" access control Archives - LuxSci

Posts Tagged ‘access control’

What exactly does HIPAA say about Email Security?

Wednesday, February 26th, 2025

Performing daily business transactions and communications through electronic technologies is accepted, reliable, and necessary across the nation’s healthcare providers, payers and suppliers. As a result, email has become a standard in the healthcare industry as a way to conduct business activities that commonly include:

  • Interacting with patients
  • Real time authorizations for medical services
  • Transcribing, accessing and storing health records
  • Appointment scheduling
  • Referring patients
  • Explanation of benefits
  • Marketing offers
  • Submitting claims to health plan payers for payment of the services provided

Collaborative efforts amongst healthcare providers have improved the delivery of quality care to patients in addition to the recognized increase in administrative efficiency through effective use of email and other types of digital communication. Patients are becoming more and more comfortable with emailing their physician’s office to schedule an appointment, discuss laboratory results, or request refills on medication. Medicare and some other insurance payers also recognize and pay for virtual care where the health provider and patient interact over video (telemedicine).

Using digital communications, undoubtedly, poses concerns about the privacy and security of an individual’s information. In healthcare, the confidentiality of a patient’s information has been sacred since the days of the Hippocratic Oath (Hippocrates – the Father of Medicine, 400 B.C.). Today, merely taking an oath to respect one’s privacy has been overshadowed by regulations that govern how certain healthcare establishments must handle an individual’s health information. So, if a healthcare organization employs email as a means of communicating medical and/or mental health data to appropriate parties, including patients and customers, they must also ensure that information is well safeguarded.

This article addresses the specific issues that healthcare provider, payers and suppliers must address in order to be in compliance with HIPAA and HITECH certified. It will also lay out how LuxSci enables healthcare organizations to meet these requirements though HIPAA compliant email outsourcing.

Overview of HIPAA

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) implemented new rules for the healthcare world. Mandating compliance with its Privacy and Security Rules, the federal government is committed to enforcing patients’ rights. Industry professionals – financial, administrative and clinical – are no strangers to the regulatory compliance culture. HIPAA laws apply to a covered entity; i.e. healthcare providers, suppliers, clearinghouses and health plan payers that meet certain conditions. In essence, most providers are covered entities if they employ digital communications, meaning they function by storing and exchanging data via computers through intranets, Internet, dial up modems, DSL lines, T-1, etc. Additionally, HITECH extends the requirements of HIPAA to any business associate of a covered entity and to all business associates of  business associates (all the way down the line) who may come into contact with Protected Health Information originating from a covered entity.

HIPAA email security applies specifically to protected health information, not just personal information. Protected Health Information (PHI), as defined in HIPAA language, is health information of an identifiable individual that is transmitted by electronic media; maintained in any electronic medium; or transmitted or maintained in any other form or medium. For example, all administrative, financial, and clinical information on a patient is considered PHI and must abide by the following standards:

  • Privacy Standards: The HIPAA Privacy Rule sets standards for protecting the rights of individuals (patients). Covered entities must follow the laws that grant every individual the right to the privacy and confidentiality of their health information. Protected Health Information is subject to an individual’s rights on how such information is used or disclosed.
    Privacy Standard Key Point: Controlling the use and disclosure of oral, written and electronic protected health information (any form).
  • Security Standards: Taking the Privacy Rule a step further, HIPAA implemented the Security Rule to cover electronic PHI (ePHI). To this end, more secure and reliable information systems help protect health data from being “lost” or accessed by unauthorized users.
    Security Standard Key Point: Controlling the access to electronic forms of protected health information (not specific to oral or written).

The Privacy and Security Rules focus on information safeguards and require covered entities and their business associates to implement the necessary and appropriate means to secure and protect health data. Specifically, the regulations call for organizational and administrative requirements along with technical and physical safeguards.

Starting on February, 2010, the HIPAA rules were enhanced by the American Recovery and Reinvestment Act.  The HITECH section of this act implements significant penalties for breaches of HIPAA and requires that the business partners of organizations covered by HIPAA must themselves obey the HIPAA Privacy and Security Rules, and face liability if there are any unauthorized disclosures.  For more information on what HITECH has done to HIPAA, see: HIPAA 2010: HITECH Impact on Email and Web Outsourcing.  Starting in September 2013, the Omnibus rule goes into effect, further expanding the scope of coverage and drastically strengthening the penalties and enforcement of HIPAA.   For more information on Omnibus, see: How the HIPAA Omnibus Rule Affects Email, Web, FAX, and Skype.

Provisions of the HIPAA Email Security Rule

The HIPAA language uses the terms required and addressable. Required means that complying with the given standard is mandatory and, therefore, must be complied with.  Addressable means that the given standards must be implemented by the organization unless assessments and in depth risk analysis conclude that implementation is not reasonable and appropriate specific to a given business setting.  Important Note: Addressable does not mean optional.

