Current threats to medical data security in family doctors’ practices

The recent massive worldwide WannaCry/WannnaDecryptor ransomware attack on medical information systems, beginning 12 May 2017, demonstrated that even a temporary loss of the ability to create, update, or access medical data is detrimental both to patients’ medical safety and to medical professionals’ ability to work. In Poland, medical documents exist in paper-based and electronic forms; complete migration to computer processing and storage of medical data has already been delayed for ten years. Securing paper-based medical documents is comparably easy; the most common problems are illegibility; loss of the file; and errors in filling out the document, such as failure to fill in the obligatory fields identifying the patient, the medical professional filling in the document, or the date and time of document creation; and faulty, missing, or irrelevant data pertaining to health state, diagnostics, or therapy. In contrast, making electronic medical files secure is no longer a single time-limited, well-defined event, but rather a dynamic, long-lasting process of balancing risks against protective measures in highly unpredictable environment. Any electronic medical record can be attacked in many different ways, including using social hacking, penetrating physical barriers, destroying computer hardware, or overcoming software-based security. Preventive measures include continuous education of staff; using IT specialists’ help at setup and maintenance of computer systems; and repeatedly reassessing the threats that exist and the appropriateness of the measures taken to prevent the risks thus identified. The approaching coming into force of EU Regulation 2016/679 means increased medical data security requirements and elevated legal, formal, and financial risks resulting from infringement.