<img src="https://ws.zoominfo.com/pixel/4CagHYMZMRWAjWFEK36G" width="1" height="1" style="display: none;">
Request Demo


An article from HealthITSecurity detailed that NIST and the National Cybersecurity Center of Excellence (NCCoE) have released a guidance on how healthcare providers can make an effort to secure mobile devices in the healthcare industry. The securing Electronic Records on Mobile Devices guidance gives information for security practitioners, IT-focused professionals, and security engineers.

“Healthcare providers increasingly use mobile devices to store, process, and transmit patient information. When health information is stolen, inappropriately made public, or altered, healthcare organizations can face penalties and lose consumer trust, and patient care and safety may be compromised,” says the guidance text.

According to the article, "mobile device security is a top concern of healthcare providers when it comes to their mobile programs, according to a recent survey of 600 healthcare IT decision makers conducted by Vanson Bourne on behalf of mobile device management provider Jamf.

Despite their concern, a full 90 percent of respondents said their institution is implementing or planning to implement a mobile initiative. And nearly half plan to increase mobile device usage within the next two years.

The guide shows how healthcare providers can more securely share patient information among caregivers using mobile devices using open-source and commercially available tools and technologies. Specifically, the guide's security architecture provides several benefits to healthcare organizations. The security architecture maps to standards and best practices from NIST, including the NIST Cybersecurity Framework and the HIPAA Privacy and Security Rules

The guide was developed by industry and academic cybersecurity experts, with the input of healthcare providers who first identified the challenge. The center invited technology providers with relevant commercial products to partner with NIST through cooperative research and development agreements and collected public feedback.

The team at the NCCoE built a virtual environment that simulates interaction among mobile devices and an EHR system supported by the IT infrastructure of a medical organization. NCCoE was founded in  2012 by NIST, the state of Maryland, and Montgomery County, Maryland. 

The high-level abstract security architecture involves a multi-step information transfer process:

1) a physician uses a mobile device application to send a referral to another physician

2) the application sends the referral to a server running a certified EHR application

3) the server routes the referral to the referred physician, and 4) the referred physician uses a mobile device to receive the referral.

NIST Guide cover-2

The architecture uses commercially available Medical Internet of Things (MIoT.) When there were no commercial products to address specific needs, NIST and NCCoE researchers used open-source products. Commercial and open-source standards-based products are available and interoperable with commonly used IT infrastructure and investments.

The architecture has a modular design, allowing organizations to adopt as much or as little of the reference design as suits their needs."

The guidance noted that healthcare organizations, regardless of size, location, etc., must "fully understand their potential cybersecurity risks, the bottom-line implications of those vulnerabilities, and the lengths that attackers will go to exploit vulnerabilities."

The guidance continued to advise: "Assessing risks and making decisions about how to mitigate them should be continuous to account for the dynamic nature of business processes and technologies, the threat landscape, and the data itself."

The guidance also said that the authors would "recommend that organizations implement a continuous risk management process as a starting point for adopting this or other approaches that will increase the security of EHRs. It is important for management to perform periodic risk reviews, as determined by the needs of the business."

NIST's Internet of Things (IoT) Framework draft is out and is readily available via the CyberStrong Platform. Use CyberStrong's Integrated Risk Management Platform to streamline compliance and risk projects and accurately map your risks across cloud, mobile, and other risk areas, regardless of complexity. CyberStrong is the most cost-competitive integrated risk management solution available while remaining robust enough to handle an exponential amount of company or supply chain data and scalable across even hundreds (or thousands) of assessments. Learn more by scheduling a free demo and experience automated intelligence cyber compliance and risk management.

You may also like

Leveraging Cyber Risk Dashboard ...
on March 20, 2023

Cybersecurity risks have a far-reaching impact. As we’ve come to know, the effect of cyber has grown far beyond information systems and can render a company obsolete. The data and ...

Private Equity Firms are Embracing ...
on March 15, 2023

Private Equity firms pride themselves on implementing best practices in every functional area within their portfolio companies. Cyber Risk Management is emerging as a core ...

How to Use Cyber Risk Analysis to ...
on February 28, 2023

Cyber risk management has become more challenging to manage and monitor as the cybersecurity landscape has developed and digitized. Numerous endpoints, regulatory changes, cloud ...

The Top 10 Cybersecurity Dashboard ...
on February 23, 2023

As cybersecurity continues to become a more significant focus for organizations, other C-suite leaders must get up to speed on cyber risks and their impact on the organization's ...

Leveraging CISO Dashboard Metrics ...
on February 21, 2023

As a Chief Information Security Officer (CISO), it is essential to clearly understand your organization’s cybersecurity posture and how to improve it continuously. One way to do ...

The Importance of Monitoring Cyber ...
on February 14, 2023

Cybersecurity has become a critical concern for businesses and organizations in today’s digital age. With the increasing number of cyber threats and attacks, monitoring ...