{"id":11788,"date":"2024-03-13T11:55:03","date_gmt":"2024-03-13T11:55:03","guid":{"rendered":"https:\/\/ww2.efax.com\/?p=11788"},"modified":"2025-06-09T08:25:20","modified_gmt":"2025-06-09T15:25:20","slug":"ephi-data-leakage-and-the-8-hiding-places-youve-forgotten","status":"publish","type":"post","link":"https:\/\/www.efax.com\/blog\/ephi-data-leakage-and-the-8-hiding-places-youve-forgotten","title":{"rendered":"ePHI Data Leakage and the 8 Hiding Places You\u2019ve Forgotten"},"content":{"rendered":"\n

In the last few years, HIPAA\u2019s regulators and auditors have become more aggressive in finding and penalizing instances in which Covered Entities and their Business Associates fail to protect the electronic protected health information (ePHI) in their care. And chances are, you\u2019ve gotten the message: It is your healthcare organization\u2019s legal responsibility to safeguard at all times the private patient data under your charge.

But even if you have already taken many of the necessary steps to build a HIPAA compliant IT infrastructure, there are almost certainly several vulnerabilities in your organization\u2019s ePHI-security processes, typical digital stops that your ePHI makes along its journey to recipients or to your long-term secure archiving<\/a> and storage. Most IT teams forget to secure or scrub their ePHI from these hiding places.

Here are 8 of the top ePHI vulnerable spots where even at this very moment your data might be hiding \u2014 leaving you open to noncompliance with HIPAA, exposed to cyber criminals, in jeopardy of a reputation-damaging breach, and creating many other ongoing risks to your healthcare practice or organization.<\/p>\n\n\n\n

ePHI Data Leakage, and 8 Places You\u2019ve Forgotten to Secure<\/h2>\n\n\n\n
\"USB-Stick\"
Hand insert USB flash drive into laptop computer port<\/figcaption><\/figure>\n\n\n\n

1.  USB Drives<\/h3>\n\n\n\n

Even for a disciplined and security-conscious healthcare IT team, it\u2019s easy to forget the USB drive and other portable media-storage and transfer devices.

But your staff might be using them for faster and more convenient exchanging of ePHI documents between colleagues or to transfer them more easily from a device in the office to, say, a device at home. For your doctors or administrative staff, this might be completely innocent \u2014 just an easier way to work. But as far as HIPAA regulators are concerned, and for the cyber thief who steals the device and all of the data on it, these innocent intentions won\u2019t protect your patients or your organization.

The preferred approach is to not allow files to be transferred to removable media, and systems can be implemented to automatically block such attempts to copy files.  But if your staff is going to use USB drives to share and transfer ePHI, you\u2019ll need to either insist on only company-issued drives \u2014 which you\u2019ll equip with encryption software \u2014 and require that your employees who do use them delete all of the contents after each use.<\/p>\n\n\n\n

\"doctor\"<\/figure>\n\n\n\n

2.  Your Staff\u2019s Texts<\/h3>\n\n\n\n

Because it\u2019s such a convenient and immediate method of communication, doctors, nurses and other health professionals often use text messaging to communicate with colleagues and patients \u2014 and this often means transmitting ePHI in an unsecure way.

There are two problems here. First, under most circumstances texting ePHI is a HIPAA violation.  In fact, according to a 2016 Healthcare IT article, HIPAA\u2019s auditors can fine your organization up to $50,000 for each text containing ePHI.

Second, and equally important, texting ePHI can leave the data exposed to hackers, in several ways. If your staff is texting ePHI over an unsecure network \u2014 such as a WiFi hotspot in a public place \u2014 hackers can grab the data digitally. Also, what if the doctor texting ePHI with her cell phone loses that phone or has it stolen? Finally, even if your doctor remains extremely careful about how and where she texts, the ePHI data she is sending and receiving over the cellular network still remains in storage on the cellular provider\u2019s own cloud \u2014 and there is no way of knowing either that the data is secured on the carrier\u2019s own servers or who at the carrier\u2019s company will be able to see it.
<\/p>\n\n\n\n

\"working<\/figure>\n\n\n\n

3.  Your Staff\u2019s Email Accounts<\/h3>\n\n\n\n

Your IT department has probably developed a secure email  system that satisfies HIPAA\u2019s requirements \u2014 using secure transmission encryption protocols<\/a> and other security measures to protect data on your network\u2019s servers, etc.

But remember that your staff probably also sends and receives work-related email, including ePHI, on their personal email accounts\u2014 such as web accounts like Gmail and Yahoo! Mail.

Often your doctors or administrative staff will do this for convenience; perhaps they\u2019re in a location where they can\u2019t access their corporate email. Other times they might simply forget which email program they\u2019re using when they send a new message from their smartphone.

Whatever the reason, you should assume your employees are using their personal email accounts, often outside of your network firewall, to send and receive messages containing ePHI. So your IT team\u2019s job here \u2014 and it\u2019s a difficult one \u2014 will be to implement policies and provide training to steer your staff away from emailing outside the corporate system you\u2019ve developed for work-related messages, particularly messages with ePHI.

And even secure email is only as secure as the system of the person receiving the email.  If the recipient is on a non-secure personal email system, employees should be cautioned not to send email that contains protected information.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

4.  The Hard Drives of Your Copiers, Scanners and Fax Machines<\/h3>\n\n\n\n

When your employees scan, copy or fax physical documents containing ePHI, digital copies of those documents are saved to the hard drives of the copiers, scanners and fax machines. This is an often overlooked security vulnerability because people, even seasoned IT professionals, forget that these standard pieces of office equipment even have hard drives.