With regard to addressable, an organization should read and decipher each Security standard separately and deal with each piece independently in order to determine an approach that meets the needs of the organization.

The General Rules of the Security Standards reflect a “technology-neutral” approach. This means that there are no specific technological systems that must be employed and no specific recommendations, just so long as the requirements for protecting the data are met.

Organizational requirements refer to specific functions a covered entity must perform, including the use of business associate contracts and the development, documentation and implementation of policies and procedures.

Administrative requirements guide personnel training and staff management in regard to PHI and require the organization to reasonably safeguard (administrative, technical and physical) information and electronic systems.

Physical safeguards are implemented to protect computer servers, systems and connections, including the individual workstations. This section covers security concerns related to physical access to buildings, access to workstations, data back up, storage and obsolete data destruction.

Technical safeguards affect PHI that is maintained or transmitted by any electronic media. This section addresses issues involving authentication of users, audit logs, checking data integrity, and ensuring data transmission security.

Risk Analysis

Risks are inherent to any business and, therefore, with regard to HIPAA, each organization must take into consideration the potential for violating an individual’s right to privacy of their health information. HIPAA allows for scalability and flexibility so that decisions can be made according to the organization’s approach in protecting data. Covered entities and their Business Associates must adopt certain measures to safeguard PHI from any “reasonably anticipated” hazards or threats. After a thorough yearly risk analysis, a yearly assessment of the organization’s current security measures should be performed. Additionally, a cost analysis will add another important component to the entire compliance picture. A plan to implement secure electronic communications starts with reviewing the Security Rule and relating its requirements to the available solution and your business needs.

HIPAA Administrative and Physical Safeguards

Below are the administrative and physical safeguards as outlined in the Federal Register. These requirements are items that must generally be addressed internally, even if you are outsourcing your email or other services.  We will discuss these safeguards in more detail below.

Standard: ADMINISTRATIVE SAFEGUARDS Sections Implementation Specification Required or Addressable
Security Management Process 164.308(a)(1) Risk Analysis R
Risk Management R
Sanction Policy R
Information System Activity Review R
Assigned Security Responsibility 164.308(a)(2) R
Workforce Security 164.308(a)(3) Authorization and/or Supervision A
Workforce Clearance Procedures R
Termination Procedures A
Information Access Management 164.308(a)(4) Isolating Health Care Clearinghouse Function R
Access Authorization A
Access Establishment and Modification A
Security Awareness and Training 164.310(a)(5) Security Reminders A
Protection from Malicious Software A
Log-in Monitoring A
Password Management A
Security Incident Procedures 164.308(a)(6) Response and Reporting R
Contingency Plan 164.308(a)(7) Data Backup Plan R
Disaster Recovery Plan R
Emergency Mode Operation Plan R
Testing and Revision Procedure A
Applications and Data Criticality Analysis A
Evaluation 164.308(a)(8) R
Business Associates Contracts and Other Arrangement. 164.308(b)(1) Written Contract or Other Arrangement R
Standard: PHYSICAL SAFEGUARDS Sections Implementation Specification Required or Addressable
Facility Access Controls 164.310(a)(1) Contingency Operations A
Facility Security Plan A
Access Control and Validation Procedures A
Maintenance Records A
Audit Controls 164.312(b) R
Integrity 164.312(c)(1) Mechanism to Authenticate EPHI A
Workstation Use 164.310(b) R
Workstation Security 164.310(c) R
Device and Media Controls 164.310(d) Disposal R
Media Re-use R
Accountability A
Data Backup and Storage A

Importance of Encryption for Email Communication

The security risks for email commonly include unauthorized interception of messages en route to recipient, messages being delivered to unauthorized recipients, and messages being accessed inappropriately when in storage. These risks in using the Internet are addressed in the Security Rule’s technical safeguards section, particularly:

  1. Person or Entity Authentication – required procedures must be implemented for identification verification of every person or system requesting access to PHI. This means the identity of the person seeking information must be confirmed within the information system being utilized.  It also means that shared logins are not permitted.
  2. Transmission Security – addressable data integrity controls and encryption reasonable and appropriate safeguards.
  3. Business Associates – if you outsource your email services to another company and your email may contain ePHI in any form, then that company must be HIPAA compliant, sign a Business Associate Agreement with you, and actively safeguard your ePHI.  The restrictions on Business Associates are quite strict and have changed as of Feb, 2010 and again, becoming even more strict as of September, 2013.

Each healthcare organization using email services must determine, based on technologies used for electronic transmission of protected health information, how the Security standards are met.

