{"id":5720,"date":"2017-10-17T10:25:11","date_gmt":"2017-10-17T14:25:11","guid":{"rendered":"https:\/\/systems4pt.com\/staging\/?p=5720"},"modified":"2017-11-13T08:52:53","modified_gmt":"2017-11-13T13:52:53","slug":"cyber-security-alert-web-based-pt-emr-gets-even-risky","status":"publish","type":"post","link":"https:\/\/systems4pt.com\/staging\/cyber-security-alert-web-based-pt-emr-gets-even-risky\/","title":{"rendered":"Cyber Security: Web-Based PT EMR Gets Even More Risky"},"content":{"rendered":"

Cybersecurity Alert:<\/h2>\n

Web-Based PT EMR Gets Even More Risky<\/h2>\n

Yesterday, US-CERT (The United States Computer Emergency Readiness Team) disclosed that your wireless network is vulnerable to hackers. Technical details are listed at the end of this blog.<\/p>\n

HOW THIS IMPACTS YOUR PRACTICE<\/strong><\/h3>\n

With web-based PT EMR, PHI is sent to the therapist\u2019s computer where it resides in an unencrypted <\/strong>format. The vulnerability is obvious: Hackers can crack your WPA(2) encryption and literally copy\/export the data stream of PHI.\u00a0 If you log into your EMR on an internet browser (Chrome, Safari, Firefox, Edge), you have this vulnerability right now. This web-based PT EMR vulnerability is unacceptable.<\/p>\n

With Systems 4PT, PHI is accessed through a VPN (as is recommended by US-CERT). With this technology, unencrypted PHI data is never on the therapist\u2019s computer. In fact, the PHI never leaves our Data Center (the therapist edits the secure data, remotely).<\/p>\n

If you\u2019re using web-based PT EMR, the risks are amplified further. A leading web-based PT EMR advertises \u201cAnywhere Access\u201d and \u201cAny employee can access your PHI from any internet connected device, anywhere, anytime.\u201d The risks with this approach are unacceptable.<\/p>\n

We discussed the unacceptable vulnerabilities of web-based PT EMR above; that is, if a hacker is in your system, they can simply copy\/export the stream of unencrypted EMR. \u00a0Moreover, your vulnerabilities skyrocket<\/strong> if employees (or hackers) can log into ANY wireless network, using ANY computer, ANYWHERE, ANYTIME. \u00a0This concept encourages the scenario where the vulnerable EMR (where unencrypted PHI can be exported) can log into an unprotected wireless network on an infected computer. \u00a0And you, the practice owner, have absolutely no control over the process. \u00a0(You should not accept this risk.)<\/p>\n

With Systems 4PT, the practice owner decides which computers can access their PHI.<\/p>\n

Hacking is obviously accelerating. The \u201cbad guys\u201d are getting better each day.<\/p>\n

The bottom line: If you\u2019re using web-based PT EMR, we strongly advise against it. Systems 4PT is the leader in outpatient rehab cybersecurity. We don\u2019t use web-based navigation, we don\u2019t put unencrypted PHI on your computer. Instead, we use a VPN and we don\u2019t let \u201cany employee access your PHI from any computer, anywhere, anytime.\u201d<\/p>\n

To be clear, we\u2019re not saying that your web-based PT EMR is not HIPAA compliant. We\u2019re saying that this type of software makes your practice very, very vulnerable to hackers and a PHI data breach. And when that happens, you\u2019re the one who\u2019s not HIPAA compliant.<\/p>\n

Completely unacceptable.<\/p>\n<\/div>

Download Cybersecurity Workflow<\/span><\/a><\/div>

a<\/span><\/p>\n<\/div>

I can\u2019t accept these Web-based vulnerabilities. Let\u2019s Talk!<\/span><\/a><\/div>

BACKGROUND<\/strong><\/h3>\n

Most practices use wireless networks for internet access. The most widely used forms of encryption are WPA(1) and WPA(2). It\u2019s very important that you know which type of encryption you\u2019re using.<\/p>\n

