A hospital, clinic, or other healthcare provider is going to face some specific challenges when implementing a new WiFi system. While proper data protection is necessary in all areas of business, the WiFi for medical practices specifically has a number of additional regulations over how data is handled.
Since, of course, your patients' medical histories are among the most highly confidential records in circulation, extra care is needed to keep them safe on a network with public access. Failure to do so wouldn't just harm the patients, it would also bring down substantial financial penalties on your operation.
Here's a quick guide to the most important areas to focus on when implementing secure medical WiFi:
Keeping Your Hospital WiFi Secure And Compliant
1 - Universal Encryption
This mostly goes without saying today, since encryption is part of virtually any modern networking system. None the less, if you're using older hardware, you need to have systems that can use strong encryption throughout the network. Patient records and other critical data cannot be stored or transmitted in non-encoded forms.
2 - Create Separate Guest Access
Broadly speaking, there's just no reason to let visitors or patients anywhere near your official work network. Virtually any business networking OS these days, such as those from ADTRAN or Cisco, allows you to set up a guest network with just a few clicks.
This gives visitors direct access to the outside Internet, but nothing else. The system locks them away from any of your internal tools or systems. This, by itself, will greatly alleviate any potential security issues.
3 - Physically Secure Your Access Points
Here's one regulation many other businesses aren't required to follow: Your access points and other physical hardware must be securely kept away from visitor access. This means a locked server room, preferably with electronically-tracked access, and access points that are out of the reach of curious hands.
However, you don't have to go overboard here. Simply putting them above people's heads is fine, such as high on walls or inside the ceiling drop-space. Or, use little plastic cages to hold them, like some institutions do with their air-conditioning controls.
As long as someone would need a ladder or other tool to access them, they're secure from a regulatory standpoint.
4 - Mobile Device Restrictions
Adding WiFi to your operations basically guarantees your staff will start bringing their mobile devices. These pose challenges to your security, but trying to ban BYOD is just not practical for all but the most security-focused organizations.
As a few suggestions:
-
Implement mobile device management to ensure every device has updated security.
-
Require users keep current on OS updates.
-
Require a passcode/word on every device that touches your work network.
-
Ban devices with compromised security, such as "jailbroken" smartphones.
-
Keep personal access records to spot and track suspicious behavior.
-
Implement application-level restrictions to keep out unauthorized devices.
-
Ban applications such as Dropbox that could encourage poor data handling.
When putting WiFi into place, it's vital to remember that any connecting device is a potential security threat. Your
security systems have to expand past your own computers to encompass every access method.
5 - Staff Training
Finally, when bringing WiFi to your facilities, it's important to keep your staff refreshed and up-to-date on proper data handling techniques.
Besides the usual training on strong passwords and records-handling, put a special emphasis on keeping the data in your system and nowhere else. Most data-mishandling cases these days are being caused by staff mistakes, rather than from deliberate intrusion.
Something as simple as putting records onto a Blackberry can cause huge problems.
Is Your Medical Practice WiFi Ready?
If you're interested in adding WiFi to your healthcare facility, contact Hummingbird for advice! We have years of experience adding secure and reliable networks to businesses of all sizes, including those with stringent security requirements.