Addressable specifications include automatic log off, encryption, and decryption. Covered entities must also assess organizational risks to determine if the implementation of transmission security which includes integrity controls to ensure electronically-transmitted PHI is not improperly modified without detection is applicable. E.g. it is applicable for any ePHI going over the public Internet; it may not be necessary for information flowing between servers in your own isolated office infrastructure.  Encryption of ePHI at rest (as it is stored on disk) is also addressable and not a requirement under HIPAA regulations; however, a heightened emphasis has been placed on encryption due to the risks and vulnerabilities of the Internet.

Ultimately, according to the Department of Health and Human Services, covered entities and their business associates can exercise one of the following options in regard to addressable specifications:

  • Implement the specified standard;
  • Develop and implement an effective security measure to accomplish the purpose of the stated standard; or
  • If the specification is deemed not reasonable and appropriate for the organization but the standard can still be met, then do not implement anything.

Reasonable and appropriate relate to each organization’s technical environment and the security measures already in place.

Questions to Consider When Choosing an Email Service Provider

When your organization is responsible for critical data such as protected health information, choosing an email provider is more than a matter of trust. Does the email service provider build on the administrative, physical and technical safeguards while delivering to its customers:

  • Signed Business Associate Agreement
  • Awareness of their responsibilities under HITECH and Omnibus
  • Solutions that meet or exceed HIPAA’s Security Standards
  • Willingness to work with you and advise you on your security and privacy choices
  • Protect data integrity
  • Flexible, scalable services – no account is too small
  • Administrative access to assign or change a user’s password
  • Controls to validate a user’s access
  • Audit controls to track user access and file access
  • Allow access to users based on role or function
  • Automatic log off after specified time of inactivity
  • Data transmission security
  • Unlimited document or email transfer
  • Ability for encryption
  • Emergency access for data recovery
  • Minimal server downtime
  • Secure data back up and storage
  • Secure data disposal
  • User friendly, web-based access without the necessity of third party software
  • Privacy in not selling or sharing its client contact information

A Scalable, Flexible and HIPAA-Compliant Solution in Electronic Communications

Lux Scientiae (LuxSci for short) offers secure, premium email services including extensive security features, Spam and virus filtering, robustness, and superior customer service. The offerings are scalable to any size healthcare organization.

In addition to LuxSci itself protecting your ePHI by following the HIPAA Security and Privacy Rules as required by the HITECH amendment to HIPAA, LuxSci also provides a clean set of guidelines for using its services that enable your ePHI to be safeguarded; these guidelines are automatically enforced by the use of any “HIPAA Compliant” account.  If you follow these guidelines and sign LuxSci’s Business Associate Agreements, LuxSci will certify your account as HIPAA compliant and give you a HIPAA Compliance Seal.

Take a look at the table below to see examples of how LuxSci enables you to meet HIPAA’s requirements for protecting electronic communications in your organization.

