Cyber attacks against the healthcare industry are growing at an accelerated pace, and to help healthcare organizations strengthen their cybersecurity programs and defend against a cyber attack, the American Health Information Management Association (AHIMA) recently released a 17-step cybersecurity plan.
AHIMA notes that Information governance (IG)—the development of an organization-wide framework for managing information throughout its lifecycle and supporting the organization’s strategy, operations, regulatory, legal, risk and environmental requirements—is a critical organizational initiative that healthcare organizations must embrace in order to thrive in the environment of cyber threats and attacks in healthcare today. Once information governance program is created and implemented, a cybersecurity plan needs to be reviewed at least quarterly to ensure the organization is taking the necessary steps to prevent or detect an attack.
The 17 steps that ANIMA recommends as part of a complete cybersecurity plan are:
- Conduct a risk analysis of all applications and systems
- Recognize record retention as a cybersecurity issue
- Patch vulnerable systems
- Deploy advanced security endpoint solutions that provide more effective protections than standard antivirus tools
- Encrypt the following: workstations (high-risk) and laptops; smartphones and tablets; portable media and backup tapes (if tapes are still being used)
- Improve identity and access management
- Refine web filtering (blocking bad traffic)
- Implement mobile device management (MDM)
- Develop incident response capability
- Monitor audit logs to select systems
- Leverage existing security tools like Intrusion Prevention System/Intrusion Detection System (IPS/IDS) to detect unauthorized activities
- Evaluate business associates
- Improve tools and conduct an internal phishing campaign
- Hire an outside security firm to conduct technical and non-technical evaluations
- Prepare a “State of the Union” type presentation for an organization’s leaders on cybersecurity
- Apply a “Defense in Depth” strategy
- Detecting and preventing intrusion
Get the latest information on Health IT and attend other valuable sessions at this two-day Summit providing healthcare leaders with educational content, insightful debate and dialogue on the future of healthcare and technology.