Healthcare professionals working at a computer workstation with dual monitors displaying schedules and data dashboards, while colleagues collaborate in the background of a modern clinical office.

HTM cybersecurity: prioritizing and reducing ePHI risks

The increased complexity of critical medical equipment systems make them a target for cybersecurity threats. Cybersecurity programs need to reduce risks to healthcare technology and electronic patient health information (ePHI).

Keep reading

According to the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF), cybersecurity threats exploit the increased complexity and connectivity of critical infrastructure systems, placing medical equipment security, patient data and potentially the connected patient at risk. With no such thing as a risk-free environment, healthcare technology management teams need to design cybersecurity programs around reducing risks to healthcare technology, and subsequently, to patients and electronic patient health information (ePHI).

Prioritizing risks for highest impact

With so many connected medical devices in the healthcare setting, healthcare technology management services teams must prioritize where to focus attention to maximize cybersecurity efforts. Sodexo's healthcare services prioritize risks in two ways: patient safety and business criticality, where the highest risks are life threatening and the lowest pose no physical threats.

Patient safety

  • Life criticality

    Risk of potential patient harm, injury or death.

  • High risk

    Risk of potential patient harm or severe injury, but no risk of patient death.

  • Normal risk

    Risk of potential patient harm, but no risk of severe injury or death.

  • Low risk

    No risk of potential patient harm, severe injury or death.

Business Criticality

  • Life critical devices 
(network connected)

    A security compromise presents risk of severe injury to patient or staff.

  • Business critical devices
(network connected)

    A security compromise presents risk of serious disruption to patient care operations such as diversion or cancellation of critical care.

  • Regulatory data (ePHI) devices
(network connected)

    A security compromise presents risk of serious regulatory risk such as HIPAA, PCI or SOX.

  • Normal criticality devices

    Any equipment for which compromise does not present risk to safety, operational or regulatory requirements.

Data that informs priorities

This can only be done by understanding where protected data lives and who has access to it through in-depth data collection. Key data elements that HTM cybersecurity experts should understand to get a full picture of how patient data is stored and moves within the hospital include: 

Healthcare professional in blue scrubs using a desktop computer at a clinical workstation, with a stethoscope, identification badge, and keyboard visible in a modern healthcare environment.

Loading component...

Loading component...

Loading component...

Loading component...

Reducing risks starts with understanding your inventory and your environment to identify where the vulnerabilities are present. Without a full understanding and the proper processes in place, vulnerabilities turn into risks to assets, data, operations, and ultimately, patient safety. Transitioning from reactive actions to proactive processes is essential for effective risk reduction. 

Turn cybersecurity insights into lower risk

Gain a clearer view of your connected medical devices, identify your highest cybersecurity risks and implement proactive strategies that help protect patient safety, safeguard sensitive data and strengthen operational resilience.

Get started with HTM

Read our latest stories