Layers of Security Architecture
A robust health information system security architecture uses multiple layers of defense, since no single control can fully protect sensitive data. RHIA candidates should understand the major technical components that make up this layered approach.
Network Security and Firewalls
Firewalls control traffic entering and leaving a network based on predefined security rules, blocking unauthorized access attempts. Network segmentation further isolates sensitive systems, such as those hosting the EHR, from less secure areas of the network.
Encryption
Encryption converts data into an unreadable format unless the correct decryption key is used. Data should be encrypted both at rest, such as on servers and laptops, and in transit, such as when transmitted over the internet, to protect against unauthorized interception.
Access Controls
Access controls limit system access based on user roles, following the principle of least privilege and minimum necessary use. Role-based access control (RBAC) assigns permissions according to job function, ensuring users can only access the data required to perform their duties.
Audit Trails
Audit trails, also called audit logs, record who accessed a system, what data they viewed or modified, and when. Regular audit log review helps detect unauthorized access, such as employees inappropriately viewing celebrity or family member records.
Disaster Recovery
Disaster recovery planning ensures health information systems can be restored quickly following a natural disaster, cyberattack, or system failure. Key elements include regular data backups, an offsite or cloud-based recovery site, and a documented recovery time objective (RTO) and recovery point objective (RPO).
Exam Tip
Know the distinction between recovery time objective (how quickly systems must be restored) and recovery point objective (how much data loss is acceptable).