But as the healthcare educational company 4MedApproved points out, one health insurance provider was forced to pay a $1.2 million HIPAA fine for returning leased office equipment that still had stored patient records and other ePHI on the devices\u2019 hard drives.<\/p>\n\n\n\n

\"dialing<\/figure>\n\n\n\n

5.  Your Voice Files<\/h3>\n\n\n\n

Let\u2019s say a patient leaves a voicemail on your organization\u2019s phone service, or on the smartphone issued to one of your doctors (or even to that doctor\u2019s personal mobile phone). If the patient identifies herself and gives any personal information in that voicemail \u2014 almost a certainty in a message left for a medical office or doctor \u2014 that is considered ePHI.

Furthermore, let\u2019s say your doctors use handheld dictation systems to record patient details during or immediately after patient appointments. And further imagine that the routine for many of your doctors is simply to keep the tapes of these recordings in an unlocked cabinet or even on an open shelf in their offices. Again, these voice recordings would qualify as ePHI \u2014 and need to be protected just as any fax server or network transmission containing patient records.

Your IT team\u2019s task here \u2014 again, a difficult one \u2014 will be to train all staff on treating these voice recordings as the HIPAA-enforced protected data they are, and to implement processes to secure this ePHI at all times, whether digitally (in the case of patient voicemails) or physically (in the case of your doctors\u2019 own patient recordings on dictation devices).

And it goes without saying that outside medical transcription services must be HIPAA compliant and willing to sign a BAA if they will be transcribing doctors notes that contain personally identifiable information.
<\/p>\n\n\n\n

\"doctor<\/figure>\n\n\n\n

6.  Your Previous Electronic Medical Records System<\/h3>\n\n\n\n

Here\u2019s a very common scenario in healthcare organizations today \u2014 particularly as the Affordable Care Act rules force many medical and dental practices to reconsider the records systems they are using. A doctor\u2019s office decides to switch its Electronic Medical Records (EMR) system from, say, to NexGen.

After training its staff on the NextGen system and migrating its records over the new platform, the company will then often maintain a computer server that contains copies of all of its old records originally generated on its Cerner system. But very few of these companies will also provide adequate security for that old EMR data \u2014 even though it is still ePHI, subject to the exact same HIPAA regulations as new patient records.

Here your IT team\u2019s responsibility will be to treat this archived data and the hardware storing it with the same level of care and security as your office\u2019s current ePHI. That means you\u2019ll need to maintain current usernames and passwords for authorized personnel, equip the server (and any transmissions of the data to or from that server) with encryption and other security protocols, and maintain usage logs for any access to the ePHI contained on this old server.

It\u2019s easy to forget this data is even there. But if HIPAA auditors come knocking, you\u2019re just as much at risk of a noncompliance fine from the ePHI stored here as you are from any other type of  violation.<\/p>\n\n\n\n

\"heart<\/figure>\n\n\n\n

7.  Your Medical Equipment\u2019s Hard Drives<\/h3>\n\n\n\n

This is often another innocent oversight, but one that still leaves the healthcare organization at risk from both a data breach from cyber attackers and from landing on the wrong side of a HIPAA investigation. The CT scanner, MRI machine, dental x-ray device and other medical equipment in your office also have hard drives \u2014 and virtually all of the images and data stored on these hard drives is, by definition, ePHI.

You need to implement a process for encrypting these storage drives and regularly offloading the data to a secure server \u2014 whether that\u2019s a cloud storage plan or an on-premises secure server that your IT team manages.<\/p>\n\n\n\n

\"man<\/figure>\n\n\n\n

8.  Your ePHI Held by Third-Party Vendors<\/h3>\n\n\n\n

To function as a healthcare organization today, you almost certainly need to work with third parties, such as an after-hours answering service and a cloud provider to back up and provide disaster recovery services for your data. But these are yet more examples of places where your ePHI is residing, and where they also need protecting at all times.

Any vendor that handles your ePHI should be able to demonstrate that they understand HIPAA\u2019s requirements and their role in securing your ePHI, and that they have developed HIPAA compliant processes to secure your data at all times<\/a>.<\/p>\n\n\n\n

\n\n\n\n

Make Your ePHI Faxes Secure and HIPAA Compliant<\/h2>\n\n\n\n

As we noted in ePHI vulnerability #4 above, your data is probably residing unsecured on the hard drives of your office\u2019s copiers and fax machines. This is yet one more reason to upgrade your infrastructure from standard desktop fax machines or fax servers to a cloud fax model built specifically for businesses that need to transmit highly sensitive material by fax.<\/p>\n\n\n\n

A pioneer in cloud faxing 20 years, eFax Corporate\u00ae is the world\u2019s leading cloud fax partner for enterprises, and the most trusted provider of digital faxing services to the most heavily regulated industries \u2014 including healthcare.

Our\u00a0HIPAA compliant fax solution employs\u00a0the most advanced security and encryption protocols available for faxes in transit over the Internet. Additionally, we use the most sophisticated security protocols for a business\u2019s faxes at rest \u2014 in storage online after they have been either sent or received. That is why eFax Corporate is the cloud faxing solution preferred by the majority of Fortune 500 corporations.<\/p>\n\n\n\n

\n

Get Your Quote Today<\/h2>\n\n\n\n

For over two decades, eFax has been a leading provider of best-in-class electronic fax solutions, serving small businesses and cloud-driven enterprises alike.<\/p>\n\n\n