Standard: TECHNICAL SAFEGUARDS Sections Implementation Specification R/A?
Access Control 164.312(a)(1) Unique User Identification R
HIPAA COMPLIANT SOLUTION from LuxSci
The Rule States: “Assign a unique name and/or number for identifying and tracking user identity.”
Solution: Use of unique usernames and passwords for all distinct user accounts.  No shared logins; but sharing of things like email folders between users is permitted.
Standard: TECHNICAL SAFEGUARDS Sections Implementation Specification R/A?
Emergency Access Procedure R
HIPAA COMPLIANT SOLUTION from LuxSci
The Rule States: “Establish (and implement as needed) procedures for obtaining necessary electronic protected health information during an emergency”
Solution: PHI in email communications can be accessed from any location via the Internet. There are also mechanisms for authorized administrative access to account data.  Optional Email Archival and Disaster Recovery services provide enhanced access to email in case of emergency.
Standard: TECHNICAL SAFEGUARDS Sections Implementation Specification R/A?
Automatic Logoff A
HIPAA COMPLIANT SOLUTION from LuxSci
The Rule States: “Implement electronic procedures that terminate an electronic session after a predetermined time of inactivity.”
Solution: An organization can set screen savers on their desktops to log users out. Additionally, WebMail and other email access services (e.g. POP, IMAP, and Mobile) automatically log off all users after a predetermined amount of time; the WebMail session time is user- and account-configurable.
Standard: TECHNICAL SAFEGUARDS Sections Implementation Specification R/A?
Encryption and Decryption A
HIPAA COMPLIANT SOLUTION from LuxSci
The Rule States: Implement a mechanism to encrypt and decrypt electronic protected health information.
Solution: All usernames, passwords, and all other authentication data are be encrypted during transmission to and from LuxSci’s servers and our clients using SSL/TLS. Additionally, SecureLine permits end-to-end encrypted email communications with anyone on the Internet, SecureForm enables end-to-end encryption of submitted web site form data, and WebAides permit encryption of sensitive documents, passwords databases, and internal blogs.
Standard: TECHNICAL SAFEGUARDS Sections Implementation Specification R/A?
Audit Controls 164.312(b) R
HIPAA COMPLIANT SOLUTION from LuxSci
The Rule States: “Implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information.”
Solution: Detailed audit trails of logins to all POP, IMAP, SMTP, LDAP, SecureLine,and WebMail services are available to users and administrators. These include the dates, times, and the IP addresses from which the logins were made. Auditing of all sent and received email messages is also available. SecureLine also permits auditing of when messages have been read.
Standard: TECHNICAL SAFEGUARDS Sections Implementation Specification R/A?
Integrity 164.312(c)(1) Mechanism to Authenticate ePHI A
HIPAA COMPLIANT SOLUTION from LuxSci
The Rule States: “Implement policies and procedures to protect electronic protected health information from improper alteration or destruction.”
“Implement electronic mechanisms to corroborate that electronic protected health information has not been altered or destroyed in an unauthorized manner.”
Solution: To prevent unauthorized alteration or destruction of PHI, the use of SSL, TLS, PGP, and SecureLine will verify message and data integrity.
Standard: TECHNICAL SAFEGUARDS Sections Implementation Specification R/A?
Person or Entity Authentication 164.312(d) R
HIPAA COMPLIANT SOLUTION from LuxSci
The Rule States: “Implement procedures to verify that a person or entity seeking access to electronic protected health information is the one claimed.”
Solution: Username and Password are used for access control (Two-factor verification is also available); strict control is given over who can access user’s accounts. LuxSci’s privacy policy strictly forbids any access of email data without explicit permission of the user (unless there are extenuating circumstances). Also, use of SecureLine end-to-end encryption in email and document storage ensures that only the intended recipient(s) of messages or stored documents can ever access them.
Standard: TECHNICAL SAFEGUARDS Sections Implementation Specification R/A?
Transmission Security 164.312(e)(1) Integrity Controls A
HIPAA COMPLIANT SOLUTION from LuxSci
The Rule States: “Implement technical security measures to guard against unauthorized access to electronic protected health information that is being transmitted over an electronic communications network.”
“Implement security measures to ensure that electronically transmitted electronic protected health information is not improperly modified without detection until disposed of.”
Solution: SSL-based encryption during the transmission of data to/from our clients for WebMail, POP, IMAP, SMTP, and document storage services is provided. SMTP TLS-based encryption of inbound email at LuxSci ensures that all email sent internally at LuxSci meets “Transmission Security” guidelines and allows you to securely receive email from other companies whose servers also support TLS. LuxSci also provides SecureLine for true end-to-end encryption of messages to/from non-clients.
Standard: TECHNICAL SAFEGUARDS Sections Implementation Specification R/A?
Encryption A
HIPAA COMPLIANT SOLUTION from LuxSci
The Rule States: “Implement a mechanism to encrypt electronic protected health information whenever deemed appropriate.”
Solution: SSL encryption for WebMail, POP, IMAP and SMTP services is provided. Additionally, encrypted document and data storage is available and use of SecureLine for end-to-end security is enforced.
Standard: TECHNICAL SAFEGUARDS Sections Implementation Specification R/A?
Device and Media Controls 164.310(d) Data Backup and Storage R
HIPAA COMPLIANT SOLUTION from LuxSci
The Rule States: “Create a retrievable, exact copy of electronic protected health information, when needed, before movement of equipment.”Solution: Daily on-site and weekly off-site backups ensure exact copies of all ePHI are included. Live data is stored on redundant RAID disk arrays for added protection. Furthermore, Premium Email Archival provides permanent, immutable storage on servers in multiple geographic locations.
Standard: TECHNICAL SAFEGUARDS Sections Implementation Specification R/A?
Data Disposal R
HIPAA COMPLIANT SOLUTION from LuxSci
The Rule States: “Implement policies and procedures to address the final disposition of electronic protected health information, and/or the hardware or electronic media on which it is stored.”Solution: Clients can delete their data whenever desired. Additional security comes in automatic expiration of data backups (cease to exist after 1 month). Alternate expiration plans are available for large clients.

Healthcare staff using LuxSci can send and receive email from anywhere in the world using existing or new email clients or web browsers.  A comprehensive solution for a complex law – managed by your account administrators in-house or remotely by our company. Risk assessments for potential HIPAA violations can be performed by administrators through the use of audit trails. Reliability and cost effective solutions are the backbone of LuxSci – even for extremely large client organizations. And, count on the physical security of our servers.

