The Security Rule protects ePHI. It requires covered entities and business associates to protect the confidentiality, integrity and availability of ePHI:
- Confidentiality — only authorized people can see it.
- Integrity — it is not changed or destroyed improperly.
- Availability — it is there when authorized people need it, for example after a computer failure or ransomware attack.
The rule is flexible: each organization does a risk analysis and chooses safeguards that fit its size and risks. Some implementation specifications are "required"; others are "addressable". Addressable does not mean optional — the organization must put the measure in place if it is reasonable and appropriate, or document why not and use an equivalent alternative.
The three types of safeguards
Administrative safeguards — policies and people:
- a security officer responsible for security policies;
- a regular risk analysis and risk management;
- workforce security and access management — people get access only to what their role needs, and access is removed when they leave;
- a security awareness and training program for all workforce members;
- a sanction policy for workforce members who violate the rules;
- procedures for reporting and responding to security incidents;
- a contingency plan: data backup, disaster recovery and emergency operations.
Physical safeguards — places and devices:
- controlling access to buildings, server rooms and records areas;
- workstation use and security — screens placed away from public view, computers locked when unattended;
- device and media controls — tracking laptops and drives, and wiping or destroying them before reuse or disposal.
Technical safeguards — technology:
- access control, including a unique user ID for every person, emergency access procedures, automatic logoff, and encryption;
- audit controls that record who looked at or changed records;
- integrity controls and authentication that confirms people are who they say they are;
- transmission security that protects ePHI sent over networks.
What this means for you
Passwords and logins
- Never share your password or log in for someone else. Your user ID is how the audit trail knows what you did.
- Use strong passphrases and multi-factor authentication when offered.
- Lock or log off your workstation every time you step away, even for a minute.
Encryption and devices
- Store and send ePHI only with the tools your organization provides. Encryption protects information if a device is lost or stolen.
- Do not copy PHI to personal USB drives, personal email or personal cloud storage.
- Mobile phones and laptops that hold or reach PHI need a screen lock and must be enrolled or set up as your organization requires. Report a lost or stolen device right away.
Phishing
- Phishing emails pretend to be from IT, a manager, a vendor or a bank to get you to click a link, open an attachment or enter your password.
- Warning signs: urgency, threats that your account will close, unexpected attachments, a sender address that does not match, requests for passwords or gift cards.
- Do not click. Report the message the way your organization tells you to. If you already clicked or entered your password, report it immediately — fast action limits the damage.
Email and texting PHI
- Use only the email and secure messaging systems your organization authorizes for PHI, and follow its rules (for example, encrypting external email).
- Double-check the recipient before you press send; autocomplete errors are a common cause of misdirected PHI.
- Do not text PHI from a personal phone through ordinary text messaging unless your organization's policy specifically allows it.
- Patients may ask to receive information by unencrypted email or text. Organizations may do this after warning the patient of the risk and getting their agreement — follow your organization's procedure.
Scenarios
A pop-up asking for your password. A window appears saying your session has expired and asking you to enter your password into a page you do not recognize. Close it and report it. Legitimate IT teams do not ask for your password by email or unexpected pop-up.
A lost phone. Your work-enrolled phone is lost on the bus. Report it immediately, even late at night. IT may be able to lock or wipe it remotely, and the privacy officer needs to start assessing whether a breach occurred.
A shared workstation. At shift change, a colleague is still logged in at the medication cart computer. Do not chart under her login. Log her out (or ask her to) and log in as yourself, so the record shows who did what.
Key points
- The Security Rule protects the confidentiality, integrity and availability of ePHI.
- Safeguards are administrative, physical and technical; "addressable" does not mean optional.
- Never share passwords; lock your screen; use only authorized tools and devices.
- Report phishing, lost devices and suspected incidents immediately.