Scary fact: Any tech enthusiast worth their salt can hack a WPA(1) encryption in about 15 minutes. It is important that you verify that your practice WiFi is not using WPA(1).<\/p>\n

Now we learn that WPA(2) encryption is vulnerable. Yesterday, an advisory from US-CERT publicly disclosed WPA(2) vulnerability to KRACK (or Key Reinstallation Attacks).<\/p>\n

Systems 4PT anticipates that all the major router vendors will either release a patch for current hardware, or in a worst-case scenario, develop a new encryption protocol. Until then, all WiFi traffic is at risk, meaning that hackers will be able to eavesdrop on all your WiFi traffic and steal PHI from vulnerable devices that connect to the internet wirelessly.<\/p>\n

The practice owners bear civil and criminal liability for any PHI data breach. US-CERT provided three suggestions to help you mitigate the problem while you wait for hardware companies to update router firmware.<\/p>\n

    \n
  1. Update your router regularly to check for security patch updates. If you don\u2019t know how to do this, search: How to update my [band name, model #] router<\/li>\n
  2. Stop using WiFi until your router provides a security patch<\/li>\n<\/ol>\n

    This would involve connecting to CATV ethernet cables and turning of the wireless access to the router. There\u2019s no question, this option limits mobility, but it fixes the problem.<\/p>\n

    For example, Systems 4PT\u2019s Technology Center does not use WiFi for business operations.<\/p>\n

      \n
    1. A much less intrusive option is using Virtual Private Networks (VPN) to obfuscate your internet usage, especially if you keep using WiFi, and especially in those places where you don’t control the wireless network<\/li>\n<\/ol>\n

      Systems 4PT is not web-based. PHI is accessed over a VPN. \u00a0With this technology, unencrypted PHI data is never on the therapist\u2019s computer. In fact, the PHI never leaves our Data Center (the therapist edits the secure data, remotely).<\/p>\n

      CONCLUSION<\/strong><\/h3>\n

      Your practice can achieve 99.9% cybersecurity if you follow the US-CERT recommendations and use Systems 4PT\u2019s VPN rather than web-based PT EMR, and if you follow our cybersecurity protocol.<\/p>\n<\/div><\/div><\/div>