Chart of LuxSci Services and the HIPAA Rules they Satisfy

If you are interested in specific services at LuxSci and would like to know exactly which of the HIPAA rules each service meets, the following charts will assist you. Please contact LuxSci for more information.

HIPAA Rule 1. View Email: Secure WebMail, POP, IMAP, or Mobile Sync 2. Send Email: Secure WebMail, SMTP, or Mobile Sync 3. Encryption with SecureLine combined with 1 and 2 4. Secure Collaboration (WebAides)
Access Control – Unique User Identification
Access Control – Emergency Access (a) (a)
Access Control – Automatic Logoff
Audit Controls
Integrity (b) (b)
Person or Entity Authentication (b) (b)
Transmission Security > Integrity Controls (c) (c)
Transmission Security > Encryption (c) (c)
Device and Media Controls > Data Backups
Device and Media Controls > Data Disposal

(a) Our secure document storage service and use of SecureLine for communications may assume that the recipients have special passwords for their “Secure data access certificates” (PGP or S/MIME). These passwords are may be stored in a “Password Escrow” (a special secure password database) if the users so choose. In these cases, passwords to security keys can be retrieved in case of emergency or in case of loss.

(b) Our secure document storage service and use of SecureLine for communications encrypts data so that only the intended recipient(s) can ever view the data. The encryption process also allows the recipient(s) to verify that the data was not altered since it was sent or stored using digital signatures.

(c) SSL/TLS solutions encrypt the message during transport to and from LuxSci’s servers and your personal computer. Email sent from LuxSci to external addresses is secured with the use of SecureLine (Solution #3).

Solutions #3 provides complete transport layer and end-to-end email security compatible with any email user anywhere, no matter what software s/he may have.

References

Health Insurance Reform: Security Standards – Federal Register, Vol. 68, No. 34, 45 CFR Parts 160, 162, 164.

Centers for Medicare and Medicaid HIPAA Security Series

Tags: access control, addressable, audit controls, authentication, covered entities, email security, email security rule, encryption, ePHI, Health Insurance Portability and Accountability Act, heathhealthcare, hipaa, hitech, integrity, omnibus, phi, privacy, protected health information
Posted in AAA Featured Articles, LuxSci Library: HIPAA
9 Comments »

4 Security Tips for Cybersecurity Awareness Month

Wednesday, October 26th, 2022

October is Cybersecurity Awareness Month, and it’s worth taking a minute to reflect on your security stance and what you can do better to protect sensitive data and accounts.

cybersecurity awareness month tips

The Current State of Cybersecurity in 2022

Cybersecurity incidents and data breaches continue to increase across all industries. A 2022 report noted a 42% increase in cyberattacks for the first half of 2022 compared to the same period in 2021.

The healthcare sector also continues to be a target. The same report noted a 69% increase in cyberattacks targeting the healthcare sector. The Office of Civil Rights also noted that breaches affecting 500 or more individuals increased from 663 in 2020 to 714 in 2021.

Even more concerning, 74% of the breaches reported to OCR in 2021 involved hacking or IT incidents. In the healthcare sector, hacking represents the greatest threat to the privacy and security of PHI. Organizations must take the threat seriously and take concrete steps to protect their systems.

4 Essential Steps for Better Cybersecurity

So what can you do to avoid falling victim to a cyberattack? The Cybersecurity & Infrastructure Security Agency (CISA) recommends these four essential steps that all employees can take to protect their accounts.

Watch Out for Phishing Scams

Think before you click! Educate employees on common phishing tactics, create policies to help reduce risk, and invest in tools that flag suspicious emails. Phishing tactics are successful because they prey on common human impulses to manipulate individuals into taking quick actions.

Teaching employees what to look out for and putting in place email filtering systems to flag suspicious senders and links can drastically reduce your risk and the probability of your organization falling victim to a hacking incident.

Update Software

Many people find software updates annoying and snooze them for as long as possible. However, many software updates include security patches for recently identified vulnerabilities. By not updating to the latest version, it leaves your organization vulnerable to attacks.   

Use Strong Passwords

It’s an obvious tip to many security professionals, but many people still use weak passwords that are easy to guess. Today it is easier than ever to crack simple passwords using dictionary attacks or finding credentials on the dark web.

Employees should use unique passwords for each account. In addition, passwords should be:

  • Randomly generated
  • Use a combination of letters, numbers, and characters
  • At least ten characters
  • Stored securely in a password manager
  • Not shared with other employees

Enable Multifactor Authentication

As we mentioned above, cracking passwords is getting easier, especially if employees are not using strong, complex credentials. Enabling multifactor authentication adds another layer of security to account logins. Multifactor authentication requires users to present two or more credentials to log in to their accounts. The first factor required is a typical username and password. The second factor is usually a code contained within a text, email, or push notification. The user must enter this numerical code to confirm that they are logging into the account. Even if your username or password is compromised, a hacker will not be able to access the account without that second factor. It’s wise to require the use of multifactor authentication, especially for accounts that contain sensitive data. 

