Electronic Health Reporter

By Paul Banco, CEO, etherFAX.

Healthcare organizations know just how important it is to comply with the HIPAA Privacy Rule to protect sensitive and unstructured data such as patient records, scripts, discharge summaries, medical forms, authorizations, prescriptions, and insurance claims. However, in the event of an emergency, HIPAA compliance is usually the last thing on people’s minds. As a result, hospitals are often granted a HIPAA waiver of up to 72 hours from the time they first implement their disaster protocol. Unfortunately, without a HIPAA waiver, hospitals may face substantial liabilities and penalties for non-compliance.

Even worse, if a hospital’s network is affected by a natural disaster, cyberattack, or system outage, doctors may not be able to access medical records and patients will not receive the proper care. With any type of downtime, some disruption within a hospital is expected to occur. In some cases, these disruptions could be life-threatening. Reports have shown that more than 2,100 patient deaths are linked to hospital data breaches each year. Unfortunately, doctors are often so preoccupied with remediation activities after a breach occurs that patients no longer receive quality care.

Secure exchange network

To prevent tragedies, human errors, and system failures from occurring in the event of an emergency, healthcare organizations must utilize a HIPAA compliant, secure, and trusted network. The ideal secure exchange network will leverage hybrid cloud technology and military-grade encryption to provide 100 percent secure communications at all times. Document and fax transmissions sent via a trusted network will never traverse an external telephone network and, therefore, will remain secure between the remote client site and the secure exchange network at all times.

Disaster recovery

In addition to a secure exchange network, having a complete disaster recovery solution in place is business-critical. A disaster recovery solution works to ensure that organizations never experience downtime while inbound and outbound fax communications remain secure and protected from technical failures due to catastrophic events and natural disasters.

Disaster recovery is also ideal for business continuity initiatives and managing high-volume, peak overflow fax operations. The ideal disaster recovery solution will feature built-in redundancy to guarantee uptime even when existing telephony equipment fails (such as fax boards, PRI lines, servers, and applications).

Legacy fax connectivity 

Many unsecured legacy systems still exist and often act as gateways for attackers to access and compromise sensitive data including medical records and insurance information. As legacy systems pose a massive risk to patient privacy, they must be extended to a secure exchange trusted network via the cloud that will provide the advanced security, compliance regulations, and endpoint authentication needed to mitigate risks. By extending legacy systems to the cloud before a catastrophic event or technical failure occurs, organizations will remain protected in the midst of security threats and cyberattacks.

End-to-end encryption

Lastly, all healthcare organizations should utilize well-defined end-to-end encryption methods, such as those defined in the Elliptic Curve Integrated Encryption Scheme (ECIES), to securely transfer information between two endpoints. The hybrid encryption scheme uses Elliptic Curve Cryptography to generate a shared secret between peers to seed the encryption process with unique keying material while signing and authentication mechanisms assure the validity of the data in transit. Even if a third-party attempted to eavesdrop on the network communication, the information itself would be indecipherable.

Overall, healthcare providers must implement an emergency response plan before disaster strikes. As a provider of secure document solutions, etherFAX knows how important 24/7 technical support and customer service are to maintain control over any unforeseen complications such as internet outages or cyberattacks. With a secure exchange network and disaster recovery solution in place, your organization can continue to securely operate without disruption and maintain HIPAA compliance during an emergency.