Best Security Practices for HIPAA Logging

Despite advanced security measures and increased due diligence from healthcare professionals, system attacks are still a constant threat for a majority of medical organizations. Overlooked security weaknesses, outdated systems, or an inadequate IT infrastructure can be just the catalyst an attacker needs to exploit your protected health information (PHI).Remaining HIPAA compliant and safeguarding your (PHI) can be accomplished by following a few basic security practices. Professionals need to implement a company-wide security control which establishes how your (PHI) data should be created and stored. You’ll also want to create a compliance plan, or for the more theatrically minded – a contingency plan, in the event of a security breach. Most importantly, a proactive logging strategy has to be integrated each step of the way.These practices serve as a baseline for security. It’s recommended you build off of this foundation and adjust security measures as needed.

(PHI) Entry - A Foundation For Security

There are a unique set of risks you will contend with daily. Attackers on the outside are always looking for a way in. In 2016 alone, the Identity Theft Resource Center (ITRC) found that over thirty percent of healthcare and medical organizations reported data breaches. Outside threats are always a concern, but take into account the additional threat of inept data handling from employees and improper (or even nonexistent) logging practices and you’re asking for trouble.  The following steps outline basic security measures, establish a (PHI) entry guideline, and show what should be done before the data even enters your system or logging platform.

1. Develop or implement a company standard for new patient data entry.
2. Identify where the (PHI) is being created and who is creating it.
3. Establish the number of different devices used to enter data from.
4. Electronic Health Records (EHR) – record how many staff members are entering in data and where are they doing this from.
5. (re)Configure your database and note what records are stored there.
6. Create communication standards with your business associates – signees of a mutual Business Associate Agreement (BAA).

A detailed (PHI) flowchart can be made from the preceding information. This allows for a detailed analysis that can show whose hands your information passed through and what systems and technologies were used. A diagram can track data points of entry, revealing weak spots during the data exchange. For example, a patient’s sensitive information might languish in a filing cabinet or float through an unprotected third party portal online. Your diagram of the (PHI) flow can account for these types of discrepancies in security. A (PHI) flowchart is best used in tandem with a logging compliance report.

Compliance Reports & Safeguard Plans

One of the major failsafes of HIPAA – amended through the HITECH Act, is the requirement in maintaining an audit trail and submitting routine reports if a data breach is suspected. The ability to generate and distribute these reports is important for maintaining and proving compliance.  A proper log management system will be able to create automated reports that demonstrate compliance. LogDNA has the ability to generate automated audit reports from event logs within your system. Conversely, if an unexpected audit request occurs, you’ll be able to quickly query the necessary results to respond to the auditor and create a report for them manually as well. Additionally, plans should be made that take into account other areas of the HIPAA Security Rule. This means issuing policies around device access, workstation data safety, employee authentications, mobile use restrictions and encryption.  Think about utilizing an Incident Response Plan (IRP) –  or creating one if not already in place – while ensuring to amend it and make it useful. An (IRP) is best used to designate a planned response if a security incident arises. HIPAA logging solutions can and should be integrated into this plan.  This will provide concrete guidelines in the event of a (PHI) data breach. It will also make the team more efficient in the aftermath and allow them to give the proper compliant information to government agencies and individuals affected.

Take Advantage of Your Logging Environment

Logging takes the guesswork out of detecting threats – both internal and external. You’ll be able to commence a quick response and enact the correct procedures to patch any data leaks. It’s crucial to detect an attack before it happens. Sensitive data cannot afford to be lost. HIPAA logging gives the end user the ability to identify events across the whole system (file changes, account access and health data inquiries) while they occur. These security strategies will help you get the most out of your HIPAA logging platform:

• Determine what type of logs will be generated and stored(while keeping Compliance in mind).
• Ensure a secured storage place for logs that can be saved up to six years. This can be accomplished through storage in an encrypted archive by using AWS, Azure, or other  certified and protected service.  
• Designate an employee who will check logs on a daily basis.
• Create a plan for reviewing suspect alerts.
• Enact fail safes so that stored logs cannot be tampered with internally.
• Adjust log collection accordingly.

Event logs are bits of information coming from a myriad of sources. Firewalls, printers, (EHR) systems and more all contribute to the data that the logging platform will receive. A majority of organizations have a mixed IT environment; it’s essential to have the ability to collect and support a wide range of user activity and log file types. Log analysis not only ensures you comply with HIPAA, but also gives you the tools you need to defend against attacks and faulty data practices. Think of LogDNA as the sentry lookout that warns you of incoming danger. We’re using our digital eyes to spot all incoming risks and provide the raw data to create audit records and maintain HIPAA compliance. While it’s important to focus on security indicators, logging can also monitor a number of other events inside the system. Event logs can point towards malfunctioning applications, outdated hardware or faulty software. All events are monitored and can be traced back to where they originated from.  An internal structure that places an importance on HIPAA security will be able to utilize logging to stay compliant and keep crucial healthcare information safe. Have questions?  Contact LogDNA  and our team members will respond within one business day.