CEWIT 2015 12th International Conference & Expo on Emerging Technologies for a Smarter World

The Rise of Mobile Technology in Healthcare: The Challenge of Securing Teleradiology

Sharing DICOM Images on Mobile Devices: Confidentiality, Integrity, & Availability Risks

Abstract— There are many potential security risks associated with viewing, accessing, and storage of DICOM files on mobile devices. Digital Imaging and Communications in Medicine (DICOM) is the industry standard for the communication and management of medical imaging. DICOM files contain multi-dimensional image data and associated meta-data (e.g., patient name, date of birth, etc.) designated as electronic protected health information (e-PHI).

The HIPAA (Health Insurance Portability and Accountability Act) Privacy Rule, the HIPAA Security Rule, the ARRA (American Recovery and Reinvestment Act), the Health Information Technology for Economic and Clinical Health Act (HITECH), and applicable state law mandate comprehensive administrative, physical, and technical security safeguards to protect e-PHI, which includes (DICOM) medical images. Implementation of HIPAA security safeguards is difficult and often falls short. Mobile device use is proliferating among healthcare providers, along with associated risks to data confidentiality, integrity, and availability (CIA). Mobile devices and laptops are implicated in wide-spread data breaches of millions of patients’ data.

These risks arise in many ways, including:

[i] inherent vulnerabilities of popular mobile operating systems (e.g., iOS, Android, Windows Phone);

[ii] sharing of mobile devices by multiple users;

[iii] lost or stolen devices;

[iv] transmission of clinical images over public (unsecured) wireless networks;

[v] lack of adequate password protection;

[vi] failure to use recommended safety precautions to protect data on a lost device (e.g., data wiping);

[vii] use of personal mobile devices while accessing or sharing e-PHI.

Analysis of commonly used methods for DICOM image sharing on mobile devices elucidates areas of vulnerability and points to the need for holistic security approaches to ensure HIPAA compliance within and across clinical settings. Innovative information governance strategies and new security approaches are needed to protect against data breaches, and to aid in the collection and analysis of compliance data. Generally, it is difficult to share DICOM images across different HIPAA-compliant Picture Archive and Communication Systems (PACS) and certified electronic health record (EHR) systems – while it is easy to share images using non-FDA approved, personal devices on unsecured networks. End-users in clinical settings must understand and strictly adhere to recommended mobile security precautions, and should be held to greater standards of personal accountability when they fail to do so.

Author
Recent Posts

Dr. Teresa Piliouras

Dr. Teresa Piliouras is the CEO and Founder of Technical Consulting & Research, Inc. She is an educator, industry consultant, and entrepreneur with over twenty years of management leadership and technical experience providing Information Technology solutions to corporations, academic, government, and not-for-profit institutions.She was an Adjunct Professor at New York University Polytechnic School of Engineering in Computer Science and Management of Technology, and held visiting appointments as Computer Science Professor at Iona College. She is an award-winning inventor, author of textbooks and peer-reviewed academic publications, and a frequent speaker at industry events. She holds a B.S. from the University of Illinois, a MBA from Iona College, and a Ph.D. from New York University Tandon School of Engineering.

Latest posts by Dr. Teresa Piliouras (see all)

Best We Can Be Featured in IEEE Pulse Magazine - February 23, 2016
CEWIT 2015 12th International Conference & Expo on Emerging Technologies for a Smarter World - October 16, 2015
2015 IEEE Long Island Systems, Applications and Technology Conference (LISAT 2015) - May 1, 2015