than small ones. The small companies just don’t think it can happen to them, but when trends are showing high numbers of compromise and low confidence of protection, it is time to get support. A security audit to access the need and vulnerabilities of the systems is the first step.

If you are in the healthcare industry and are subject to HIPPA law compliance, it is critical to protect your client data from a healthcare cyberattack.

EstesCloud // Explore our Managed Services Solution:

CompleteCare: Maintaining your own IT infrastructure is expensive and frustrating. EstesCloud CompleteCare combines the benefits of our ServerCare and ClientCare programs into one comprehensive program that protects your entire IT infrastructure at a predictable fixed cost.  Let the EstesCloud team become your Trusted IT Advisor, so you can get back to growing your business.
Let’s start the conversation!

ServerCare: A proactive approach to IT that includes regular scheduled maintenance and monitoring is essential to maintaining a healthy network and a productive staff.
EstesCloud ServerCare will give you peace of mind knowing that our team is continually watching and caring for your servers.
Discover the Benefits of ServerCare.

ClientCare: Proactive support for your desktops, laptops, and mobile devices.  We provide all of the monitoring, patching, and security tools for your systems, plus full access to our help desk services 24/7/365.
EstesCloud ClientCare will ensure your valuable data is secure whenever and wherever it is needed.

Take control of your systems today.

ComplianceCare: Are you a medical provider under HIPAA or HITECH regulatory compliance? Are government auditors keeping you up at night? Our HIPPA IT Management Service will ensure you are HIPPA compliant.

For the health of your IT Enterprise.

Take the first step to reduce cost and increase the productivity of your business. Give us a call at 888.300.2340, and