HIM 81 Indiana Tech Minor Consents and Security Threats Discussion M4D1: MINORS CONSENTS AND SECURITY THREATS Answer both topics 1 & 2: 1) Minors consent

HIM 81 Indiana Tech Minor Consents and Security Threats Discussion M4D1: MINORS CONSENTS AND SECURITY THREATS

Answer both topics 1 & 2:

1) Minors consenting to medical treatment

One of the most valued rights in American society is the right to control one’s own body, especially when it comes to medical decision making. However, the rights surrounding consent are not absolute and can be affected by factors such as age, competence, and emergency situations. Anyone working in healthcare must be knowledgeable about the ethical and applicable legal principles of consent.

Discuss situations in which minors may be legally permitted to consent to their own medical treatment. In your opinion, should they be permitted to make their own treatment decisions in these cases? Are there any situations in which minors cannot make their own treatment decisions and you feel they should?

2) Security Threats and Mobile Technology

Background: Mobile devices used by healthcare professionals has transformed clinical practice. These devices are now commonplace in health care settings which has lead to the growth of medical software applications. These applications are available to assist with many important tasks such as health record maintenance and access, patient management and monitoring, clinical decision-making and medical education. With this increase in access to these tools, security must be a top priority for all health care organizations.

For this assignment, you will need to:

Review the May 10, 2011, NIST presentation titled “Trends for the Mobility-Enabled Healthcare Enterprise and Security Threats Vulnerabilities, and Countermeasures”. Also see “Security Issues and Mobile Technology”. (see Module 4 for these document).
Discuss one or two of the majority security issues related to mobile applications technologies.

