Today I’ll continue with a related theme to yesterday’s discussion on regulation. Specifically, a patient portal is secure. You can interpret security in a variety of ways but let me give my own spin.
- The data is secure
- The access point is secure
- Setup is secure
- The system will track anything that happens on the portal.
The Data is Secure
Because any protected health information (PHI) must be encrypted at rest, you already have one level of security. A well architected portal will also add in layers of firewalls to further ensure the sanctity of the data. A well architected portal will store as little key information on the portal itself and as much as possible on a back end system. Of course that back end system will only be available via a secured set of API’s and calls will only be allowed from trusted servers.
In other words, if you do your job correctly, getting access to that data should prove almost impossible from a coding based approach to hacking.
The Access Point Is Secure
By this we mean that you can’t just waltz in and see the data. Access will be granted with the following parameters:
- You must use a username and password
- More sophisticated sites will employ the same adaptive authentication banks do to ensure that you are who you say you are. This includes logging your computer or device as trusted and using security questions.
- Any login will be secured with https. The encryption behind https is always improving so it should be hard to break and will continue to get harder as we keep up with computing speed increases that make lower encryption levels more open to a brute force approach.
Setup Is Secure
This refers to the social hacking vulnerabilities in any system. Because the security team at any hospital must think through the consequences of any breach that they could have reasonably prevented, they have to consider the social aspect. In most hospitals, you can only get your patient login if
- You present your valid government id and you can prove you had services performed at the hospital. Proving services means that you can give them a unique and hard to get piece of information like your Medical Record Number (MRN) for your last visit.
- You are in the hospital for your procedure at that point in time. You will have already presented your id and they figure that if you just got your appendix out or your hip replaced, well you must be who you say you are.
- You enroll online but only after being queried about the MRN, invoice number, and specific questions only you would know based on your credit history. This last point only applies to the really sophisticated entities. Most rely on one and two above.
The System Will Track Anything That Happens on The Portal
While auditing does nothing to improve security, it does help to understand what happened to someone’s account and medical record. Most systems only audit transactions. Patient portals audit both views and transactions. So if you login to your account, we log it. If your proxy logs into the account and views your bills, we see it. If someone else within the hospital views your medical record via the portal, we see it and log it. As a patient, you also get to see that audit log.
Bottom Line
Professional Services and IT resources spend a lot of time and effort ensuring their patient portal remains resistant to hacking of any kind. Having seen too many exceptions in my life, I won’t say a well architected patient portal is impregnable. I will say that it’s more secure than most sites you visit on a daily basis.
