HTM cybersecurity: prioritizing and reducing ePHI risks

According to the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF), cybersecurity threats exploit the increased complexity and connectivity of critical infrastructure systems, placing medical equipment security, patient data and potentially the connected patient at risk. With no such thing as a risk-free environment, healthcare technology management teams need to design cybersecurity programs around reducing risks to healthcare technology, and subsequently, to patients and electronic patient health information (ePHI).

Prioritizing risks for highest impact

With so many connected medical devices in the healthcare setting, healthcare technology management services teams must prioritize where to focus attention to maximize cybersecurity efforts. Sodexo's healthcare services prioritize risks in two ways: patient safety and business criticality, where the highest risks are life threatening and the lowest pose no physical threats.

This can only be done by understanding where protected data lives and who has access to it through in-depth data collection. Key data elements that HTM cybersecurity experts should understand to get a full picture of how patient data is stored and moves within the hospital include: