How to Develop a Data and Premises Security Policy for Your Health Practice

As a healthcare practitioner, it’s essential for you to have security policies that protect all data, whether in a physical or digital format. However, it doesn’t stop there.

Policies that secure the physical premises of your practice are just as critical to ensure that not only data but clients and staff members, as well as your ability to run a business, are protected. It’s important to understand that security breaches can originate from external and internal sources and that internal breaches often happen unintentionally.

The best way to protect yourself is to ensure that your security policies include a standard set of processes and procedures. This will help staff apply policies correctly and consistently.

Creating your own security policy can be a head-scratcher. As a busy healthcare practitioner, you might feel overwhelmed and even delay getting started. The good news is that we’ll help you do it. We’ll show you which critical elements to include in your policy as well as how to make its implementation a success.

Grab a coffee, and let’s get into the details of developing a security policy for your practice.

10 Key Topics to Include in Your Security Policy

All aspects of your security policy revolve around data protection or safeguarding the physical premises. Whenever a specific aspect is addressed, it’s a good idea to use the following structure:

• Start with a statement about its purpose
• Include any related definitions
• State the policy
• Detail the procedures required to adhere to the policy

We’ll introduce the 10 key topics to include in your security policy with a discussion of their purpose, starting with data security.

Section 1: Digital Data Security

The purpose of this section is to provide measures to protect security and privacy across all systems used in the practice, including Zanda. Definitions might include terms like “devices” and “2-factor authentication”. You can specify which systems have been approved for use and the minimum requirements for password selection.

1. Secure Use of Zanda

Practitioners may have access to Zanda as the online system to make appointments, manage client records, document clinical care, diagnosis and more. You need to ensure that Zanda is used in ways that protect client data and privacy.

Procedures include requirements regarding the use of individual login credentials, that 2-factor authentication should always be used, and the requirement for all staff to consent to spot checks on user logs.

2. Use of Devices

This section supports the avoidance of inappropriate, illegal, and unapproved use of computer equipment, including tablets, mobile devices, and other technology, and avoids putting the practice’s reputation and security at risk. Definitions like “malware” and “data encryption” make sense to include here.

It’s important to specify who and to which devices the policy applies. The expected tasks to be performed on devices should be laid out, and it should be specified what inappropriate device usage looks like.

3. Back-Up & Restoration of Data

In this section, you want to outline policies that prevent the loss of data and outline the process for data restoration in the event of a hardware/software failure, physical disaster, or human error. The policy should cover the steps required to successfully and safely back up information, how often it should be done, by whom it should be done, and how long it should be kept.

4. Maintenance & Protection of Systems

This section details how to keep computers, laptops, tablets and mobile devices in good condition to lengthen their lifespan and usefulness. Team members might be instructed to secure devices to desks, use protective cases, update software regularly, run virus scans, clean keyboards and update passwords.

Section 2: Physical Asset Security

5. Physical Records

Team members must know how to maintain and store any physical records kept; this policy will help them do it. To begin with, encourage staff to reduce the number of physical records they keep only to what’s essential.

Paper-based records could include reports, employee files, bills and receipts, meeting minutes, contracts, or notes. Prompt staff to decide how to handle a document based on its use, the applicable audit requirements, legal compliance, the consequences if the document goes missing, and whether the item could be easily reproduced.

Detail the requirements to keep filing systems and archives orderly, as well as how to dispose of documents when the time comes.

6. Premises Security

The premises security section will ensure that the facility is secure and maintain the safety of all team members and clients. It should explain the responsibility of team members when they either enter or leave the property. This may include detailed steps for the activation or deactivation of the alarm system, an instruction to turn the lights on or off, and to check all exits for unimpeded access.

7. After-Hours Access

The purpose of this section is to ensure that if staff require access to the facilities outside of normal hours, they are able to do so safely. To begin with, staff should know that they can only enter the premises after hours if they have approval from the management, and once they leave, management should be notified again. Other steps to include here may be to notify the security company and the requirement to follow standard opening and closing procedures.

8. Restricted Access Areas

To safeguard the health information of clients, as well as practice data and employees themselves, may mean that access to some areas in your practice should be restricted.

The concept of “forbidden access” could be defined here. Then, measures like the requirement for any visitors to the practice to sign in and always be escorted by staff members when they’re in the vicinity of sensitive information, the use of signage to restrict access, and measures to ensure that access to restricted areas and data is enforced (think about instructions like locking doors, cabinets, and filing systems, as well as how to secure communication devices).

9. Alarm Management

This section will ensure that electronic security alarm system equipment is effectively used, monitored, managed, and maintained within the practice. Sensible steps might require all staff who operate the alarm system to have unique security codes, how the alarm should be tested and maintained, a specification on who should activate and deactivate the alarm on any given day, and what to do if someone fails to deactivate the alarm.

10. Duress Alarm

Incorporate a process to help protect people and property using a duress alarm. Terms like fixed and portable “duress devices” could be defined here.

As with all aspects of your security policy, this section should be based on the circumstances at your practice. Elements of this policy may include when duress alarms should be used, which risks are mitigated with the incorporation of duress alarms in the practice (e.g. the receipt and storage of cash or prescription drugs), how assistance should be summoned, the required training related to the successful implementation of the policy, and how to maintain duress alarm systems.

Next Step: How to Successfully Implement Your Security Policy

Phew, that was a lot of ground to cover!

Now that you’ve got a security policy, you’ll likely wonder what it looks like to get all team members on board and compliant.

Fear not, we have some tips for you!

• Include Staff in Policy Development – Make your team members a part of the process to help them become invested in its implementation. This policy might include measures they’re not so excited about because it may add a few extra steps to tasks they perform on a regular basis. A way to work around potential resistance is to draft the policy first and then submit it to team members for feedback.
• Train Your Employees – Once the policy is complete, make sure all team members are comfortable with the required steps. Where it can be reasonably expected, ask them to demonstrate their understanding of it to you as well. Finally, take the time to explain the importance of each measure and the impact if they don’t adhere to it. This will motivate the team to work together and accept their new responsibilities.
• Get it in Writing – Having a security policy and training team members on its implementation should be supported by a written record of these policies and be kept in a location accessible to everyone. The easiest way to do this is to allow staff members to view the policy virtually on their preferred device.
• Enforce the Policy – It’s the natural course of things: people tend to relax their discipline about tasks that can seem mundane and cumbersome, and this includes the consistent implementation of security measures. This is where you’ve got to draw a line in the sand with communication of the penalties for non-compliance to security policies and also enforce penalties when the time comes. If you set an example of consistency, you’re well on your way to keeping things running smoothly in your practice!

Let’s Take it One Step Further (And Make It Even Easier for You)

If you still feel intimidated by the scope of this task, don’t worry: when you start with Zanda, you’ll get a free Practice Operations Manual with extensive pre-written documentation that not only includes a security policy, but more than 100 policies and procedures that are pivotal to the success of your practice. Sign up for a free trial to access your Practice Manual now.