Conclusion

Of course, these tips only scratch the surface of a successful security and compliance program. To get started, complete a risk assessment to identify gaps and areas to improve. LuxSci is here to help improve your email security.

Tags: 2fa, access control, cybersecurity, cybersecurityawarenessmonth, email filtering, mfa, multifactor authentication, password manager, password security, phishing, risk assessment, software updates
Posted in LuxSci Library: Security and Privacy
Comments Off on 4 Security Tips for Cybersecurity Awareness Month

Improve Account Security by Enabling Multifactor Authentication

Tuesday, May 17th, 2022

This month, the Cybersecurity and Infrastructure Security Agency (CISA) launched an initiative called MFA May to encourage individuals and businesses to enable multifactor authentication for their accounts. This article defines multifactor authentication and explains why organizations should implement it to improve the security of their accounts.

multifactor authentication

 

What is Multifactor Authentication?

Multifactor authentication requires users to present two or more credentials to log in to their accounts. Multifactor authentication is sometimes called two-factor authentication for this reason. The first factor required is a typical username and password. The second factor is usually a code contained within a text, email, or push notification. The user must enter this numerical code to confirm that they are logging into the account. Sometimes an authenticator application is used to generate the code. Instead of a numerical code, the second factor could be a biometric marker like a thumbprint scan.

By requiring a second piece of information to log in to an account, multifactor authentication increases the security of accounts. Even if a hacker gets ahold of your password, they will be unable to log in to an account without the second piece of authentication.

How Multifactor Authentication can Stop Cybercriminals

As you can tell, multifactor authentication is an effective tool for limiting account access. A study by Microsoft found that users who enable multifactor authentication for their accounts will block 99 percent of automated attacks.

It is easier than ever before for hackers to acquire users’ passwords. Data breaches compromise millions of account credentials each year, which can be purchased on the dark web for pennies. Hackers can also use dictionary attacks to guess simple passwords using computer technology. Lastly, users may unwittingly hand over their credentials to a malicious actor during a phishing attack.

However, administrators can stop these attacks by enabling multifactor authentication. Even if a hacker knows your password, they will be unable to access your account without that second piece of information.

How to Enable Multifactor Authentication

Many vendors now offer multifactor authentication. We recommend enabling it as often as possible, especially for sensitive accounts like email, financial accounts, and medical records.

LuxSci has offered options for multifactor authentication to our users for over a decade. Users have the flexibility to choose the second option for authentication. They can choose to send a token to an alternate email address or enable a third-party app like DuoSecurity or Google authenticator to validate their identities. Please contact our support team to learn more about enabling multifactor authentication on your LuxSci account.

Conclusion: Why Use Multifactor Authentication

Cyber threats are increasing across all industries. Although HIPAA does not yet require users to implement multifactor authentication, security experts strongly recommend it. Enabling multifactor authentication is an inexpensive and effective way to improve your security posture. Although users may object to the extra step, enforcing multifactor authentication as an administrator is a smart move.

Tags: 2fa, access control, authentication, cybersecurity, login, mfa, multifactor authentication, secure login, two-factor authentication
Posted in LuxSci Library: Security and Privacy
Comments Off on Improve Account Security by Enabling Multifactor Authentication

HIPAA Compliance for Mobile Apps

Tuesday, November 9th, 2021

Many people rely on mobile devices to access the Internet, and apps are a convenient way to deliver online services. The health industry has also turned to mobile apps to provide health care services on the go.

In some industries, developing apps may be relatively straightforward. However, those that deal with PHI need to understand the HIPAA compliance requirements for mobile apps. If your company’s app isn’t HIPAA compliant, it could result in heavy fines or a data breach, which could seriously harm your business’s finances and its reputation.

To develop a HIPAA-compliant app, privacy and security need to be considered from the start.

hipaa compliance for mobile apps

What Exactly Is an App?

Before we get too deep into HIPAA compliance, we should take a step back and clarify what an application is. Most people use them every day, but not everyone will know how they differ from other kinds of software.

At its highest level, an app is a software program that is designed to help users perform activities. This contrasts with system software, such as an operating system, which generally works in the background.

The three main types are web apps, desktop apps and mobile apps. Web apps run in your browser, things like your webmail or Google Translate. Desktop apps tend to be full-featured, while mobile apps are stripped-back versions that focus on making the most out of the tablet or smartphone experience. There are also hybrid apps that embed mobile websites inside apps.

While Microsoft Word and the alarm clock on your phone are both apps, people will often be referring to mobile apps when they use the term.

