Electronic Health Reporter

By Chad Cragle, information security officer, FormAssembly.

Data collection is one of the most important processes in healthcare today. But outdated methods of data collection have made it increasingly difficult to both efficiently collect data and keep it secure. How companies collect patients’ health information is extremely important, as personal data can easily be exposed in the event of a breach.

As we saw earlier this year, the Quest Diagnostics breach caused about 11.9 million patients to have their data exposed. These kinds of breaches are especially delicate compared to other types of breaches, since you can usually replace credit cards or social security numbers, but you can’t retract what is released to the public. This kind of leaked information can have a negative effect on patients’ lives, perhaps in areas like job applications or relationships.

To prevent these data breaches from occurring, it is essential to have the proper precautions in place. Manual data entry presents its own challenges – it is tedious and allows room for error. Manual data entry will not cut it, as we have seen from recent data breaches.

We need a new method of collecting and storing data in a way that is simple, secure and compliant with regulations such as GDPR and HIPAA. This is where web forms enter the picture.

Web Forms are the Key to Securing Healthcare Data

Web forms are transforming the way that data is collected and stored. This data is collected through a method where it is encrypted in transit and at rest, enabling safeguards to ensure that this data cannot be seen by those who do not have access. At our company, for example, we use TLS 1.2 to make sure that the entire data collection process, from the web browser to the endpoint, is encrypted.

These forms benefit users, providing a simple, hands-off process to collect data: all they need to do is click the box, type in the information needed, and they are then able to mask the data and send it off. Though this process might seem daunting, I’ve found that companies and healthcare professionals can use a paid service to collect data. And by doing so, they are freeing up time and resources.

Doctors and other healthcare providers should focus on diagnosing and treating patients, not collecting their information. Utilizing web forms frees up medical professionals to do what they were trained to do, leaving the responsibility to the form builder to take care of all the security measurements and checks to make sure that this data is safe.

Companies and Healthcare Organizations Need to Take Data More Seriously

Regulations such as GDPR in the EU and HIPAA for healthcare professionals are drastically changing how companies and healthcare organizations are handling their customer or patient data. GDPR was a great example of transparency, forcing companies to tell consumers that their data is being collected and how it is being used, mainly in the form of “cookies” on websites. And in the future, I believe we’re going to see a more robust security framework arise, such as in states like California, where harsher regulations such as the CCPA are rolling out, and other states are beginning to follow suit.

Healthcare professionals are also looking into data mining to diagnose patients without even seeing them in person. Even now, companies like Cambridge Analytica collect hundreds of data points on a certain person, and they receive this information from the various websites they visit.

I can see a point where data mining in the healthcare industry will be huge, as healthcare professionals could potentially diagnose a condition that a patient has just from looking at their data- either from the websites they visit, comments they posted on social media, or even over the phone.

How Companies can Secure Data the Right Way

These examples of data breaches further prove why web forms should be utilized to secure sensitive patient data, but what can those in the healthcare industry do to protect their patients’ data? Here are some ways that I’ve found can make a great deal of a difference when dealing with data:

1) Be Transparent

Transparency is key in this digital age. Customers tend to be on edge about how much information they give to various companies and how their data will be used. But if a company is up front about what kind of data they are collecting and how it will be used, this will help set customers at ease. And, if a breach were to happen, customers might respect these companies a little more if they were completely transparent, sharing how this happened and what they are doing to correct it.

2) Spread Awareness

For organizations to maintain compliance with regulations, they must first be aware, not just aware of what’s going on in the industry, but also making sure that employees are aware of these industry news and regulations as well. This is especially true of the healthcare industry, as leaders should send out updates regarding security, security awareness, updates about HIPAA, and how they need to handle that data, if they are not doing so already.

3) Keep Policies and Procedures Up to Date

I’ve found that the best way for organizations, particularly in healthcare, to remain in compliance with regulations is to maintain policies and procedures, keeping them up to date to know how the organization is running.

How can companies keep their privacy methods up to date? It’s simple – they can begin by reading through privacy policies, procedures and notices on their website on a semi-annual basis, making sure the language is still applicable to everyone. It’s also crucial that if companies say they are doing something regarding certain privacy standards, they had better be doing it, as they will be held accountable for their actions (or lack of).

This ties back to transparency: if information were to be exposed in a breach, and the company says that they are doing something that triggered it, the affected customers would most likely go a little easier on them, since they were transparent, rather than if they had lied to try to cover up their mistake.

Another way that companies can maintain their privacy policies is to map internal controls to GDPR, PCI, HIPAA, ISO, NIST and CCPA to find any gaps in their controls. Not only does this help them keep their privacy policies and procedures updated, but it also ensures that they remain in compliance with these regulations.

Healthcare data is arguably the most important kind of data there is, and how it is protected is crucial. When companies use web forms to collect and secure data, they are not only protecting their patients but also themselves by creating accountability.

Transparency is a vital component of data collection and usage, creating a bond between patients and healthcare providers. And as companies start being held more accountable for their actions via regulations, they must create a plan to first secure their patient data and then regularly update their policies and procedures to ensure that patient data will not fall into the wrong hands.