The University of North Texas just performed this survey to investigate PACS security usage and architectures in over 40 institutions. The organizations varied in size from 100-1,000 bed facilities and represented 50,000-1,000,000 examinations each year.
The information in the UNT survey displayed several potential vulnerabilities in regards to security plans. Because of the Federal HIPAA security regulation coming into effect on April 20th, these problems aren’t just impacting the integrity and availability of Patient Health Information but could also represent possible federal HIPAA violations.
Please remember, these following suggestions shouldn’t be taken as a comprehensive review of the HIPAA regulations or how they relate to PACS. For an assessment like that, refer to PACS Fundamentals, chapter 8, from www.otechimg.com.
Instead, the following focuses on the most apparent issues and threats. They are founded on the UNT survey and personal observations we’ve made while going to these institutions and communicating with PACS administrators.
- Deploy internal and external firewalls
Almost all institutions have an external firewall which connects the hospital’s core network to the outer network given by an ISP or WAN service provider. Still, most threats usually appear from the internal side of things. Typically this is due in part because of an attacker inserting a virus-infected CD or floppy or connecting his or her laptop to a device in order to be serviced or calibrated.
The survey proved that 90% of the institutions don’t have the PACS and RIS separated from a firewall. This indicates that a compromising condition at either the RIS or the PACS can affect both systems. Even the HIS isn’t always screened consistently. Numerous security incidents and downtime circumstances can be avoided or limited if an organization deploys these more widely.
- Ensure your virus scanner is up to date and properly installed
Virus protection is slightly difficult due to the fact that most commercial virus protections don’t always do a nice job with specialized and dedicated medical imaging devices.
Using anecdotal evidence, laptops slow down greatly after virus scanners for all incoming and outgoing files are installed. Additionally, it doesn’t make sense to ensure that every image leaving or entering a medical device gets scanned. There have been accounts about images being quarantined due to the fact that they fit certain signs of a certain virus. Also, the loss in performance with scanning files such as these is oftentimes unacceptable.
Thus, deploy virus scanners but closely work with the vendor to ensure they’re properly configured and have been confirmed by the vendor not to possess any negative impacts on the devices.
- Use the right VPN setup
Our investigation indicated that all hospital supported VPN for remote access. Though only 20% of those reported that they provided dial-up access as well. SSL is primarily utilized for remote access of PACS which is best at the communication level.
Said another way, a secure connection is put into place on an as-needed basis. The data is encrypted in order for it to be exchanged through public networks. In some instances, it might make sense to actually use IPsec technology for establishing a safe “tunnel” at the level of applications.