Does My App Need to Be HIPAA-Compliant?

Health and wellness apps have become more sophisticated and are often recommended by medical practitioners to help patients manage medical conditions. However, not every app is required to meet HIPAA regulations. To determine whether an app should be HIPAA-compliant, consider whether your business practices make you a covered entity or a business associate of an entity.

Another complex aspect is understanding what actually counts as PHI. PHI is identifiable information that includes medical test results, prescriptions, billing details and insurance, among an array of other things. Weight loss data, calories burned, heart rate and other similar readings are not normally considered PHI unless they are attached to identifiable information.

If your business processes PHI as a covered entity or a business associate, you are subject to HIPAA regulations. If your company offers services directly to customers that are unrelated to their healthcare provider or insurance, it is unlikely to be covered by HIPAA.

Because of this, apps like MyFitnessPal are exempt from the regulations, because they don’t process PHI, nor do they conduct their business through healthcare providers. Conversely, an app from your health plan that stores your healthcare records would be regulated under HIPAA. Similarly, email, chat, texting, and video conferencing apps that may be used by healthcare providers to communicate with their patients would also need to be HIPAA-compliant. 

If you do not secure PHI properly, you could be subjected to financial penalties. The FTC recently announced it will begin enforcing the Health Breach Notification Rule for health apps. The rule requires entities to deliver breach notices to customers by first class mail no later than 60 calendar days after discovering a breach. Companies must also notify the FTC and in some cases, the media. Companies can face penalties up to $43,000 per violation per day for noncompliance.

HIPAA Compliance for Mobile Apps

If your company has an app that falls under HIPAA regulations, you will need to put serious consideration into its privacy and security measures. It is best to keep HIPAA in mind from the earliest planning stages to ensure that the app is compliant and to reduce the chance of penalties or any significant breaches. App security starts with corporate compliance; your company and your developers need to do all of the things necessary for compliance (see HIPAA Compliance Checklist), including training, risk assessments, etc.

From the app design stage forward, you should limit the use and sharing of PHI in your App to the minimum that is necessary to complete the task. If your data is processed by any outside entities, you will also need to sign a business associate agreement (BAA) with them to ensure that they are complying with the regulations as well.

You should also understand the additional risks that come with processing PHI on devices. Smartphones and tablets can easily be lost or stolen and they have a range of features that bring new security challenges.

Developing an app brings up a different set of complications when compared to SaaS (software-as-a-service .. i.e. using web-based applications), because apps generally store data locally and need access control measures in place to ensure that the data is secure. Because of this, it is best to go above and beyond HIPAA regulations to safeguard your customer data.

Control Access to Protect PHI

Access control is critical for apps that process PHI. Mobile devices have a high risk of being stolen or accessed by unauthorized entities. With the right access control measures in place, the risk of anyone being able to view sensitive patient data is minimized.

First, ensure that your app can only be accessed with a unique ID. To authenticate their identity, a user also needs to prove who they are. Require the use of a strong password or biometric data (like fingerprints) to login.

If PHI is going to be available in an app, automatic logoff is important for preventing unauthorized access. People often keep their apps logged in and leave their devices unattended. Without automatic logoff after a set period of time, the user’s PHI becomes more vulnerable to unauthorized access. Many apps neglect auto-logoff and keep users logged in indefinitely, relying instead on the device’s own login and logoff functionality instead. This may be sufficient to pass your HIPAA risk assessments; however, it is far more secure (though far more annoying) to institute app-level login and logoff requirements. Perhaps the pervasiveness of biometrics will make remove the annoyance factor of requiring authentication to gain access on demand.

We highly recommend that app developers institute auto-lockout after a short period of inactivity and use fingerprints or other means to resume access. Several access failures should cause your app to back off and require the full regular password to re-authenticate. This mitigates the weaker nature of a fingerprint or pin for access resumption.

Encrypt App Data

Encryption is another key aspect of preventing PHI from being exposed. Data should be encrypted at all times except when it is in use. This prevents anyone who may be listening in from accessing the data. Instead of being able to view the PHI, all they will see is ciphertext. Data encryption can safeguard PHI from other running apps and from attackers who may be trying to break into a device’s hard drive. Relying on a device’s disk encryption provides a basic layer of safety, but it does not protect data against other malicious running apps.

Auditing to Monitor Access

Any HIPAA-compliant app should have mechanisms in place to monitor and log access to PHI. These logs help detect any unauthorized access in the event of a breach.

HIPAA-Compliant Web Hosting

Apps are often just the front-end interface of a company’s website. To protect data on the back-end, host the website with a HIPAA-compliant provider. Your company needs to sign a business associate agreement with the provider to ensure that they are safeguarding PHI. LuxSci offers HIPAA-compliant hosting and we even have a free eBook that goes through the subject in more depth.

