Electronic Health Reporter

By Milica Vojnic, digital marketeer, Wisetek.

In no small part to the fact that we live within a decidedly digital society, it only stands to reason that securing personal and private information is now one of the most pertinent concerns. This is also why the European Union created the General Data Protection Regulation (GDPR) protocol to mitigate the chances of private material falling into the wrong hands. Of course, some sectors tend to be more vulnerable than others. One striking example involves the e-health community. This article highlights the steps firms can take to better protect their clients and remain in full compliance with GDPR guidelines.

The Role of ITAD for Health Organizations

First and foremost, the notion of IT Asset Distribution (ITAD) is critical to address before moving on. The main concern involves the fact that important patient information (such as names, email addresses and financial details) may be inadvertently stored within end-of-life devices such as computers and mobile phones. If they are not disposed of properly, there is always a risk that this data can be subsequently accessed by a (potentially nefarious) third party. ITAD provides start-up healthcare organisations with a handful of options including:

• Overwriting the existing information.
• Magnetically erasing the data; rendering it completely inaccessible.
• Physically destroying the device(s) in question.

As these processes are not normally able to be accomplished through the use of in-house techniques, it is better to outsource such solutions to third-party vendors with a proven track record.

A Disturbing Trend Within the Healthcare Sector

Another issue which start-up online healthcare providers must overcome involves online security in relation to current GDRP regulations. This has been highlighted by a handful of stark facts; perhaps the most worrisome is that 66 percent of firms still do not utilise a secure HTTPS server. Not only will this place the data of patients at risk, but it also augments the chances that the website in question could fall victim to hacking and similar activities. Thus, it is crucial that all e-health portals adopt the appropriate SSL (Secure Sockets Layer) systems to avert any possible breaches sooner as opposed to later.

The Notion of User Consent

Transparency is one of the core tenets of GDPR regulations. In terms of the end user, this comes in the form of explicit permission to access specific data sets. This can be accomplished through the use of an interactive widget employed during the initial registration process. Visitors will be able to check certain boxes in order to illustrate that they consent to any subsequent data collection methods that may be utilised. There are additional metrics that should be emphasised including:

• A clear explanation of why certain information may be required.
• How this data will be used.
• Whether or not it will be potentially shared with any third parties.

Not only will this approach ensure that the e-health portal in question is adhering to all relevant GDPR regulations, but it can provide the visitor with a heightened level of trust.

Implementing a Data Protection Officer

This recommendation is particularly relevant for budding e-health firms. There are several roles attributed to a Data Protection Officer (DPO) including:

• Monitoring the core activities of your organisation.
• Ensuring that these actions are compliant with GDPR guidelines.
• Training employees on how to enhance online privacy.
• Maintaining real-time records in order to guarantee a greater sense of in-house accountability.

It is therefore wise to consult professionals such as a lawyer specialising in GDRP compliance in order to determine if a Data Protection Officer is needed for your organisation.

Additional Security Recommendations

This final topic will often depend upon the e-health organization in question, as recommendations revolve upon its size and scope of operations. For instance, firms associated with telecommuting must educate all employees about the hazards attributed to security breaches. Additional methods (such as 256-bit AES encryption) may likewise be warranted alongside allocating pseudonyms to clients to avoid possible identification in the event of a data breach. VoIP systems and robust antivirus firewalls will also help to provide an additional layer of protection while simultaneously avoiding any downtime that might come because of a third-party attack (such as a DDoS breach).

Final Thoughts

Please note that the recommendations outlined above may change depending upon the type of e-health organisation. They are nonetheless critical to remaining in compliance with current GDPR regulations.

Of course, implementation can often be a challenge for start-up firms. This is why it is often prudent to outsource such requirements to third-party vendors that specialise in offering bespoke solutions based on the needs of the business in question.

As the digital health community continues to expand, it only stands to reason that preventative measures will need to be taken in order to protect the information of all clients.