3 EHR security risks and what you should do about them

Security risks in a medical practice are inherent when you are handling the personal, private and medical information of many thousands of patients. It is the responsibility of all healthcare providers to ensure patient privacy, following all guidelines set forth by the Health Insurance Portability and Accountability Act (HIPAA). If managed poorly, an EHR system creates security risks which can compromise the privacy of protected health information.

According to the U.S. Department of Health and Human Services Office for Civil Rights, there were 663 reported episodes of HIPAA data breaches in 2024, a massive surge from the 139 episodes reported in the first half of 2015 (back when this article was originally published).

The figure counts only breaches that affected 500 or more individuals (so it is likely there were even more breaches on a smaller scale). There were approximately 242.9 million individuals affected in these breaches, a staggering leap from the 94 million affected in early 2015. One 2024 incident alone accounted for nearly 79% of all affected individuals.

An analysis of the breach types highlights how drastically threats have evolved:

• Hacking or IT incidents skyrocketed to cause 81% of cases (up from 26% in 2015)
• Unauthorized access or disclosure dropped to 16%, theft to 2%, and improper disposal and loss fell to less than 1% combined.

All of these breaches fall upon the practice and can lead to huge legal and financial ramifications.

What happens if there is a security breach with an EHR?

Federal law requires a provider to notify affected patients and the Secretary of Health and Human Services about a breach.

If the breach affects more than 500 residents of a state or jurisdiction, the provider must also notify prominent media outlets serving that area. Patient trust suffers as well, because patients who doubt the privacy of their records may withhold information or delay treatment.

A breach can also disrupt care. Malware can shut down hospital systems, and a software bug or virus can jumble or delete the data physicians need to find. A contingency plan should include paper records that staff can use if the system shuts down.

EHR regulations

The same federal laws that protect paper records apply to EHRs. HIPAA’s Privacy Rule gives patients rights over their health information in any form; its Security Rule requires specific protections for electronic health information, and its breach notification rule sets out the reporting duties described above. The HITECH Act of 2009 added stricter penalties for HIPAA noncompliance. The 21st Century Cures Act of 2016 promotes interoperability and penalizes information blocking, and it works alongside HIPAA because both support a patient’s right to access their own health records.

Practices must make it a priority to ensure patient privacy is maintained at all times and do everything in their power to ensure the following EHR security risks don’t compromise patient data security.

EHR security risk 1: Mobile devices

One of the benefits of EHR systems is their ability for remote access and remote communication. For this reason, many providers use laptops, mobiles, and tablets for documentation and access to patient records.

Providers should use mobile access only over a secure network. In addition, staff must ensure that they are only accessing information in a private area, not in a busy coffee house, where information is often broadcast to all (in a physical and networked sense).

The most common causes of health record breaches include the loss of unencrypted laptops and mobile phones that contain patient information, and encryption keeps stored information unreadable to anyone without the key.

Text messaging adds a further risk, because many physicians text colleagues about patient care and no one can control what a message contains or who intercepts it.

Recommended reading: Our guide to keeping patient communications HIPAA compliant covers the precautions for email and text.

EHR security risk 2: Staff negligence

Unfortunately, human error or laziness can cause major security breaches when using EHRs. Staff must log out of the EHR system when not in use to ensure information is not viewable by unauthorized individuals, such as visitors or other patients.

Staff must also refrain from creating a paper copy of sensitive information unless it is absolutely necessary. In addition, staff must not share usernames and passwords; passwords ought to be changed regularly and avoid common names and birthdates. Privacy awareness and staff training are effective strategies for reducing this risk.

EHR security risk 3: Technical safeguards

The EHR system must have processes in place to keep secure information protected, including secure log-ins and restricted access. The HIPAA Security Rule requires specific protections, and EHR systems can build in access controls such as passwords and PINs, encryption of stored information, and an audit trail that records who accessed a patient’s information and what changes they made and when.

The system should have role-based security in which access is restricted to different user types. For example, the clerical access should not have the same access to information as the attending physician. In addition, the server must have a security system in place to block outside access to the network. The system should continually scan servers and workstations for software corruption.

Further recommended reading: Our guide to conducting a thorough EHR audit explains how to review those audit trails.

There will most likely always be some form of EHR security risk in whichever system you choose, but as this article demonstrates, there are ways to reduce the likelihood of anything untoward happening.