Information Security in a World of Technology

Introduction

The contemporary healthcare delivery system is a multifaceted system that is faced with numerous competing demands. One of those demands pertains to the calls for elevated quality and safety in the provision of care. Notably, with the advent of health information technology solutions such as electronic health records, patients are at significant risk of being exposed to security vulnerabilities that come from unauthorized third parties, such as hackers. Consequently, the following literature aims to present some of the techniques that can be used to safeguard the personal health information of patients, such as training staff on security measures. Additionally, the article also explores some of the educational approaches that may be used to offer training to the staff.

Education Methods

Instructor-led training:  This education model involves classroom or instructor-led training that is delivered using an instructor to the audience of learners that are present within a classroom setting or via AV technology. The deployment of instructor-led training is usually time-consuming as it calls for the least amount of work hours among the staff.  Besides, numerous costs accompany the use of this educational technique, including salaries of the trainers, salaries of the support staff, technology, end-users, and replacement staff (Hebda et al., 2019 .p.223). The best approach to evaluate the success of this educational model is through formative evaluation. Formative evaluation appraises the effectiveness of instructor-led training on a wide range of issues, including the success of the training and its ability to meet learners’ needs alongside the content (Buckley, 2018).

Self-Guided Learning: Even though rarely used, the self-guided learning approach uses text-based training manuals or materials that the learner may follow to gather new knowledge or skills. This is considered a cost-efficient educational approach as the only costs covered include those of producing stapled copies of manuscripts or digital training manuals. One major drawback of this learning approach pertains to the little-to-no ability to monitor compliance with training alongside the lack of instructional interaction with end-users (Hebda et al., 2019, p.223). Subsequently, this may make the educational model difficult to evaluate. However, one effective evaluation technique that can be used in this circumstance is knowledge evaluation. This involves the assessment of how the learner has gained new information and knowledge from self-guided learning (Buckley, 2018).

Blended learning: Blended learning integrates the element of several different education techniques in a bid to maximize learning and application while also reducing the costs linked to substantial time spent in a classroom. This model of learning typically may use print-based or web-based instructions for the preparation of ILT that emphasize the incorporation of concepts (Hebda et al., 2019, p.224). As such, the most effective evaluation technique that can be used in this case is reaction evaluation, which is largely based on the evaluation of the reaction or the response to the training (Buckley, 2018).

How Healthcare Organizations May Protect Patient Health Information (PHI)

The Health Insurance Portability and Accountability Act (HIPAA) mandates healthcare organizations alongside business associates to institute safeguards that ensure confidentiality and integrity alongside the availability of patient health information (PHI). These safeguards may come in four different approaches, including security mechanisms, administrative and personnel issues, accessibility levels, alongside the handling and disposal of confidential information.

Security mechanism: There are multiple security mechanisms that healthcare organizations may introduce to ensure that PHI does not fall into the wrong hands. Some of the security mechanisms that can be implemented include the use of:

Firewalls prevent unauthorized individuals from gaining access to the facility’s network and data.

Spam filters that block malicious emails and malware.

An antivirus solution to block as well as to detect the presence of malware in the system.

The use of data encryption on all portable devices.

A HIPAA-compliant messaging platform that encrypts all communications between providers and clinicians (Alder, 2017).

Administrative and personal issues: Some of the typical administrative alongside personnel issues that can be undertaken to safeguard PHI include:

Creating security awareness and anti-phishing training for the staff.

Implementation of administrative actions policies, and procedures to manage the selection, development, and implementation, alongside the maintenance of security measures that protect the electronic health records of patients.

Enacting incident response plans.

Implementing business associate agreements and background checks (Alder, 2017).

Level of Accessibility: To control the level of accessibility of information, the following ought to take place:

Ensuring that PHI is disseminated with practices and organizations that are HIPAA-compliant to promote the coordination, provision, and management of healthcare-related services such as billing and payment.

The implementation of an intrusion detection system that monitors for any changes in the files as well as network activity.

