HITEQ Health Center Cybersecurity Defender Against the Dark Web

Health Centers are being inundated by an unprecedented surge in cybersecurity incidents that are having detrimental effects on healthcare worldwide. New, sophisticated threats seem to appear on a daily basis. Most importantly, these threats are primarily being targeted and spread through end users (vs health IT systems) through social engineering and phishing attack methods. 

Healthcare cybersecurity is the ultimate team sport. The responsibility goes beyond the IT staff and includes front and back office staff, doctors and nurses, patients, executives, and the board of directors. These resources are directed at all levels of the healthcare organization so that they may be proactive and aware and help to defend Health Centers against the Dark Web.

Take some time to read through some of the articles on this page and then fill out the submission form on the right and you will be rewarded with a Health Center Defender Against the Dark Web badge! This is an official badge that is submitted by the HITEQ Center as a proof of completion to the blockchain. Your credentials can be added to profiles such as LinkedIn and verified through accreditation services such as Accredible and Open Badge.

 

Health Center Emergency Response Resources

636
Health Center Emergency Response Resources

October 2024

Ready to take the next step towards enhanced IT preparedness? The resources linked below, organized by topic, share actionable strategies that health centers can implement to move towards greater resilience.

Preserving access to Electronic Health Record (EHR) data

The Office of the National Coordinator for Health Information Technology’s Safety Assurance Factors for EHR Resilience (SAFER) self-assessment for contingency planning identifies recommended practices for managing EHR downtime, including use of redundant hardware, regular backup of data, use of uninterruptible power supplies, and protocols for use of paper forms.

The American Medical Association’s Guidelines for Developing EHR Downtime Procedures includes a list of considerations that planners can use when developing or improving information technology EHR downtime procedures. 

Preventing cyber-attacks

The HITEQ Center’s Guide to Essential Cybersecurity Tasks For Health Centers with Limited Resources provides a baseline of day-to-day tasks that health center IT and compliance staff should consider to protect their systems and comply with regulatory requirements. These include strategies to prevent successful phishing attacks, limit unnecessary physical and virtual access to systems, and keep security patches up to date. 

Responding to cyber-attacks

The U.S. Department of Commerce National Institute of Standards and Technology’s Guide for Cybersecurity Event Recovery describes the contents of a typical cyber-attack recovery plan and includes a checklist of items (a “playbook”) that should be implemented as part of the recovery process. 

Leveraging EHR data for patient outreach

The HITEQ Center’s “Accessing Your Data: Questions to consider with your Electronic Health Record Vendor,” is a checklist that can be used to talk with vendors about how health centers use EHR system capabilities for activities such as report generation. Relevant questions include 1) whether data, including reports, can be accessed from any location at any time; 2) whether and how your practice can generate ad hoc reports; and 3) whether it is possible to query the EHR to identify certain patients, for example, those with particular conditions, using particular medications, or in a particular geography.

Some EHR enhancers, such as Relevant’s Data Explorer, enable health centers to use the EHR to build reports without writing code and automate text messaging to subsets of patients.

Sharing data to prevent or lessen a serious or imminent threat

The U.S. Department of Health and Human Services Office for Civil Rights’ Hurricane Katrina Bulletin: HIPAA Privacy and Disclosures in Emergency Situations and Summary of the HIPAA Privacy Rule address the use and disclosure of protected health information by covered entities when that disclosure is believed to be necessary to prevent or lessen a serious and imminent threat to a person or the public.

Sharing data to support care continuity

In addition to the strategies for preserving access to EHR data, participation in local or state health information exchanges (HIE) or in vendor-supported EHR based data-sharing initiatives (e.g., Epic's Care Everywhere or eClinicalWorks PRISMA) facilitates data sharing.  Learn more about HIE capabilities in HITEQ Highlights: Advancing Interoperability & Health Information Exchange for Health Centers.

 

Health Center Defender Against the Dark Web Badge Confirmation