Clinician cybersecurity 101: Protecting your practice

As healthcare continues to integrate more advanced technologies, from AI scribes to other third-party services beyond EMRs, the importance of cybersecurity in clinical settings has never been more critical. In today’s landscape, clinicians must understand the risks and adopt strategies to protect patient information. During OntarioMD’s Digital Health Conference 2024, experts emphasized the significance of proactive cybersecurity measures, vendor management and data protection. Below are some key takeaways for clinicians.‘Health data is valuable’Andrew Drummond, director of health policy at Ontario’s Information and Privacy Commissioner (IPC), emphasized that you can’t assume you are immune from cyberattacks just because yours is a clinic in small-town Ontario. “Do not try a security through obscurity approach,” he advised, reminding clinicians that hackers are aware of the value of health data. The IPC has reported 61 cyber incidents in Ontario recently, a third of which were in the healthcare sector. For doctors, it’s crucial to recognize that a breach isn’t just a technical problem; it’s a violation of patient trust and a legal issue. “The law holds you ultimately responsible,” Drummond warned. Even with outsourced services, clinics are accountable for the security of patient data, whether stored locally or out of province.Read: Dr. Marina Malak: Privacy perils: protection or pestering?Vendor managementOne critical areas in healthcare cybersecurity is managing third-party vendors. Ariane Siegel, general counsel and chief privacy officer at OntarioMD, highlighted that clinics must hold vendors accountable through well-constructed contracts. These agreements should ensure that vendors comply with healthcare privacy laws like PIPEDA and PHIPA and conduct privacy and threat risk assessments. Siegel pointed out that while no Ontario laws prohibit outsourcing services like virtual assistants or cloud storage out of country, clinicians must understand the risks as many cyberattacks originate from foreign entities.Common misconceptions John Solomos, CEO of BlueBird IT Solutions, addressed common cybersecurity misconceptions in the clinical setting. One myth is that using widely available software like Office365 automatically ensures encryption. Solomos clarified that free email services are neither safe nor compliant with healthcare regulations. Clinics must opt for secure platforms, employ two-factor authentication and regularly update their systems. “Device management is critical,” Solomos emphasized, as outdated systems and software are often the weakest link in a clinic’s security defenses.He also discussed the importance of cybersecurity insurance, polling the audience on whether they had policies in place (a scattering of hands went up). Mitigating risks with backupHuman error remains one of the most significant threats to clinical cybersecurity. Both Siegel and Drummond emphasized the importance of regular cybersecurity training. “Think before you click,” Siegel urged, reminding clinicians that phishing and social engineering attacks can often bypass technical safeguards. OntarioMD offers free, accredited cybersecurity training to help clinicians stay informed about evolving threats and protective measures.In addition to training, a robust backup strategy is essential for safeguarding patient information and maintaining clinic operations in the event of a cyberattack. Siegel noted that regular backups are a key defense, but they must also be tested to ensure they work when needed. “The most important thing you can do is back up and test the backup,” she said, noting that the first time you look at the backup data should not be after a cybersecurity incident.VigilanceAs more clinics adopt AI-based tools like virtual scribes, there is growing concern about data privacy and security. Dr. Sharon Domb, a family physician and the Physician IT lead at Sunnybrook Family Practice, pointed out that while systems like Ocean are using secure messaging the question remains: “How do we mitigate the risk?”Indeed, cybersecurity is not just about technology but also about creating a culture of awareness, responsibility and vigilance in every clinic.As Drummond emphasized, “Attacks are happening all the time. When they do—it is a crime, and they should be reported.”

Clinician cybersecurity 101: Protecting your practice

Register for free access or login.

Related Topics