The storage of charts in secure locations, thereby ensuring that they are accessed by authorized individuals (Kruse & Smith, 2017).

Handling and Disposal of Confidential Information:  The following strategies are proposed by HIPAA for the handling and disposal of confidential patient health information. Storing confidential patient health information in a secure place away from unauthorized individuals.

For PHI paper charts, HIPAA stipulates that they ought to be disposed of through burning, pulping, shredding, or pulverizing so that they remain unreadable or undecipherable and may not be reconstructed.

Storing confidential patient health information in a secure place away from unauthorized individuals (Kruse & Smith, 2017).

Educational Methods to Train the Staff

E-learning: One of the most effective approaches to training that can be used to educate the staff on phishing and spam emails is e-learning. This refers to the presentation of learning content by information technology, such as computers as well as handheld devices. In my case, the most ideal approach that will be utilized is PowerPoint. For the PowerPoint presentation, I will utilize elements that engage the user with interactive simulations, activities, and questions. Nonetheless, I would avoid the use of exaggerated transitions, imagery, and themes that can potentially cause cognitive overload on the side of the staff and, as such, significantly impact their learning experience (Hebda et al., 2019, p.225).

Self-Guided Learning: The other educational approach that I would utilize in delivering education to the staff concerning spam emails and phishing is the self-guided learning approach. A self-guided learning approach is a training-delivery approach that uses text-based training manuals and materials that the end-user may follow to learn about the topic. Subsequently, some of the materials I would use in the self-guided approach include the use of posters, manuals, protocols, and guidelines that will be distributed to each of the staff.  One drawback that is expected from the use of this approach includes the inability to monitor compliance with training alongside the lack of instructional interaction with end-users (Hebda et al., 2019,p.223).

Just-in-time training: In this model, I will be physically present with the staff to walk them through some of the daily processes, such as when feeding the electronic health records. In this approach, the trainers will be assigned to tasks that can be performed in patient-care areas, such as monitoring user reports and auditing reports. One of the major drawbacks expected from this training model includes the fact that physicians rarely see the entire flow of a process and all the steps that are involved from the beginning to the end (Hebda et al., 2019).

Conclusion

Conclusively, The Health Insurance Portability and Accountability Act (HIPAA) mandates healthcare organizations alongside business associates to institute safeguards that ensure confidentiality and integrity alongside the availability of patient health information (PHI). One safeguard that organizations may use involves the implementation of administrative actions, policies, and procedures to manage the selection, development, and implementation, alongside the maintenance of security measures that protect the electronic health records of patients.

References

Top of Form

Alder, S. (2017). How to Secure Patient Information (PHI). HIPAA Journal. https://www.hipaajournal.com/secure-patient-information-phi/

Buckley, K. M. (2018). Evaluation of classroom-based, web-enhanced, and web-based distance learning nutrition courses for undergraduate nursing. Journal of Nursing Education, 42(8), 367–370

Hebda, T., Hunter, K. M., & Czar, P. (2019). Handbook of informatics for nurses and healthcare professionals. In Open WorldCat. Pearson. https://www.worldcat.org/title/handbook-of-informatics-for-nurses-and-healthcare-professionals/oclc/1035016210

Kruse, C. S., & Smith, B. (2017). Security Techniques for the Electronic Health Records. Journal of Medical Systems, 41(8). https://doi.org/10.1007/s10916-017-0778-4

ORDER A PLAGIARISM-FREE PAPER HERE

We’ll write everything from scratch

---

The textbook discusses several education methods. Discuss each method with an example of how the method could be used in the organization. Then, discuss how you will evaluate the method and learning.

Healthcare continues to be a lucrative target for hackers with weaponized ransomware, misconfigured cloud storage buckets, and phishing emails. Discuss how an organization can protect patients’ information through:
Security mechanisms
Administrative and Personnel Issues
Level of access
Handling and Disposal of Confidential Information
You are providing education to staff on phishing and spam emails. Using the different educational methods discussed in Chapter 12:
Provide examples of how each method can be used
How will the method and learning be evaluated?