6 Simple Cybersecurity Tips for EMS Agencies

(2 min read) EMS agencies are very attractive targets for cybercriminals.  But, there are easy steps you can take to better protect your information from a cyber-attack.

1. “Cyber Check” Your Vendors

Third-party billing companies and ePCR vendors host a lot (sometimes almost all) of our patient data.  Ask your vendors the following questions:

• Do you have a documented risk analysis?
• What measures do you employ to protect against cyber-attacks?
• What type of “Cyber Events” will you notify us about and how soon?

2. Monitor Software Updates

Software updates address vulnerabilities that already exist in software.  It’s critical to monitor for urgent patches and implement updates before vulnerabilities are exploited.  Ask your vendors about updates and how they occur (automatically and how often). If your vendor maintains an open connection to the installed software (a “back door”), ensure that there is a secure connection at the firewall.

3. Practice Good Operating System Maintenance

Make sure:

• User accounts for former employees are appropriately and timely disabled (usually immediately upon separation)
• All devices (laptops, etc.) or storage media are properly “sanitized” before disposal or reuse
• Software that is no longer needed is fully uninstalled (including trial software and old versions of current software)

4. Have and Test a Cybersecurity Plan

Ask your IT folks, “If we got hit with a ransomware attack today, what would we do?”.  You need a plan and you need to test that plan periodically.  That means making sure you can restore data from backups in a timely fashion and that folks report events immediately to the appropriate individual(s). 

5. Have Good Backup Practices

Make sure you:

• Have frequent (daily preferred) backups of all important data
• Periodically test your backups
• Maintain backups offline and unconnected from networks

6. Encrypt, Encrypt, Encrypt Your Sensitive Data

Important data should be encrypted while at rest and in motion.  Recommended best practices for encrypting health information can be found at https://www.hhs.gov/hipaa/for-professionals/breach-notification/guidance/index.html.