October is Cybersecurity Awareness Month, but it’s always a great time to check in on your data security practices. We spoke to PCC’s Security Analyst David Trautman, who reminds practice owners, office managers, and managing physicians that often, data security comes down to the individual.
According to the Verizon 2024 Data Breach Investigations Report, the median time for users to fall for a phishing attack is less than 60 seconds. "Cybersecurity isn't just an IT issue - it's everyone's responsibility," Trautman says. "The weakest link in your security is usually the human element. We can’t eliminate human error, but we can be proactive in preventing it.”
Here are Trautman's top tips for improving cybersecurity at your independent pediatric practice:
- Strengthen your password practices: Encourage all staff to use strong, unique passwords for every account. Avoid common words, phrases, or personal information that could be easily guessed. A better way to come up with passwords is using passphrases - for example: ‘W3heartPCC#’. Consider implementing a password manager to generate and store complex passwords securely.
- Enable multi-factor authentication: Adding an extra layer of security through multi-factor authentication (MFA) makes it much harder for cybercriminals to access your accounts, even if they obtain a password. Enable MFA wherever possible.
- Be cautious with email and links: Phishing attacks, where criminals try to trick you into revealing sensitive information or installing malware, are a leading cause of data breaches. Teach staff to be wary of unsolicited emails, especially those containing links, attachments, and spelling or grammar mistakes. Verify the sender's identity before responding or clicking on anything.
- Keep software up-to-date: Outdated software often contains known vulnerabilities that hackers can exploit. Ensure all your practice's computers, servers, and other devices have the latest security patches and updates applied. Enable automatic updates whenever possible.
- Back up data regularly: Regular, reliable backups are essential for protecting against data loss, whether from a ransomware attack, hardware failure, or human error. Implement a comprehensive backup strategy including site and off-site/cloud-based backups. PCC never charges practices for accessing their data.
- Restrict access to sensitive data: Not everyone in your practice needs access to all your patient records and other confidential information. Carefully manage user permissions in your EHR, and only grant access to those who require it for their job duties.
- Train staff on security best practices: Educate all your employees on cybersecurity threats and how to recognize and respond to them. Formal trainings are an option, although regular reminders on cybersecurity can be just as effective. This includes online behaviors like checking emails and in-person behaviors such as allowing only authorized personnel in secure areas. There are many reputable vendors out there that offer security training based on employee count.
- Partner with an IT provider: Many independent practices don't have the in-house expertise or resources to manage their cybersecurity effectively. Consider working with a managed IT services provider who can monitor your systems, implement security controls, and provide expert guidance. PCC works in tandem with your practice’s IT.
- Stay informed and proactive: Cybersecurity is an ever-evolving landscape, with new threats always emerging. Make it a priority to stay up-to-date on the latest cybersecurity news, trends, and best practices for the healthcare industry. Be proactive in reviewing and updating your practice's security measures. For example, Trautman recommends quarterly trainings for employees.
“Reinforce with staff that ‘gut feeling’ if they suspect something isn’t right,” Trautman continues. “Taking time to consider an email or phone request removes urgency, something hackers rely upon to exploit the natural fear response.”
By implementing these tips, independent pediatric practices can reduce their risk of costly data breaches and ransomware attacks, safeguarding their operations and reputation. Cybersecurity may start with the individual, but keeping your data safe takes a whole-practice effort. At PCC, we want to be your technology partner. We’ll never gatekeep your data or charge you to access it — no matter what.
More questions on technology? Visit us to learn more.