      I can\u2019t accept these Web-based vulnerabilities.\u00a0 Let\u2019s Talk!<\/h2>\n<\/div>[contact-form-7 id=\"5393\" title=\"Free Demo_copy\"]
      Download Cybersecurity Workflow<\/span><\/a><\/div><\/div><\/div><\/div><\/div>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":1,"featured_media":5725,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"content-type":"","footnotes":""},"categories":[56],"tags":[],"class_list":["post-5720","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-general"],"yoast_head":"\nCyber Security: Web-Based PT EMR Gets Even More Risky - Systems4PT<\/title>\n<meta name=\"robots\" content=\"noindex, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Cyber Security: Web-Based PT EMR Gets Even More Risky\" \/>\n<meta property=\"og:url\" content=\"https:\/\/systems4pt.com\/staging\/cyber-security-alert-web-based-pt-emr-gets-even-risky\/\" \/>\n<meta property=\"og:site_name\" content=\"Systems4PT\" \/>\n<meta property=\"article:published_time\" content=\"2017-10-17T14:25:11+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2017-11-13T13:52:53+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/systems4pt.com\/staging\/wp-content\/uploads\/2017\/10\/S4PT_Security.jpeg\" \/>\n\t<meta property=\"og:image:width\" content=\"2560\" \/>\n\t<meta property=\"og:image:height\" content=\"1248\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Systems4PT\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Systems4PT\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/systems4pt.com\/staging\/cyber-security-alert-web-based-pt-emr-gets-even-risky\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/systems4pt.com\/staging\/cyber-security-alert-web-based-pt-emr-gets-even-risky\/\"},\"author\":{\"name\":\"Systems4PT\",\"@id\":\"https:\/\/systems4pt.com\/staging\/#\/schema\/person\/cbd6a79a0c6efcdf4bf949f37beca785\"},\"headline\":\"Cyber Security: Web-Based PT EMR Gets Even More Risky\",\"datePublished\":\"2017-10-17T14:25:11+00:00\",\"dateModified\":\"2017-11-13T13:52:53+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/systems4pt.com\/staging\/cyber-security-alert-web-based-pt-emr-gets-even-risky\/\"},\"wordCount\":1142,\"publisher\":{\"@id\":\"https:\/\/systems4pt.com\/staging\/#organization\"},\"image\":{\"@id\":\"https:\/\/systems4pt.com\/staging\/cyber-security-alert-web-based-pt-emr-gets-even-risky\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/systems4pt.com\/staging\/wp-content\/uploads\/2017\/10\/S4PT_Security.jpeg\",\"articleSection\":[\"General\"],\"inLanguage\":\"en\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/systems4pt.com\/staging\/cyber-security-alert-web-based-pt-emr-gets-even-risky\/\",\"url\":\"https:\/\/systems4pt.com\/staging\/cyber-security-alert-web-based-pt-emr-gets-even-risky\/\",\"name\":\"Cyber Security: Web-Based PT EMR Gets Even More Risky - Systems4PT\",\"isPartOf\":{\"@id\":\"https:\/\/systems4pt.com\/staging\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/systems4pt.com\/staging\/cyber-security-alert-web-based-pt-emr-gets-even-risky\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/systems4pt.com\/staging\/cyber-security-alert-web-based-pt-emr-gets-even-risky\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/systems4pt.com\/staging\/wp-content\/uploads\/2017\/10\/S4PT_Security.jpeg\",\"datePublished\":\"2017-10-17T14:25:11+00:00\",\"dateModified\":\"2017-11-13T13:52:53+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/systems4pt.com\/staging\/cyber-security-alert-web-based-pt-emr-gets-even-risky\/#breadcrumb\"},\"inLanguage\":\"en\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/systems4pt.com\/staging\/cyber-security-alert-web-based-pt-emr-gets-even-risky\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en\",\"@id\":\"https:\/\/systems4pt.com\/staging\/cyber-security-alert-web-based-pt-emr-gets-even-risky\/#primaryimage\",\"url\":\"https:\/\/systems4pt.com\/staging\/wp-content\/uploads\/2017\/10\/S4PT_Security.jpeg\",\"contentUrl\":\"https:\/\/systems4pt.com\/staging\/wp-content\/uploads\/2017\/10\/S4PT_Security.jpeg\",\"width\":2560,\"height\":1248,\"caption\":\"Blue chip executive locking laptop and mobile in a wireless communication network. Concept for internet of things security, smart devices management, remote access control and mobility as a service.