2.

Security definitions

Understand the approaches and practices of information security.

• Access Control: viewing, storing, copying, modifying, transferring, and deleting information.

• Access Control Models: Mandatory Access Control, Discretionary Access Control, Role-Based Access Control.

• Data Encryption: technical control or solution to protect information confidentiality.

• Training and Awareness: Training and awareness can help prevent the breaches caused by employee mistakes.

• Logging and Monitoring: a log is a record for store and collect events, network, applications, and end user devices.

• Segregation of Duties: Administrative job sharing.

• Least Privilege: permissions, rights, and privileges necessary to perform your assigned duties.

• System Recovery: A process for bringing the systems back after a power outage or malware attack.
Information protection and initiatives
• A medical device can be Following forms: X-Ray, MRI, Stethoscope, Diognistic Set, Pulse Oximeter,
Clucometer, Autoscope, Opthalmoscope, Patient Monitor, Oxygen System and more…

• Medical devices entered the medical marketplace the U.S. government agency taken under U.S. Food and
Drug Administration (FDA)

FDA List of Medical Devices – Download Here

A brief history of medical device law and associated privacy and security guidance
Data breach impact

• Data breaches may also cause patients to lose trust in the organization.
• A breach may cause an organization to lose revenue.
• All these impacts may occur with a data breach.

A small sample of
results from data
breach surveys and
investigations.
Workforce competency

Many data breaches happening globally, many call for measures to provide for and ensure that
healthcare has trained and competent workforce members protecting sensitive information.
 Cybersecurity Workforce:
 Threats are real, and attacks come from many sources, including hackers, nation states, terrorists, and
organized crime.
 To provide cybersecurity defenses, we must have the right people equipped and trained in the right positions in
the organization.
 Convergence of Skill Sets:
 H/C cyber security workforce comes from information technology background.
 People comes from background of biomedical engineering or health information management.
 Government Initiatives:
 shortage of qualified cybersecurity workers. All industries have a need for these workers, and healthcare is no
exception.
 National Initiative for Cybersecurity Education (NICE)
 National Health System (NHS)
 National Health - Information Sharing and Analysis Centers (NH-ISAC)
Workforce measures

• Organization: The size and scope of the healthcare organization, along with services provided, level of technology
maturity, and third party business relationships.

• Education: Offerings and quality of curriculum delivery that either anticipates or at least reacts to business
requirements.

• Industry: Regulatory concerns, market pressures, clinical practices, and local and national competition.

• Privacy and security: Changes in controls and standards, technologies that better support information protection,
and policy and procedural effectiveness.