The attachments are for Security Threats and Mobile Technology Trends for the Mobility-Enabled Healthcare Enterprise and
Security Threats, Vulnerabilities, and Countermeasures
NIST HIPAA Conference
May 10, 2011
This document is confidential and is intended solely for the use and information of the client to whom it is addressed.
Agenda
• Context for Mobile Health
• Risks
• Security Implementation Considerations
1
Health care has increasingly used technology to expand its
reach or enhance delivery
• Hippocrates (460-377 B.C) and Galen
(131-201 A.D) documented their
patient’s process of healing to improve
patient care.
• 1901 the Trans-Atlantic radio
introduced and by 1924, envisioned
this technology bringing the doctor to
our home
• 1946 the ENIAC computer introduced
• 1950 the transmission of radiologic
images by telephone between West
Chester and Philadelphia (24 miles
was reported in the scientific literature)
• 1970s a growing number of electronic
medical records systems were
introduced
Rapid advancements of today bring even more possibilities tomorrow
2
Today, mobility and “anywhere connectivity” is being used
to transform business, drive productivity, and redefine the
workplace
2010’s
2000’s
3G Smart
Devices
1990’s
2G Mobile
Phones
1980’s
Laptops
Desktops
3
Consumer
Driven Mobility
The explosion of new devices and applications focused on
healthcare solutions is resulting in mHealth…
…a term used for the practice of medical and public health,
supported by mobile devices
4
These mobile solutions offer significant opportunity for
improvements across the health market
Examples
Education
• Search the web for
health information
• Utilize local
software or
remote enterprise
applications
• Conduct patient
education or
review results
bedside
Reminders
and Alerts
• Local alarm or
calendar alerts
• Register for
service – calls;
text messages
• Enter information
for personalized
responses
Data
Collection
• Patient History at
the Bedside; home
visits
• Personal Health
Records… local or
hosted
• Door to door
surveys and
research protocol
data collection
5
Care
Delivery
• View patient
information, labs,
images
• Remote
monitoring &
consults
• Prescription
ordering
• Dictation
• Clinical Decision
Support
Emergency/
Events
• Collect and
transmit patient
data at the point of
care
• Transmit images
from the scene
• Obtain guidance
and start
intervention
Success of these mobile solutions requires a holistic and
integrated approach
Usability
Clinical Integration
Sustainability
Security and Privacy
6
As users increasingly rely on mobility for health care
services, the risk of data compromise escalates
Potential Threats and Vulnerabilities
Vulnerabilities
Device Loss
Protection Needs
Unsecured Wireless
Malware Attacks
Location Tracking
Threats to the
Enterprise
Enterprise Resources
7
• Context for Mobile Health
• Risks
• Security Implementation Considerations
8
As security professionals, we have been playing catch-up by
trying to learn, analyze, and secure mobile technologies
Grassroots
Mobility
Ad Hoc
Mobility
Structured
Mobility
Optimized
Mobility
Increasing Security Posture
• Realize substantial savings, increased information dissemination from
previously disparate systems, and enhanced real-time and operational
efficiencies
• Ability to integrate communications more closely with business
processes
• Anywhere and anytime access to email, calendars, and applications
• Enabled business processes applications with automated alerts and
context-driven architectures
9
Mobile technologies extend the wired infrastructure but
introduce many new challenges for information security
personnel
•
•
•
•
•
•
•
•
Personal devices vs. care delivery organization (CDO)
Connectivity from anywhere and everywhere
Multiple devices and OS platforms
Multiple applications to support
Data is outside the ‘secure’ perimeter
Hard to distribute security controls
Access complexities (power users, etc)
Device management
10
Our goal is to move employees to technologies that provide
greater mobility, efficiency, and productivity
Mobility Challenges
• Information security concerns
• Business processes can
change dramatically,
presenting organizational
challenges
• The business case is complex
• Point solutions that do not
address total requirement
• Technical issues surrounding
connectivity
• Standards are evolving
• Evolving policies and
corporate governance related
to mobile devices
• Human acceptance of new
technology
• Integrating dynamic mobile
devices with legacy
information systems
• Maintaining the user
experience
Security Challenges
Mobile Security
Considerations
11
• Data disclosure (storage and
transmission)
• Physical security
• Strong authentication / multifactor authentication
• Multi-user support; separate
organizational and personal
data
• Safe browsing
• Operating systems and
abundance of hardware
platforms
• Application isolation
• Malware, phishing
• Updates – App, OS, and
Firmware mechanisms
• Geolocation privacy
• Improper decommissioning
The potential effects of risk from mobility include more than
just eavesdropping on mobile users
•
•
•
•
•
Unauthorized monitoring and disclosure of ePHI
