6 Cybersecurity Questions Healthcare Leaders Should Ask This October

Cybersecurity Awareness Month isn’t only an opportunity to remind employees to watch for phishing emails or protect their passwords. 

It’s also a good time for healthcare leaders to ask a bigger question: Are the cybersecurity fundamentals actually working across your organization? 

Here are six questions worth asking. 

1. Do employees know how to report something suspicious?

If someone receives a suspicious email, unexpected MFA prompt, strange phone call, or notices unusual system activity, do they know exactly what to do? 

Quick check: Ask a few employees how they would report a cybersecurity concern. If the answers are different—or they don’t know—you’ve found a gap. 

2. Is your Security Risk Analysis current, and are you acting on what it found?

Your Security Risk Analysis should reflect the systems, devices, locations, vendors, and workflows your organization uses today. 

But identifying risks is only the first step. Those findings need to lead to action. 

Quick check: Have you added new technology, vendors, locations, or ways of handling electronic protected health information since your last assessment? Then pick a few risks from your most recent analysis. Can you identify what has been done, who owns the next step, and what still needs attention? 

3. Do you know where your ePHI lives?

Electronic protected health information can exist well beyond the EHR. 

Think email, mobile devices, cloud applications, file-sharing tools, medical devices, backups, and other systems employees use every day. 

Quick check: Is there anywhere ePHI is stored, transmitted, or accessed that isn’t reflected in your current documentation? 

4. Are employees prepared for unexpected login requests?

Multifactor authentication adds another layer of protection, but employees still need to recognize when something isn’t right. 

Quick check: Do employees know not to approve an MFA request they didn’t initiate—and how to report it? 

5. Are systems and software being kept current?

Unpatched or unsupported technology can create opportunities for attackers. 

Quick check: Ask whether there are critical updates, known vulnerabilities, or outdated systems that still need attention. 

6. Does cybersecurity training continue after annual training is complete?

Annual training can establish a foundation. But employees make security decisions all year. 

Phishing changes. Social-engineering tactics evolve. People forget. 

Quick check: What is your organization doing between annual training sessions to keep cybersecurity habits top of mind? 

Cybersecurity Is an Ongoing Practice 

You don’t need to solve every cybersecurity challenge during October. 

But Cybersecurity Awareness Month is a good reason to ask the questions, identify gaps, and decide what needs attention next. 

And when it comes to your workforce, reinforcement matters. 

HIPAA Secure Now’s PHIshMD Ongoing Training Program helps healthcare organizations keep cybersecurity top of mind throughout the year with bite-sized training, simulated phishing, and ongoing visibility into employee risk. 

 

Don’t make cybersecurity a once-a-year conversation.

Click Here to Learn More About PHIsh MD