In response to an ever-worsening cybersecurity environment in healthcare, with an increasing number of cyberattacks on hospitals, health systems and clinics, the American Health Information Management Association has issued new cybersecurity guidelines for healthcare professionals to reference as they seek ways to implement cybersecurity prevention measures.

These include actions that can be started immediately as well as comprehensive efforts that require more long-term commitments. The roadmap, tittled, AHIMA Guidelines: The Cybersecurity Plan, was primarily authored by Kathy Downing, vice president, information governance, informatics, privacy and security, at AHIMA, who has the apt Twitter handle @HIPAAQueen.

[Also: Precision med is about to have its breakout moment ]

“Information governance – the development of an organization-wide framework for managing information throughout its lifecycle and supporting the organization’s strategy, operations, regulatory, legal, risk and environmental requirements – is a critical organizational initiative that healthcare organizations must embrace in order to thrive in the environment of cyber threats and attacks in healthcare today,” Downing wrote.

[Also: 2018 is primed for blockchain, big data and cloud computing advancements, all with a better security plan]

“The cybersecurity plan is a part of the privacy and security competency and needs to address people, processes and technology," she added.

The new cybersecurity guidelines outline 17 steps to completing a successful cybersecurity plan. These steps include:

1. Conduct a risk analysis of all applications and systems.
2. Recognize record retention as a cybersecurity issue.
3. Patch vulnerable systems.
4. Deploy advanced security endpoint systems that provide more effective protections than standard antivirus tools.
5. Encrypt workstations and laptops, smartphones and tablets, and portable media and backup tapes.
6. Improve identity and access management.
7. Refine web filtering (blocking bad traffic).
8. Implement mobile device management (MDM).
9. Develop incident response capability.
10. Monitor audit logs to selected systems.
11. Leverage existing security tools like intrusion prevention system/intrusion detection system (IPS/IDS) to detect unauthorized activities.
12. Evaluate business associates.
13. Improve tools and conduct an internal phishing campaign.
14. Hire an outside security firm to conduct technical and non-technical evaluations.
15. Prepare a “State of the Union” type presentation for an organization’s leaders on cybersecurity.
16. Apply a “defense in depth” strategy.
17. Detect and prevent intrusion.

"Review current access control protocols and tighten them up," AHIMA advises. "Another proactive step you can take is to conduct an evaluation or assessment of current security policies. If they have not been updated or modified to account for risks of hacking, this is an action item that should be undertaken."

Twitter: @SiwickiHealthIT
Email the writer: bill.siwicki@himssmedia.com