To support the sudden increase in test results and medical records being transmitted during the pandemic, hospitals, laboratories, and pharmacies implemented additional devices and remote connections into their networks. After the Office for Civil Rights (OCR) lifted penalties around telehealth to expand care options amid the crisis, new platforms were adopted that were not previously allowed by the Health Insurance Portability and Accountability Act (HIPAA).
This exercise of discretion applied to applications including FaceTime and Skype, regardless of whether the telehealth service administered while using the apps was directly related to the coronavirus. Unfortunately, this also increased security risks across thousands of healthcare organizations. Since many communications apps are not HIPAA compliant, the risk of a data breach occurring that compromises personally identifiable information (PII) is imminent. For example, though Apple is a HIPAA business associate, it is not willing to sign a BAA, and therefore, Apple services including FaceTime are not HIPAA compliant.
In 2021, adopting new technology to ensure the health and safety of patients shouldn’t adversely affect security and privacy. Today, digital and direct fax solutions offer the flexibility to securely integrate with today’s popular mobile applications and third-party messaging platforms such as Slack, Teams, and Microsoft Fax while maintaining HIPAA, SOC 2, and PCI DSS compliance.
To ensure that protected health information (PHI) remains secure at all times, organizations should utilize a hybrid-cloud fax network that leverages defense-in-depth strategies including end-to-end encryption and two-factor authentication. Unlike traditional PTSN-based networks, digital fax technology can also ensure that time-sensitive documents are delivered fast with high-resolution, near-diagnostic image quality.
Here are the most important features your organization should look for to ensure telehealth security and protect patient data:
Direct Digital Fax
Many patients and organizations are unaware that a data exchange via email or text message will typically pass through multiple servers before it reaches the final point of delivery. This indirect transmission method can leave PHI and other unstructured data vulnerable to imminent threats of cyberattacks.
Utilizing a hybrid-cloud network with direct digital faxing is the key to ensuring communications never traverse an external telephone network and that data is protected against unauthorized access. Black and White lists can also be leveraged to place further restrictions on the exchange of sensitive information. This allows patients to receive high-quality care at home or in person without compromising their personal information.
HITRUST CSF Certification
The HITRUST CSF certification has become the gold standard for compliance framework in the healthcare industry as it addresses the requirements of existing standards and regulations including HIPAA, PCI, COBIT, NIST, ISO, FTC, and state laws. While the HITRUST CSF can be used by all organizations that create, access, store, or exchange sensitive and/or regulated data, it is ideal for healthcare organizations because of its prescriptive framework for managing the security requirements inherent in the Health Insurance Portability and Accountability Act.
HITRUST offers providers a trusted benchmark from which they can measure and manage their own compliance while offering proven protection to their patients and partners. For guaranteed security, healthcare organizations should look for a fax provider that is HITRUST CSF certified in addition to SOC 2 and PCI DSS compliant.
End-to-End Encryption
Implementing a secure exchange network that leverages well-defined end-to-end encryption methods, such as those defined in the Elliptic Curve Integrated Encryption Scheme (ECIES), is crucial to fully protect the transfer of information between two endpoints. This hybrid encryption scheme uses Elliptic Curve Cryptography to generate a shared secret between peers to seed the encryption process with unique keying material while signing and authentication mechanisms assure the validity of the data in transit. Even if a third-party attempted to eavesdrop on the network communication, the information itself would be indecipherable thanks to end-to-end encryption.
Two-factor authentication (2FA) should also be utilized on every device that sends and receives PHI. Two-factor authentication can prevent data breaches on applications and platforms by requesting a combination of credentials at access points that only the actual patient, doctor, billing operator, or pharmacist would know.
Overall, network security can have an adverse effect on patient care. To secure healthcare technology during the pandemic and beyond, organizations must extend legacy devices, remote connections, and telehealth services to a secure exchange network via the cloud. Hybrid-cloud fax technology can provide end-to-end encryption, two-factor authentication, and direct transmissions to protect the integrity of PHI while ensuring that business-critical communications are sent with ultra-fast transmission speeds.
About Paul Banco
As CEO and co-founder of etherFAX, Paul Banco is responsible for the strategic direction of the company and leads technology development, including the patented etherFAX and etherFAX SEN intellectual property. In 2009, he identified the need to leverage the cloud for secure document delivery and co-founded etherFAX with fellow telecom industry veterans. As a cloud-based and virtual solution, etherFAX enables healthcare organizations to securely send and receive information from a broad range of applications and endpoint devices.
