Protecting PHI On Medical Devices

Salman Khan, MBA, CISSP, CISA

Brook Syers, CPA, CIA, CFE, CISA

Transcript

1. Protecting PHI On Medical Devices Salman Khan, MBA, CISSP, CISA Manager, IT Security Brook Syers, CPA, CIA, CFE, CISA Senior IT Audit Manager, Auditing & Advisory Services
2. In The News…
3. An unencrypted medical device with more than 500 records is lost or stolen, resulting in: • Loss of trust with patients • Bad publicity • Investigation • Financial exposure • Unplanned Capital Expenditure
4. In August 2013, an unencrypted UTHealth laptop containing 596 patient records was stolen from a locked closet inside an orthopedic clinic. The laptop was not inventoried because it was considered a medical device. Breach notification was made to patients, media, and HHS. OCR investigated; fortunately, UTHealth was cleared. The Case Of The Missing Laptop…
5. Medical and Scientific Device Policy (implemented 11/13/13): All medical & scientific devices that are able to store PHI must be encrypted or configured so that PHI is unable to accumulate beyond 100 records if encryption is not permitted by the manufacturer. Policy & Work Flow Any exceptions to this policy must be submitted (Requests) to the CISO for review and approval. A Work Flow Agreement is signed, indicating the individuals who are responsible for performing compensating controls and verifying compliance.
6. Requests
7. Requests – Cont.
8. Work Flow Agreement
9. Work Flow Agreement – Cont.
10. Quarterly Procedures [Performed By Audit/IT Security] 1. Obtain a list of all clinics and select a sample. 2. For each clinic: • Obtain all current Requests and Work Flow Agreements for all medical devices. • Perform an unannounced field inspection and verify compliance with all Requests/Work Flow Agreements regarding number of patient records (100 or less) and deletion of records at the stated time interval (25 days or less) • Verify implementation of compensating controls, if applicable. • While onsite, search for medical devices with no Request/Work Flow Agreement.
11. Audit Report to Management FY19 4Q
12. Insights & Trends Quarter Devices Audited Exception Rate Devices > 500 Records 1Q 53 30% 1 2Q 28 14% 0 3Q 33 43% 2 4Q 30 40% 1 1Q ---> 2Q: Word getting out that Medical Device audits are taking place [in Med Center]. 3Q ---> 4Q: Expanded audits to satellite clinics.
13. • Management awareness and follow-up on exceptions • Requests/Work Flow Agreements added for medical devices identified by audits • Revision of Clinical Technology policies & procedures • Identification of missing medical devices • Increase in user community awareness/saving money Benefits
14. • TigerConnect (past) • FairWarning (past) • School of Dentistry SD Cards (past) • Cloud Vendors (ongoing) • Medical Devices (ongoing) • Practice Websites (future) IT Security & Audit Collaboration