Keep Your App Updated

The threat landscape is constantly changing. Update your app whenever new vulnerabilities are discovered to protect patient data. Outdated apps are easy targets for hackers, so it is essential to patch regularly.

Be Careful with Push Notifications

Push notifications are visible even when a screen is locked. Do NOT include PHI in these notifications. If someone else sees a push notification that contains PHI, it could be considered an unauthorized access violation. This unauthorized disclosure could result in fines for your organization.

Mobile Apps Are Easy to Use, but Are They Secure?

Many healthcare organizations are seeing the value in developing apps for their patients because of their simple nature and ubiquity. While apps can certainly be useful, companies need to tread carefully and consider HIPAA regulations from the start.

Devices and apps introduce a range of security and privacy issues. It is exceedingly important that adequate measures are taken to guard the PHI of users. If neglected, your organization could face significant penalties or a serious breach. When developing a mobile application, consider your security and compliance requirements from the start.

Tags: access control, app, hipaa, hipaa compliance, hipaa-compliant web site, mobile app, phi, smartphone, web hosting
Posted in LuxSci Library: HIPAA, LuxSci Library: Security and Privacy
No comments »

Zero Trust and Dedicated Servers

Tuesday, July 6th, 2021

We will continue on in our series on Zero Trust, this time discussing Zero Trust and dedicated servers. As a quick recap, the Biden Administration ordered all federal agencies to develop a plan to adopt Zero Trust Architecture. This is a security model that begins with the assumption that even an organization’s own network may be insecure.

It accepts that bad actors may be able to penetrate the network, therefore a network designed under the Zero Trust model is built to make security perimeters as small as possible. Zero Trust Architecture also involves constantly evaluating those who are inside the network for potential threats.

One of the core aspects of Zero Trust Architecture is the concept of trust zones. Once an entity is granted access to a trust zone, they also gain access to other items in the trust zone. The idea is to keep these trust zones as small as possible to minimize what an attacker would be able to access if there is a breach.

Dedicated servers are a critical component of trust zones and Zero Trust Architecture as a whole.

zero trust and dedicated servers

The Role of Dedicated Servers in Zero Trust Architecture

Dedicated servers are an important part of Zero Trust Architecture. LuxSci customers can host their services on their own dedicated servers or server clusters, instead of sharing a server with other clients who may introduce additional threats. This isolates an organization’s data and resources from other entities, creating a small trust zone.

LuxSci also uses micro-segmentation to protect each customer’s server cluster. Our solution is host-based, and the endpoints are protected by firewalls. Each customer’s server (or cluster of servers) is dynamically configured in a micro-segment using server-level firewalls. This means that each customer is separated from others, and there is no privileged access between customers.

As a dynamic host-based micro-segmentation solution, this setup adapts fluidly to software modifications, service alterations, customer changes, and new developments in the threat landscape (as detected by automated systems).

Our customers can also choose to place a static traditional network firewall in front of their assets. This acts as an additional line of defense. With this traditional firewall on top, both customer assets and the dynamic micro-segment are placed in a well-defined network segment with added ingress and egress rules.

Access Controls

LuxSci’s dynamic host-based micro-segmentation solution is complemented by our flexible and highly configurable access controls. These include:

  • Two-factor authentication
  • Time-based logins
  • IP-based access controls
  • APIs that can be restricted to the minimum needed functionality
  • Application-specific passwords

These configuration options allow your organization to tailor access to your systems on a more granular level, limiting unauthorized access while still making resources available where necessary.

Limiting access and verifying user identities are important aspects of Zero Trust Architecture. These access controls fit hand-in-hand with our micro-segmentation setup for protecting server clusters.

Zero Trust: Dedicated Servers vs Shared Cloud Systems

A shared cloud system is not suited to the Zero Trust model, because the data and computations for different customers are managed in a shared environment. This means that segmentation isn’t possible, so the potential threats from other customers on shared resources can’t be eliminated. The risks of using a shared cloud server have been well-documented elsewhere. The industry’s shift to Zero Trust Architecture only reinforces the importance of using dedicated server environments.

Compared to cloud environments, dedicated servers are better aligned with Zero Trust Architecture. LuxSci’s dynamic customer micro-segmentation isolates customers from each other, protecting your organization from these additional threats. A second layer of network firewalls only serves to reinforce the separation, making the defenses even more formidable.

Contact our team if you want to learn more about how dedicated servers and Zero Trust Architecture can help to protect your organization from advanced threats.

Tags: access control, dedicated servers, firewall, zero trust
Posted in Dedicated & Cloud Servers, LuxSci Library: Security and Privacy
Comments Off on Zero Trust and Dedicated Servers

« Older Entries