Scribd
Upload
110 views

Final Project

The medical office had an unsecured wireless network that allowed an unauthorized individual to access the office's network and potentially steal patient information. A laptop used in the office was infected with malware. The nurses noticed issues when logging into the patient database. The office needs to improve security by creating a password-protected guest wireless network separate from the office network, training staff, installing firewalls, and adopting multifactor authentication for accessing patient information.

Uploaded by

api-634541485
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
110 views

Final Project

The medical office had an unsecured wireless network that allowed an unauthorized individual to access the office's network and potentially steal patient information. A laptop used in the office was infected with malware. The nurses noticed issues when logging into the patient database. The office needs to improve security by creating a password-protected guest wireless network separate from the office network, training staff, installing firewalls, and adopting multifactor authentication for accessing patient information.

Uploaded by

api-634541485
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
You are on page 1/ 12

Logical Networking and

Medical Practices
Amy Lawson-Gunkel
A Generic Logical
Network Map for
a PCM’s Office
To gain a stance on the network,
capture some of the data that travels
across the network on any given day.
This can be done using Wire Shark.
I
In this example, we have an
executable file that made its way onto
the office’s mobile laptop
It appears as though the hard wired connections remain
secure, while the wireless devices have executables hidden
amongst their files.

It seems as though the office has only one wireless network,


which they also allow their patient’s to utilize while waiting
to be seen; as a consequence, an individual was able to get
on their network and could have potentially stolen patient
information.
While speaking with one of the
nurses, she expressed
frustrations concerning the entry
of new patients. Recently she
noticed that she is exited from
the patient database and
prompted to log back in .
Upon further examination, we notice that when she is
prompted to log back in there are some subtle differences
from when she logged into the system in the morning.

At this point we can begin drawing our conclusions on


their security stance and advise the office on how to
overcome the issue at hand, as well as prevention for the
future.
Strengths
The office seemed to only be vulnerable
at their wireless point.

Only new patient’s were being entered


into the laptop’s for intake purposes (no
files built on these devices)

The nurse was able to identify a


discrepancy with their computer’s
performance
Weaknesses
The office does not have a password
protected Wi-Fi network that is separate
from their waiting room Wi-Fi.

The staf f is not properly trained to


identify signs of possible incidents.

Even though detailed patient files were


not exposed to the threat, patient PII
became vulnerable and at risk.
Opportunities
This particular office now has the opportunity to host
training on different ways to identify possible intrusions
to their network.

They also should take the time to set up aWAP2


password for theirWi-Fi, one that is independent of their
guest network.

Finally, they should evaluate their devices to ensure they


have identified and removed all traces of malware.AND
they should notify the Officefor Civil Rights
Threats

At this point we can identify an external


threat, preying on the ignorance of the
nurses.

If the security standards are not changed,


then any individual could pose a potential
threat to this office’s network.
 Short Term Goals:
 Create a WAP2 password for the Wi-Fi
 Change the nurses login information/password
 Notify the Office for Civil Rights
 Notify the Patient’s

GOALS
GOALS
 Long Term Goals:
GOALS  Train the staff on the identification and prevention of possible
incidents.
 Install hardware and software firewalls.
 Incorporate a two factor authentication for accessing the patient
database
 This office is in a state of non-compliance for the following
reasons
 The office did not introduce a means to authenticate ePHI

Statement of  There were no tools implemented for encryption/decryption


 No procedures were used to protect the ePHI
NonComplianc  A risk assessment was not previously conducted

e  No sign of risk management policy in play


 Employees were not trained to be secure
 A contingency plan was not put in place
 There was no restriction of third-party access to the network

You might also like