The National Cybersecurity Center of Excellence (NCCoE) has released a draft for public comment of the first guide in a new series of publications that will show businesses and other organizations how to improve their cybersecurity using standards-based, commercially available or open-source tools. 

The step-by-step guide demonstrates how healthcare providers can make mobile devices, such as smartphones and tablets, more secure, in order to better protect patient information and still take advantage of advances in communications technology.

The guide was developed because the use of mobile devices to store, access and transmit EHRs is outpacing the privacy and security protections on those devices, according to a release.

Securing Electronic Records on Mobile Devices provides IT implementers and security engineers with a detailed architecture so that they can copy, or recreate with different but similar technologies, the security characteristics of the guide. It also maps to standards and best practices from the National Institute of Standards and Technology (NIST) and others, and to HIPAA rules. The guide takes into account the need for different types of implementation for different circumstances such as when cybersecurity is handled in-house or is outsourced.

The draft guide was developed by industry and academic cybersecurity experts, with the input of healthcare providers who first identified the challenge. The center then invited technology providers with relevant commercial products to partner with NIST through cooperative research and development agreements and collected public feedback at multiple steps along the way.

The team at the NCCoE built a virtual environment that simulates interaction among mobile devices and an electronic health record system supported by the IT infrastructure of a medical organization. They developed a scenario in which a hypothetical primary care physician uses her mobile device to perform recurring activities such as sending a referral containing clinical information to another physician or sending an electronic prescription to a pharmacy. Then, using commercially available technologies, they built a solution to improve privacy and security protections.