Unauthorized modification of ePHI
Unauthorized or fraudulent use of ePHI
Radio frequency interference or disruption of service
Radio traffic analysis and operations security
In addition, mobile and wireless technology
typically increases network complexity
• Complexity is the enemy of security
• Provides more points of entry to intruders
• Mobile security tools and technologies are not
standardized
12
So how bad is it really?
According to the Department of Health and Human Services, 9,300 medical
data breaches were reported under HIPAA/HITECH between September 23,
2009 and September 30, 2010
Recent Breaches
• 18 April – Sensitive personally identifiable information (PII) was stolen from Android
Skype users by malicious third-party applications
• Any third-party application with data harvesting capabilities could steal data
– Stolen data included customer names, date of birth, location, account balances,
phone numbers, email addresses, and biographic details
• 17 March – BlackBerry JavaScript vulnerability allowed hackers to steal user data
• Remote code execution attack provided access to media cards and storage
• 02 March – Two dozen infected applications were removed from Android Marketplace
• Malware was capable of rooting devices and stealing data
– Over 200,000 of these applications were downloaded
• 22 February – Financial data was stolen from thousands of Symbian and Windows
mobile users
• Zeus malware captured sensitive financial transaction authentication numbers
13
Implementation of mobile application technology will require
integrating a number of cyber-security, privacy, and
confidentiality measures
Mobility Security
Policy and
Planning
• Establish a strong security policy foundation and risk
management program for mobile solutions
• Define the mobile concept of operations (CONOPS)
Mobility Risk
Assessment
• Assess the threats and vulnerabilities faced by the
enterprise
• Define a package of security countermeasures that
mitigate the risks to an acceptable level
Mobility Security
Solutions
• Develop and integrate the applications that allow the mobile
services to be secure in the enterprise
• Make engineering tradeoffs and procurement decisions
• Migrate legacy systems
Mobility Security
Operations and
Administration
• Enterprise mobile solutions are operated and
administered according to defined requirements
• Security posture is periodically evaluated for compliance
14
• Context for Mobile Health
• Risks
• Security Implementation Considerations
15
The proper strategic imperatives to support a mobile
ecosystem must be developed and thoroughly explored in
the beginning
Standardization
HW and SW
standardization must be
considered from start to
reduce maintenance costs
Integration
Integration is key to the
effectiveness of system;
integration with back end
systems must be
evaluated
Patient Safety
Vital factor in driving the
implementation of mobility
in the health care field
Security
Requirements of
HIPAA, FISMA, OMB,
and Privacy Act of
1974
16
Asset Management
Hardware and user
assessment must be
regularly monitored to
determine overall system
effectiveness and to
remove defective care
delivery devices
Successfully implementing enterprise mobility requires an
advanced Secure Mobility Framework
• Implement technical policies and
procedures that allow and restrict
system and data access
• Unique identification, multi-factor
authentication (AuthN) and role-based
authorization (AuthZ) access controls
• Continuous monitoring and detection
for unauthorized wireless activity
• Data encryption (at rest and in transit)
• Configuration documentation
• Physical access controls, including
session/device timeouts
• Security testing and evaluation
• Conduct risk analysis
• Incorporate into Security Awareness
training
• Software Assurance
Policy Planning & Guidance
Secure Mobility Framework
Acquisition & Procurement
Mobile Application
Development
Hardware/OS
Testing
Hardware/OS
Accreditation
Mobile Application
Certification
Authorized End
Device
Mobile Application
Distribution
Secure Infrastructure
Operations Optimization
17
Mobile security implementation includes all components of
the communications system
People
End-point
Communications
Perimeter
Enterprise
• Implement technical
policies and
procedures that allow
and restrict system
and data access
• Have an approval
policy and process
• Use only approved
devices and
implement controls to
grant/restrict remote
access
• Conduct a
solution/technology
risk assessment
• Provide end user
security and
awareness training
• Policy groups/rolebased access
• ePHI
Confidentiality/Integrity
• Unique two-factor/PIN
local and enterprise
AuthN
• Access control to local
device
• Application-level
security controls
• Device interrogation
for enterprise
compliance and
access (phase 2 & 3)
• Audit controls
• Remote wipe (phase 2
& 3)
• Data separation
(personal versus
sensitive)
• Automatic logoff
• Patient History at the
Bedside; home visits
• Personal Health
Records… local or
hosted
• Door to door surveys
and research protocol
data collection
• View patient
information, labs,
images
• Remote monitoring &
consults
• Prescription ordering
• Dictation
• Clinical Decision
