On October 21, 2013, Alhambra, California-based AHMC Healthcare Inc. reported the theft of two unencrypted laptops containing the protected health information (“PHI”) of approximately 729,000 patients. Reports of stolen laptops and other mobile devices containing PHI are not uncommon in recent years. In fact, most breaches of PHI reported to the U.S. Department of Health and Human Services (“HHS”) are related to the theft or loss of mobile devices.¹ These types of reports are also not surprising given the rise in use of mobile device technologies in the healthcare industry. Two recent studies have shown that healthcare professionals are increasingly using mobile devices such as smartphones and tablets for clinical purposes. A survey published in August 2013 by the Deloitte Center for Health Solutions² found that more than 40 percent of U.S. physicians use mobile phones to access patient records, write prescriptions and communicate with other healthcare professionals. BYOD Insights 2013 (March 2013),³ a survey conducted by a group of Cisco partner firms,⁴ points out that 88.6 percent of American workers in the healthcare industry use their personal smartphones for work purposes. Arguably the most troubling finding of the BYOD Insights 2013 study is that even the most basic protocols have not been adopted to ensure the security of these mobile devices. For example, nearly 60 percent of respondents in the healthcare industry reported that their smartphones are not password protected, and more than half of the respondents accessed unsecured or unknown Wi-Fi networks with their smartphones.

HIPAA Requires that Mobile Devices Containing PHI be Secure

The Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and its implementing regulations, the Privacy and Security Rules, as amended by The Health Information Technology for Economic and Clinical Health (“HITECH”) Act and the recent HIPAA Omnibus Final Rule specify requirements for securing PHI. The HIPAA Security Rule specifically requires covered entities and their business associates to conduct periodic risk analyses of the potential risks and vulnerabilities to electronic PHI maintained on all of its systems, including mobile devices, and to adopt policies and procedures for addressing these threats and vulnerabilities.⁵

Failing to comply with these security requirements could result in civil penalties of up to $50,000 per violation and a maximum penalty of $1.5 million for all violations of an identical provision during a calendar year.⁶ In at least two cases reported by HHS, the loss or theft of mobile devices has resulted in settlements of over one million dollars.⁷

Steps to Secure Mobile Devices

In light of significant penalties under HIPAA for failing to adequately secure the confidentiality and integrity of electronic PHI on mobile devices, healthcare organizations and their business associates should strongly consider the risks to mobile device security⁸ and adopt policies and procedures that adequately address these risks.

The following minimum security measures should be considered carefully by any organization desiring to maintain data security over mobile devices:

• Adopting access control policies that require authentication to access mobile devices, including use of complex passwords with a combination of letters and numbers. Some devices are now offering biometric authentication measures (such as Apple’s iPhone 5S) to further secure mobile data from unauthorized access.
• Installing or enabling encryption on all mobile devices that store or access patient or other sensitive information. Encryption is particularly important given that lost or stolen encrypted devices do not generally give rise to breach reporting requirements under HIPAA or most state breach reporting laws.⁹ Many newer mobile device models now offer full device encryption as a built-in option. This option should be enabled before the device is used to access sensitive data. In addition to enabling encryption for data on the device, users must also be concerned about encryption for data that is transmitted via the device. Virtual Private Network (“VPN”) technology should be implemented before sending or receiving protected data via a mobile device. When a VPN is established between the device and a corporate network, all data transmitted between the two is encrypted to protect against interception of the data by an unauthorized third party. Finally, SMS text messaging from mobile devices is inherently insecure.¹⁰ Unless text messaging of electronic PHI is expressly prohibited by organization policy, a secure HIPAA-compliant text messaging system should be implemented on all mobile devices with access to this sensitive data. There are a number of available software solutions for securing text messaging in accordance with the requirements of the HIPAA Security Rule for securing electronic PHI.
• Enabling or installing firewalls to block unauthorized access. Some mobile operating systems have built-in firewalls that users can enable.
• Enabling or installing mobile security software to protect against viruses, malware, spyware and other malicious applications. A wide range of applications are now available that offer different levels of protections. Some features often found in security software applications include the ability to remote wipe a device (in case of loss or theft); a remote alarm feature; and tracking capability via the device’s GPS system. It is important to keep mobile security software up to date.
• Disabling or uninstalling file-sharing software that can be used to access sensitive information or infect mobile devices with computer viruses or malware.
• Forensically wiping all stored health information before a mobile device is discarded or given to another user.
• Adopting a mobile device management (“MDM”) system that enforces security measures for all devices that connect to the organization’s network. A typical MDM system will register all mobile devices that seek to access data on the organization’s network; restrict access to non-compliant devices; manage security updates and access rights for user devices; roll out approved applications; and provide IT administrators the ability to remote wipe a device if the device is lost or an employee is terminated.

Conclusion

Healthcare organizations and their business associates should remember that securing mobile devices that access or maintain electronic PHI is not just good practice, but it is the law. The measures described above are just a few of the security measures a healthcare organization should consider when adopting policies and procedures to protect PHI and other sensitive information on mobile devices. The Office of the National Coordinator for Health Information Technology (“ONC”), which is the federal organization within HHS charged with coordination of nationwide efforts to implement and use health information technology, provides additional information on securing mobile devices on its website.¹¹ Additionally, the National Institute of Standards and Technology (“NIST”)¹² has published Guidelines for Managing and Securing Mobile Devices in the Enterprise (NIST Special Publication 800-124),¹³ which is intended to help organizations centrally manage and secure mobile devices.