\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/systems4pt.com\/staging\/cyber-security-alert-web-based-pt-emr-gets-even-risky\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/systems4pt.com\/staging\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Cyber Security: Web-Based PT EMR Gets Even More Risky\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/systems4pt.com\/staging\/#website\",\"url\":\"https:\/\/systems4pt.com\/staging\/\",\"name\":\"Systems4PT\",\"description\":\"Physical Therapy Software: Scheduling, EMR and Billing\",\"publisher\":{\"@id\":\"https:\/\/systems4pt.com\/staging\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/systems4pt.com\/staging\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/systems4pt.com\/staging\/#organization\",\"name\":\"Systems4PT\",\"alternateName\":\"S4PT\",\"url\":\"https:\/\/systems4pt.com\/staging\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en\",\"@id\":\"https:\/\/systems4pt.com\/staging\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/systems4pt.com\/staging\/wp-content\/uploads\/2023\/06\/cropped-favicon-avada-512x512-6.png\",\"contentUrl\":\"https:\/\/systems4pt.com\/staging\/wp-content\/uploads\/2023\/06\/cropped-favicon-avada-512x512-6.png\",\"width\":512,\"height\":512,\"caption\":\"Systems4PT\"},\"image\":{\"@id\":\"https:\/\/systems4pt.com\/staging\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/systems4pt.com\/staging\/#\/schema\/person\/cbd6a79a0c6efcdf4bf949f37beca785\",\"name\":\"Systems4PT\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en\",\"@id\":\"https:\/\/systems4pt.com\/staging\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/1373afdc7d5dc0851bb1478a44d4a874?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/1373afdc7d5dc0851bb1478a44d4a874?s=96&d=mm&r=g\",\"caption\":\"Systems4PT\"},\"url\":\"https:\/\/systems4pt.com\/staging\/author\/systemsadmin4pt\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Cyber Security: Web-Based PT EMR Gets Even More Risky - Systems4PT","robots":{"index":"noindex","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"en_US","og_type":"article","og_title":"Cyber Security: Web-Based PT EMR Gets Even More Risky","og_url":"https:\/\/systems4pt.com\/staging\/cyber-security-alert-web-based-pt-emr-gets-even-risky\/","og_site_name":"Systems4PT","article_published_time":"2017-10-17T14:25:11+00:00","article_modified_time":"2017-11-13T13:52:53+00:00","og_image":[{"width":2560,"height":1248,"url":"https:\/\/systems4pt.com\/staging\/wp-content\/uploads\/2017\/10\/S4PT_Security.jpeg","type":"image\/jpeg"}],"author":"Systems4PT","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Systems4PT","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/systems4pt.com\/staging\/cyber-security-alert-web-based-pt-emr-gets-even-risky\/#article","isPartOf":{"@id":"https:\/\/systems4pt.com\/staging\/cyber-security-alert-web-based-pt-emr-gets-even-risky\/"},"author":{"name":"Systems4PT","@id":"https:\/\/systems4pt.com\/staging\/#\/schema\/person\/cbd6a79a0c6efcdf4bf949f37beca785"},"headline":"Cyber Security: Web-Based PT EMR Gets Even More Risky","datePublished":"2017-10-17T14:25:11+00:00","dateModified":"2017-11-13T13:52:53+00:00","mainEntityOfPage":{"@id":"https:\/\/systems4pt.com\/staging\/cyber-security-alert-web-based-pt-emr-gets-even-risky\/"},"wordCount":1142,"publisher":{"@id":"https:\/\/systems4pt.com\/staging\/#organization"},"image":{"@id":"https:\/\/systems4pt.com\/staging\/cyber-security-alert-web-based-pt-emr-gets-even-risky\/#primaryimage"},"thumbnailUrl":"https:\/\/systems4pt.com\/staging\/wp-content\/uploads\/2017\/10\/S4PT_Security.jpeg","articleSection":["General"],"inLanguage":"en"},{"@type":"WebPage","@id":"https:\/\/systems4pt.com\/staging\/cyber-security-alert-web-based-pt-emr-gets-even-risky\/","url":"https:\/\/systems4pt.com\/staging\/cyber-security-alert-web-based-pt-emr-gets-even-risky\/","name":"Cyber Security: Web-Based PT EMR Gets Even More Risky - Systems4PT","isPartOf":{"@id":"https:\/\/systems4pt.com\/staging\/#website"},"primaryImageOfPage":{"@id":"https:\/\/systems4pt.com\/staging\/cyber-security-alert-web-based-pt-emr-gets-even-risky\/#primaryimage"},"image":{"@id":"https:\/\/systems4pt.com\/staging\/cyber-security-alert-web-based-pt-emr-gets-even-risky\/#primaryimage"},"thumbnailUrl":"https:\/\/systems4pt.com\/staging\/wp-content\/uploads\/2017\/10\/S4PT_Security.jpeg","datePublished":"2017-10-17T14:25:11+00:00","dateModified":"2017-11-13T13:52:53+00:00","breadcrumb":{"@id":"https:\/\/systems4pt.com\/staging\/cyber-security-alert-web-based-pt-emr-gets-even-risky\/#breadcrumb"},"inLanguage":"en","potentialAction":[{"@type":"ReadAction","target":["https:\/\/systems4pt.com\/staging\/cyber-security-alert-web-based-pt-emr-gets-even-risky\/"]}]},{"@type":"ImageObject","inLanguage":"en","@id":"https:\/\/systems4pt.com\/staging\/cyber-security-alert-web-based-pt-emr-gets-even-risky\/#primaryimage","url":"https:\/\/systems4pt.com\/staging\/wp-content\/uploads\/2017\/10\/S4PT_Security.jpeg","contentUrl":"https:\/\/systems4pt.com\/staging\/wp-content\/uploads\/2017\/10\/S4PT_Security.jpeg","width":2560,"height":1248,"caption":"Blue chip executive locking laptop and mobile in a wireless communication network. Concept for internet of things security, smart devices management, remote access control and mobility as a service."},{"@type":"BreadcrumbList","@id":"https:\/\/systems4pt.com\/staging\/cyber-security-alert-web-based-pt-emr-gets-even-risky\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/systems4pt.com\/staging\/"},{"@type":"ListItem","position":2,"name":"Cyber Security: Web-Based PT EMR Gets Even More Risky"}]},{"@type":"WebSite","@id":"https:\/\/systems4pt.com\/staging\/#website","url":"https:\/\/systems4pt.com\/staging\/","name":"Systems4PT","description":"Physical Therapy Software: Scheduling, EMR and Billing","publisher":{"@id":"https:\/\/systems4pt.com\/staging\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/systems4pt.com\/staging\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en"},{"@type":"Organization","@id":"https:\/\/systems4pt.com\/staging\/#organization","name":"Systems4PT","alternateName":"S4PT","url":"https:\/\/systems4pt.com\/staging\/","logo":{"@type":"ImageObject","inLanguage":"en","@id":"https:\/\/systems4pt.com\/staging\/#\/schema\/logo\/image\/","url":"https:\/\/systems4pt.com\/staging\/wp-content\/uploads\/2023\/06\/cropped-favicon-avada-512x512-6.png","contentUrl":"https:\/\/systems4pt.com\/staging\/wp-content\/uploads\/2023\/06\/cropped-favicon-avada-512x512-6.png","width":512,"height":512,"caption":"Systems4PT"},"image":{"@id":"https:\/\/systems4pt.com\/staging\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/systems4pt.com\/staging\/#\/schema\/person\/cbd6a79a0c6efcdf4bf949f37beca785","name":"Systems4PT","image":{"@type":"ImageObject","inLanguage":"en","@id":"https:\/\/systems4pt.com\/staging\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/1373afdc7d5dc0851bb1478a44d4a874?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/1373afdc7d5dc0851bb1478a44d4a874?s=96&d=mm&r=g","caption":"Systems4PT"},"url":"https:\/\/systems4pt.com\/staging\/author\/systemsadmin4pt\/"}]}},"_links":{"self":[{"href":"https:\/\/systems4pt.com\/staging\/wp-json\/wp\/v2\/posts\/5720","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/systems4pt.com\/staging\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/systems4pt.com\/staging\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/systems4pt.com\/staging\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/systems4pt.com\/staging\/wp-json\/wp\/v2\/comments?post=5720"}],"version-history":[{"count":12,"href":"https:\/\/systems4pt.com\/staging\/wp-json\/wp\/v2\/posts\/5720\/revisions"}],"predecessor-version":[{"id":5769,"href":"https:\/\/systems4pt.com\/staging\/wp-json\/wp\/v2\/posts\/5720\/revisions\/5769"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/systems4pt.com\/staging\/wp-json\/wp\/v2\/media\/5725"}],"wp:attachment":[{"href":"https:\/\/systems4pt.com\/staging\/wp-json\/wp\/v2\/media?parent=5720"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/systems4pt.com\/staging\/wp-json\/wp\/v2\/categories?post=5720"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/systems4pt.com\/staging\/wp-json\/wp\/v2\/tags?post=5720"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}