Support
• Collect and transmit
patient data at the
point of care
• Transmit images from
the scene
• Obtain guidance and
start intervention
18
To successfully reduce risk, CDOs must extend enterprise
security throughout their mobile ecosystem
The HIPAA
Security Rule
• Access Control
§164.312(a)(1)
• Audit Controls
§164.312(b)
• Integrity
§164.312(c)(1)
• Person or Entity
Authentication
§164.312(d)(1)
• Transmission Security
§164.312(e)(1)
19
Security can be implemented by integrating and leveraging
existing enterprise security capabilities for mobile
technologies
Notional Network
Anti-Virus &
Hostile Code
Management
Security Policy
Enforcement &
Compliance
Auditing
System
Intrusion
Detection
System
20
Public Key
Infrastructure
Identity
Management
System
Network
Management
System
As with any technology, the goal is to balance convenience
with security
Policy
 Departmental
guidance
 Roles and
Responsibilities
 Security
enforcement
framework
Operations
Integration
 Enrollment
procedures
 System Admin
Training
 Process
improvement
21
Technology
Implementation
 Risk Assessment
 Pilot programs
 Security overlay
ST&E
 Certification and
Accreditation
Security professionals should leverage NIST guidance and
other industry best practices to establish baseline security
requirements for mobile technologies
NIST SP 800-53 Rev3
Category
Access Control
System and
Communications
Protection
Access Control
Control Name
Use of External
Information Systems
Mobile Code
Concurrent Session
Control
Mobile Enterprise Solution (example)
Control No.
IT Policy
Allow Internal
Connections
AC-20
Allow Resetting
of Idle Timer
SC-18
Allow Split-pipe
Connections
AC-10
Recommended
Setting
Comments
FALSE
Specifies whether
applications, including
third-party applications,
can initiate internal
connections
FALSE
Permits third-party
applications to reset
the inactivity timeout
value, bypassing the
security timeout value
FALSE
Specifies whether
applications, including
third-party, can open
internal and external
connections
simultaneously
Leverage both civil and defense policy and guidance to secure your
mobile and wireless investments (i.e. CNSS, DHS, HHS, NIST, VA and
DISA Wireless STIGs)
22
Key Initiatives and Resources…
• The HIPAA Security Rule can be found at HHS.gov:
http://www.hhs.gov/ocr/privacy/hipaa/administrative/securityrule/index.
html
• Health information technology (Health IT) allows comprehensive
management of medical information and its secure exchange between
health care consumers and providers:
http://healthit.hhs.gov/portal/server.pt
• The National Institute of Standards and Technology
• SP 800-48 Rev1 – Guide to Securing Legacy
IEEE 802.11 Wireless Networks
• SP 800-66 Rev1 – An Introductory Resource
Guide for Implementing the Health Insurance
Portability and Accountability Act (HIPAA)
Security Rule
• SP 800-97 – Establishing Wireless Robust
Security Networks: A Guide to IEEE 802.11i
• SP 800-98 – Guidelines for Securing Radio
Frequency Identification (RFID) Systems
• SP 800-111 – Guide to Storage Encryption
Technologies for End User Devices
• SP 800-121 – Guide to Bluetooth Security
• SP 800-122 – Guide to Protecting the
Confidentiality of Personally Identifiable
Information (PII)
• SP 800-127 – Guide to Securing WiMAX
Wireless Communications
• IR 7497 – Security Architecture Design Process
for Health Information Exchanges (HIEs)
23
Closing remarks
• Don’t ignore – investigate the complete range of mobile devices
necessary to enhance various clinical and business workflows within
the enterprise
• Set strategy – realize that mobile and wireless technologies will create
new privacy and security challenges that will require new policies and
technical controls; be sure to include device ownership, support, and
maintenance
• Set integration approach and employ standards-based technologies
where possible
• Monitor and manage mobile devices and supporting infrastructure
24
Contact Information
Ilene Yarnoff
Principal
Brenda Ecken
Principal
Booz | Allen | Hamilton
Booz | Allen | Hamilton
(o) 703/917-2574
(e) yarnoff_ilene@bah.com
(o) 571/346-5854
(e) ecken_brenda@bah.com
www.boozallen.com
25
HIM4950 Professional Practice Experience
M4D1: Security Threats and Mobile Technology
Background: Mobile devices used by health care professionals has transformed clinical practice.
These devices are now commonplace in health care settings which has lead to the growth of
medical software applications. These applications are available to assist with many important
tasks such as health record maintenance and access, patient management and monitoring, clinical
decision-making and medical education. With this increase in access to these tools, security
must be a top priority for all health care organizations.
For this assignment you will need to:
1. Review the May 10, 2011, NIST presentation titled “Trends for the Mobility-Enabled
Healthcare Enterprise and Security Threats, Vulnerabilities and Countermeasures”. This
resource can be downloaded in this module.
2. Discuss one or two of the major security issues related to mobile application technologies.
Total points: 90 points

Purchase answer to see full
attachment