HCIS 352 Week 4 Healthcare Information Operational Security Risks Example

Twelve Clinics, One Cloud and a Remote Desktop Left Open: The Operational Security Risks Facing an Outpatient Physical Therapy Group and How to Rank Them

[Student Name]

University of Phoenix

HCIS/352: Foundations of it in the Health Care Environment

Week 4 Assignment

[Instructor Name]

[Date]

The practice group, its incidents and its figures are composites written for a model paper; guidance and findings come from the sources listed.

Last spring, the IT contractor for a composite outpatient physical therapy group noticed thousands of failed login attempts on a remote desktop connection that someone had opened years ago for a vendor and never closed. No one had broken in, but the attempts showed that attackers had found the door. The group, with 12 clinics, 140 staff and about 1,800 visits a week, had recently moved scheduling, documentation and billing to cloud services and assumed that security was now the vendors' job. This paper describes the operational security risks a walk-through revealed, ranks them and recommends controls.

The Environment

Therapists document on laptops and tablets using a cloud-hosted therapy EHR. Front desks use shared workstations for scheduling and payments. Billing is outsourced to a company that logs into the EHR remotely. Each clinic has exercise equipment with attached tablets that track patients' exercises, and a network that also serves patient Wi-Fi. There is no IT department, only the contractor, available eight hours a week, and no one on staff owns security.

Eight Risks

Exposed remote access: the open remote desktop connection to an office server still holding old scanned records. Phishing: staff email accounts protected only by passwords. Shared logins: front desk staff at several clinics share one scheduling account. Unpatched devices: exercise equipment tablets running an outdated operating system, on the same network as clinic laptops. Lost or stolen laptops: therapists take laptops home, and two were stolen from cars last year, one without encryption. Vendor outage: if the cloud EHR goes down, clinics have no downtime procedures. Former employees: accounts are removed by email request, sometimes weeks late. Backups: the old office server's backups are stored on a drive attached to the same server.

Rating the Risks

Each risk was rated from 1 to 3 for likelihood and for impact, and the two ratings multiplied. Exposed remote access scored 9, likely and severe, because remote desktop is a common ransomware entry point and the server held patient records. Phishing scored 9 as well. Unencrypted laptops and shared logins scored 6. Former employee accounts and backups on the same server scored 6. Unpatched equipment tablets scored 4, and a vendor outage 4. The ranking changed the group's instinct, which had been to buy new antivirus software; the top risks were an open door and passwords without a second factor, both of which cost little to fix.

Why the Top Risks Come First

Neprash et al. (2022) counted 374 ransomware incidents at American hospitals, clinics and other care providers across six years ending in 2021, with yearly incidents more than doubling, and found that almost half disrupted care, most often through downtime, sometimes through canceled appointments. For a therapy group, a ransomware attack would mean days of canceled visits and lost revenue, along with notification of patients whose records were exposed.

Controls Matched to the Risks

A federal public-private effort known as the 405(d) program publishes Health Industry Cybersecurity Practices, including a technical volume for small organizations, whose recommended practices for smaller practices range from protecting email and endpoints to managing access, preventing data loss and training staff (U.S. Department of Health and Human Services, 2023). The group's controls follow that guidance. Exposed remote access: close it immediately, move remaining records to the cloud EHR and give the billing company access only through the EHR's own accounts with multifactor login. Phishing: turn on multifactor authentication for all email, add external-sender warnings and run quarterly phishing training. Shared logins: issue individual accounts and set screen locks. Laptops: encrypt every device and enroll all in remote management so they can be wiped. Former employees: link account removal to the payroll change form, with a same-day deadline. Backups: move backups off the server to an offline or immutable cloud copy.

The Lower-Ranked Risks

Equipment tablets will be moved to a separate network segment, since they cannot be patched quickly. For vendor outages, each clinic will print the next day's schedule and keep paper evaluation forms, and the group will review the vendor's uptime and incident history at contract renewal.

People as the Last Line

Several of the eight risks are really habits: sharing a login to save time, leaving a laptop in a car, clicking a convincing email. Controls help, but staff behavior decides how well they work. The group's clinic managers will spend five minutes of each monthly staff meeting on one security habit, using real examples from the walk-through without naming anyone, and front desk staff will be told plainly that reporting a suspicious email or a lost device quickly is never a disciplinary matter. A group this size cannot afford a security team, but it can build a culture in which people notice problems and speak up.

Meeting the Rules

Under the HIPAA Security Rule, covered entities must assess and manage risks to electronic protected health information using administrative, physical and technical safeguards (U.S. Department of Health and Human Services, 2022). The walk-through and ratings form the start of the group's documented risk analysis, which it had never completed.

Costs

Multifactor authentication is included in the group's email subscription. Device management and encryption cost about $6 per device per month. Network segmentation for 12 clinics costs about $9,000 once. Training costs about $2,000 a year. Additional contractor hours for the first quarter cost about $12,000.

Ninety-Day Action List

Week 1: close remote desktop access and enable multifactor email login. Month 1: encrypt all laptops, create individual accounts and move backups. Month 2: segment equipment tablets and link account removal to payroll. Month 3: write downtime procedures, run the first phishing exercise and repeat the walk-through to confirm each fix.

Conclusion

Moving to the cloud did not move the group's security risks away. An exposed remote connection, weak email protection, shared logins, unencrypted laptops and poor account and backup practices were the real threats. Rating them showed that the most dangerous risks were also among the cheapest to fix.

References

Neprash, H. T., McGlave, C. C., Cross, D. A., Virnig, B. A., Puskarich, M. A., Huling, J. D., Rozenshtein, A. Z., & Nikpay, S. S. (2022). Trends in ransomware attacks on US hospitals, clinics, and other health care delivery organizations, 2016-2021. JAMA Health Forum, 3(12), Article e224873. https://doi.org/10.1001/jamahealthforum.2022.4873

U.S. Department of Health and Human Services. (2022). Summary of the HIPAA security rule. https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html

U.S. Department of Health and Human Services. (2023). Health industry cybersecurity practices: Managing threats and protecting patients (2023 ed.). 405(d) Program. https://405d.hhs.gov/public/navigation/hicp