However, this ease of access is met with cybersecurity threats and data privacy challenges.[4]<\/a>\u00a0 The sensitive and patient-care-centeredness of EHRs make them susceptible to cyber-attacks.[5]<\/a>\u00a0 This is because they contain Personal Health Information (PHI), which cyber attackers sell for profit on the dark web.[6] <\/a>Cyberattacks on EHRs occur in diverse ways. Some of these cyberattacks include:<\/p>\n <\/p>\n In dealing with cybersecurity threats to EHRs, Federal compliance laws such as the Health Insurance Portability and Accountability Act (HIPAA) and Health Information Technology for Economic and Clinical Health (Act) were enacted to protect the privacy and data security of Personal Health Information (PHI) which are stored electronically.[14]<\/a> In addition, the HIPAA privacy rule establishes \u201cnational standards to protect individuals\u2019 medical records and other individually identifiable health information\u2026.\u201d[15]<\/a><\/p>\n The HIPAA Security Rule also establishes appropriate safeguards to ensure the confidentiality, integrity, and security of electronically protected health information.[16]<\/a> The Security Rule provides administrative, physical, and technical safeguards for managing healthcare data privacy.[17]<\/a>\u00a0 Some of these safeguards include: i.) establishing a security management process in which the covered entity must implement policies and procedures to prevent, detect, contain, and correct security violations;[18]<\/a> ii.) appointing a designated security official who is responsible for the development and implementation of policies and procedures mandated by the Security Rule;[19] <\/a>iii.) implementing policies and procedures to address security incidents when they occur;[20]<\/a> iv.) creating policies and procedures for responding to an emergency that damages computer systems containing EHRs;[21]<\/a> v.) establishing safeguards for workstation security;[22] <\/a>vi.) implementing audit controls for information systems;[23]<\/a> and vii.) implementing measures to protect against unauthorized access to electronic personal health information transmitted over an electronic communications network.[24] <\/a><\/p>\n In addition, the HITECH Act establishes the Breach Notification Rule. This rule requires Health care providers as well as other covered entities under HIPAA to promptly notify (within 60 calendar days from the day the breach is discovered) individuals of a data breach, as well as the Secretary of the U.S. Department of Health and Human Services (HHS) and the media in cases where the breach affects more than 500 individuals.[25]<\/a> Breaches of fewer than 500 individuals must be reported to the Secretary of the HHS on an annual basis, no later than 60 calendar days from the end of the year.[26] <\/a>As healthcare delivery technology continues to evolve, cyber-attacks on EHRs continue to happen. It is therefore imperative that healthcare providers and other key players implement policies that align cybersecurity and patient safety initiatives. These measures will protect patient safety and privacy while ensuring continuity in the delivery of high-quality healthcare by mitigating disruptions.<\/p>\n <\/p>\n [1]<\/a> Electronic Medical Record in Healthcare<\/em>, U.S. Dept. Health Hum. Serv. 1, 3 (2022), https:\/\/www.hhs.gov\/sites\/default\/files\/2022-02-17-1300-emr-in-healthcare-tlpwhite.pdf.<\/p>\n [2]<\/a> Id.<\/em><\/p>\n [3]<\/a> Liu Hua Yeo & James Banfield, Human Factors in Electronic Health Records Cybersecurity Breach: An Explanatory Analysis<\/em>, Perspectives In Health Info. Mgmt. (Mar. 15, 2022), https:\/\/www.ncbi.nlm.nih.gov\/pmc\/articles\/PMC9123525\/.<\/p>\n [4]<\/a> Id<\/em>.<\/em><\/p>\n [5]<\/a> Greg Kill, Top 5 Cybersecurity Threats to Electronic Health Records and Electronic Medical Records<\/em>, Integracon (Apr. 28, 2018), https:\/\/integracon.com\/top-5-cybersecurity-threats-to-electronic-health-records-and-electronic-medical-records\/.<\/p>\n [6]<\/a> U.S. Dept. Health Hum. Serv., supra<\/em> note 1, at 6.<\/p>\n [7]<\/a> Edward Kost, Biggest Cyber Threats in Healthcare<\/em>, Upguard (Aug. 8, 2022), https:\/\/www.upguard.com\/blog\/biggest-cyber-threats-in-healthcare.<\/p>\n [8]<\/a> Id.<\/em><\/p>\n [9]<\/a> Cyber Attacks: In the Healthcare Sector<\/em>, Ctr. Internet Sec., https:\/\/www.cisecurity.org\/insights\/blog\/cyber-attacks-in-the-healthcare-sector (last visited Sept. 14, 2022).<\/p>\n [10]<\/a> Id.<\/em><\/p>\n [11]<\/a> Hardik Shah, Top 10 Cybersecurity Challenges in the Healthcare Industry<\/em>, Global Sign (May 5, 2022), https:\/\/www.globalsign.com\/en\/blog\/10-cybersecurity-challenges-healthcare.<\/p>\n [12]<\/a> Id.<\/em><\/p>\n [13]<\/a> Id.<\/em><\/p>\n [14]<\/a>\u00a0\u00a0 Liu Hua Yeo & Banfield, supra note<\/em> 3.<\/p>\n [15]<\/a> See The HIPAA Privacy Rule<\/em>, HHS.gov., https:\/\/www.hhs.gov\/hipaa\/for-professionals\/privacy\/index.html (last visited Sept. 14, 2022).<\/p>\n [16]<\/a> The Security Rule<\/em>, HHS.gov., \u00a0https:\/\/www.hhs.gov\/hipaa\/for-professionals\/privacy\/index.html (last visited Sept. 14, 2022).<\/p>\n [17]<\/a> Ryan L. Garner, Evaluating Solutions to Cyber Attack Breaches of Health Data: How Enacting A Private Right of Action For Breach Victims Would Lower Costs<\/em>, 14 Ind. Health L. Rev. 127, 139\u00a0 (2017).<\/p>\n [18]<\/a> Id.<\/em>; 45 C.F.R. \u00a7 164.308 (a)(3)(i) (2017).<\/p>\n [19]<\/a> Id<\/em>. \u00a7 164.308(a)(2).<\/p>\n [20]<\/a> Id.<\/em> \u00a7 164.308(a)(6)(i).<\/p>\n [21]<\/a> Id.<\/em> \u00a7 164.308(a)(6)(i).<\/p>\n [22]<\/a> 45 C.F.R. \u00a7 164.308(a)(6)(i) (2017).<\/p>\n [23]<\/a> Id.<\/em> \u00a7 164.312(b).<\/p>\n [24]<\/a> Id.<\/em> \u00a7 164.312(e)(1).<\/p>\n [25]<\/a> 45 C.F.R. \u00a7\u00a7 164. 400-414 (2009).<\/p>\n\n
\n
![\"\"](\"https:\/\/jolt.richmond.edu\/files\/2022\/09\/Screen-Shot-2022-09-26-at-3.34.41-PM.png\")
<\/p>\n