<img height="1" width="1" style="display:none;" alt="" src="https://dc.ads.linkedin.com/collect/?pid=293162&amp;fmt=gif">

Ryan Stark | December 11, 2019

6 Simple Cybersecurity Tips for EMS Agencies

(2 min read) EMS agencies are very attractive targets for cybercriminals.  But, there are easy steps you can take to better protect your information from a cyber-attack.

Conceptual image of micro circuit. Security concept

1. “Cyber Check” Your Vendors

Third-party billing companies and ePCR vendors host a lot (sometimes almost all) of our patient data.  Ask your vendors the following questions:

  • Do you have a documented risk analysis?
  • What measures do you employ to protect against cyber-attacks?
  • What type of “Cyber Events” will you notify us about and how soon?

2. Monitor Software Updates

Software updates address vulnerabilities that already exist in software.  It’s critical to monitor for urgent patches and implement updates before vulnerabilities are exploited.  Ask your vendors about updates and how they occur (automatically and how often). If your vendor maintains an open connection to the installed software (a “back door”), ensure that there is a secure connection at the firewall.

3. Practice Good Operating System Maintenance

Make sure:

  • User accounts for former employees are appropriately and timely disabled (usually immediately upon separation)
  • All devices (laptops, etc.) or storage media are properly “sanitized” before disposal or reuse
  • Software that is no longer needed is fully uninstalled (including trial software and old versions of current software)

4. Have and Test a Cybersecurity Plan

Ask your IT folks, “If we got hit with a ransomware attack today, what would we do?”.  You need a plan and you need to test that plan periodically.  That means making sure you can restore data from backups in a timely fashion and that folks report events immediately to the appropriate individual(s). 

5. Have Good Backup Practices

Make sure you:

  • Have frequent (daily preferred) backups of all important data
  • Periodically test your backups
  • Maintain backups offline and unconnected from networks

6. Encrypt, Encrypt, Encrypt Your Sensitive Data

Important data should be encrypted while at rest and in motion.  Recommended best practices for encrypting health information can be found at https://www.hhs.gov/hipaa/for-professionals/breach-notification/guidance/index.html

ZOLL-Pulse-Blog-Logo-FINAL-_Dec17_OL-White 220w

Insights for Informed Decisions

Subscribe to our blog to learn from industry experts on how you can improve performance - operational, clinical and financial.

More About the Author:

Ryan Stark

Ryan Stark is a Managing Partner with Page, Wolfberg & Wirth, and is the firm’s resident “HIPAA guru.” He counsels clients on labor relations, privacy, security, reimbursement, and other compliance matters affecting the ambulance industry. Ryan is passionate about educating EMS professionals and loves collaborating with providers and CEOs alike. He is a featured speaker in PWW seminars and webinars, including the firm’s signature abc360 Conference, where he hosts the abc360 Game Show. Always enthusiastic, Ryan has been invited to speak at many state and regional EMS conferences, as well as national industry events. He is also an adjunct professor at Creighton University in the school’s Master of Science in Emergency Medical Services Program.