Data Encryption in Healthcare

Encryption is terrific…in theory. Data stays protected, and confidential information remains locked away from the wrong eyes. In reality, though, compliance costs money, whether from purchasing hardware and software, hiring a consultant, both, or possibly more. When pursuing protection, is it possible to go overboard and encrypt more than necessary?

In some instances, a particular regulation will mandate encryption in clear, unmistakable terms; failure to comply with these terms implies violation of the law. Other times, regulations may be vague about requiring encryption, leaving a gray area for businesses to decipher. For example, a regulation may dictate that sensitive and/or personal data be protected without explicitly stipulating it be protected via encryption. Obviously, these situations are less than ideal.

When the law isn’t straightforward, security experts can provide clarity if and when a consensus gives way to commonly accepted best practices. The term isn’t exclusive to regulations and encryption, but it can nonetheless help guide healthcare providers that encounter nebulous compliance verbiage. Following industry best practices will keep a business protected in times when the letter of the law proves hard to decipher. Sometimes, even the government will come to providers’ aid with published best practices guidance, although the availability of such documents within a given niche or application can vary widely.

Healthcare providers can reasonably protect themselves against known threats. For instance, they can set up firewalls to thwart incoming attacks and use virtual private networks (VPNs) and secure communication protocols, such as HTTPS, to keep data secure while in transit. In many, many cases, an entity’s weakest line of defense is its own employees.

In fact, the 2015 Ponemon study indicates that respondents worry more about employee negligence (51%) than any other security threat. That’s ahead of cyber attackers (35%), system failures (19%), and identity thieves (a mere 5%). Note that negligent employees aren’t the same as disgruntled types, which the report classifies as “malicious insiders”; only 19% of respondents listed these employees as a chief concern.

No, the biggest threat is well-meaning but inattentive employees. They’re the reason laptops containing treasure troves of data disappear. Since accidents and theft do happen with all too frequent predictability (Ponemon’s 2010 paper “The Billion Dollar Lost Laptop Problem” pegs the number at 7.12% across all surveyed organizations), responsible enterprises would be playing Russian roulette by not taking appropriate precautions. Equipping portable devices with self-encrypting drives is one obvious step, but healthcare providers should go further, particularly with at-rest data on removable storage. One might assume that a portable hard drive or USB flash drive will never be left unattended, but that’s precisely the kind of employee wishful thinking and negligence that leads to breaches. Healthcare providers must address this potential weakness.

Although HIPAA’s goal of protecting private patient information remains constant and needed, the legislation became law almost 20 years ago, a time when the environment for electronically stored and transmitted information was quite different from today. For our purposes here, we’ll focus primarily on HIPAA’s coverage of electronic protected health information (ePHI) and how providers must handle it.

The Security Rule within HIPAA does not explicitly require encryption, but further explanation translates that “no” to “well…basically, yes.” Encryption is deemed “addressable,” which isn’t the same as “required,” but the Security Rule goes on to state that entities should perform a risk assessment and implement encryption if the assessment indicates that encryption would be a “reasonable and appropriate” safeguard. If an entity decides not to encrypt ePHI, it has to document and justify that decision and then implement an “equivalent alternative measure.”

This spotlights the juncture where industry-standard best practices play such an important role. Similarly, when determining the ideal method of encryption, the U.S. Department of Health & Human Services turns to the National Institute of Standards and Technology for recommended encryption practices. HHS and NIST have both produced robust documentation for adhering to HIPAA’s Security Rule (see www.hhs.gov/hipaa/for-professionals/security/guidance). NIST Special Publication 800-111 takes a broad approach to encryption on end-user devices, but in a nutshell it states that when there’s even a remote possibility of risk, encryption needs to be in place, and FIPS 140-2, which incorporates the Advanced Encryption Standard (AES) into its protocols, is an ideal choice.

Many organizations leverage the U.S. government’s Federal Information Processing Standard Publication 140-2 (FIPS 140-2) to aid in their pursuit of compliance. Specifically, FIPS 140-2 helps healthcare entities ensure that ePHI is “rendered unusable, unreadable, or indecipherable to unauthorized individuals,” according to HHS guidelines. A device that meets FIPS 140-2 requirements possesses a cryptographic erase function that “leverages the encryption of target data by enabling sanitization of the target data’s encryption key. This leaves only the ciphertext remaining on the media, effectively sanitizing the data.”

FIPS 140-2 features four levels of increasing security. Level 1 requires that a solution use an approved algorithm or security function; the device itself requires no physical security. Level 2 adds the requirement for some form of physical security that can present evidence of an unauthorized access attempt, such as a tamper-proof seal. A Level 3 solution goes even further by requiring a countermeasure that thwarts access, use, or modification of the cryptographic module if the solution itself detects a physical breach. Level 4 takes FIPS 140-2 protection to its pinnacle by detecting environmental variations (such as voltage and/or temperature) outside of a specified range and taking action to destroy cryptographic keys when it detects a breach.

Perhaps the best reason to encrypt data came with the passage of the Health Information Technology for Economic and Clinical Health (HITECH) Act. Passed in 2009, the HITECH Act protects healthcare entities from serious penalties for any lost or stolen data provided that the data was encrypted before the breach. Considering examples such as two stolen laptops resulting in a $3 million fine — a fine that could have been avoided under HITECH — the comparative cost of data encryption seems trivial. In other words, healthcare businesses and organizations can’t afford not to encrypt all data at rest.

Encryption must extend beyond laptops and backup drives. Communicating or sending data over the Internet needs Transport Layer Security (TLS), a protocol for transmitting data over a network, and AES encryption. When an employee accesses a business’s local network, using a secure VPN connection is essential when ePHI is involved. By the same token, before putting a handful of patient files on a flash drive for transfer between systems or offices, a harmless and innocent act in most situations, realize that a self-encrypting flash drive that also meets FIPS 140-2 requirements is the best option to avoid HIPAA violations.