HITEQ Health Center Cybersecurity Defender Against the Dark Web

Health Centers are being inundated by an unprecedented surge in cybersecurity incidents that are having detrimental effects on healthcare worldwide. New, sophisticated threats seem to appear on a daily basis. Most importantly, these threats are primarily being targeted and spread through end users (vs health IT systems) through social engineering and phishing attack methods. 

Healthcare cybersecurity is the ultimate team sport. The responsibility goes beyond the IT staff and includes front and back office staff, doctors and nurses, patients, executives, and the board of directors. These resources are directed at all levels of the healthcare organization so that they may be proactive and aware and help to defend Health Centers against the Dark Web.

Take some time to read through some of the articles on this page and then fill out the submission form on the right and you will be rewarded with a Health Center Defender Against the Dark Web badge! This is an official badge that is submitted by the HITEQ Center as a proof of completion to the blockchain. Your credentials can be added to profiles such as LinkedIn and verified through accreditation services such as Accredible and Open Badge.

 

Creating and Managing Strong Passwords at Your Health Center

44010
Creating and Managing Strong Passwords at Your Health Center

Guidance in relation to updated NIST security requirements and HIPAA

Question: Is it acceptable/recommended for health centers to adopt the new password policy guidelines under NIST Special Publication 800-63B and will that still uphold the HIPAA security rule?

This question had been posed to the HITEQ Center asking whether we had any guidance or recommendations on implementing the new NIST Guidelines regarding password security.  New Digital Identity Guidelines under NIST Special Publication 800-63-B presents new guidelines regarding password security that are much more user-friendly and consequently more likely to be observed by health center staff since constantly changing, complex password on multiple systems can be a source of frustration for the end user. 

After consulting with HITEQ cybersecurity experts and consultants who have helped publish cybersecurity guidelines, the recommendations outlined below were communicated.

Answer: The short answer is Yes. HIPAA is not prescriptive and takes the general stance that authentication mechanisms should be “reasonable and appropriate” for the risk they present. Being able to say that you are implementing NIST Standards is a good way to show that you are implementing “reasonable and appropriate” controls.

Some standards are relaxed in regards to password change and complexity, those items shouldn’t be taken in isolation. The additional controls in the 800-63 recommendations should also be put in place and can include:

  • Having users check passwords against password lists from breaches (e.g., https://haveibeenpwned.com/Passwords )
  • Increasing the length requirements
  • Getting rid of password reminder questions
  • Increasing usability

Further Guidance from NCCIC/US-CERT: NCCIC/US-CERT reminds users of the importance of creating and managing strong passwords. Passwords are often the only barrier between you and your personal information. There are several programs attackers can use to help guess or "crack" passwords. However, choosing strong passwords and keeping them confidential can make it more difficult for others to access your information.

NCCIC/US-CERT recommends users take the following actions:

  • Use multi-factor authentication when available.
  • Use different passwords on different systems and accounts.
  • Don't use passwords that are based on personal information that can be easily accessed or guessed.
  • Use the longest password or passphrase permissible by each password system.
  • Don't use words that can be found in any dictionary of any language.
  • Refer to Tips on Choosing and Protecting Passwords and Supplementing Passwords for best practices and additional information.
Previous Article The Health Center CIO’s Guide to HIPAA Compliant Text Messaging
Next Article Health Center Defense Against the Dark Web Presentation
Intended AudienceCIO's, Privacy & Security Staff, health center staff

Leave a comment

Add comment

Health Center Defender Against the Dark Web Badge Confirmation