The computer at a nursing station may be used by dozens of people across a week: nurses, aides, therapists, physicians, pharmacists and visiting consultants. It sits in a public-facing area, runs constantly and holds access to resident information. In security terms, it is an endpoint under unusual pressure.
Endpoint protection means securing the devices people use, including desktops, laptops, tablets and shared workstations. For care facilities, that requires balancing strong security with the need for quick access. Here is how to approach it.
Shared or weak logins make it impossible to know who did what.
Open sessions let the next person see or modify resident data under someone else's name.
Visible screens may expose information to visitors and other residents.
Unrestricted software installs and web browsing can introduce malware.
USB ports allow data to be copied out or malicious devices plugged in.
Outdated software gives attackers known vulnerabilities to exploit.
Physical access means someone can tamper with hardware or steal a device.
Traditional antivirus relies on known signatures. Modern endpoint detection and response tools watch for suspicious behavior, such as a program suddenly encrypting many files, and can isolate a device automatically. Make sure the software is centrally managed, reports to a console someone actually watches and receives updates automatically.
Operating systems, browsers, EHR clients and common applications such as PDF readers need regular updates. Use a managed process so updates are applied on a predictable schedule, ideally outside medication passes and peak charting times.
Full-disk encryption protects data if a laptop or tablet is lost or stolen. Under HIPAA, encryption is an addressable safeguard, and breach notification rules provide a safe harbor for data that was properly encrypted. Verify that encryption is enabled and that recovery keys are stored securely.
For shared clinical workstations, consider the following settings:
Standard user accounts, with administrator rights reserved for IT
Application allow lists so only approved software runs
Blocked or restricted USB storage
Automatic screen lock after a short period of inactivity, balanced with clinical workflow
Fast user switching or badge tap sign-in to end sessions cleanly
Web filtering to block known malicious and inappropriate sites
Disabled auto-run and unnecessary services
Every user should have a unique identity, even on shared computers. Proximity cards, single sign-on and fast switching can make this quick enough for clinical use. See the HIPAA Security Rule's requirements for unique user identification and automatic logoff.
Position monitors away from public view or use privacy filters
Secure computers and small devices with cable locks where theft is a risk
Lock server closets and network cabinets
Protect tablets and carts when not in use
Keep an inventory of devices, with asset tags
Facilities increasingly use tablets and phones for charting and communication. Use mobile device management to enforce passcodes, encryption, remote wipe and app controls. Decide in advance whether personal phones are allowed to access work systems, and what protections they must have.
Protection is stronger when someone is watching. Make sure alerts from your endpoint tools go to a person or provider who responds quickly, including at night and on weekends. Keep an incident procedure for isolating a suspected infected computer and notifying leadership.
Old computers running unsupported operating systems cannot receive security updates and should not be connected to networks that hold resident information. If a legacy device is required for a specialized system, isolate it on a restricted segment and plan its replacement.
Is endpoint protection installed and reporting on every device?
Are updates current?
Are drives encrypted?
Does each person sign in with their own account?
Do screens lock automatically?
Are USB ports controlled?
Is there an inventory of devices?
UnityCare IT provides managed endpoint protection, patching and monitoring tailored to healthcare workflows, and can help you standardize the configuration of your shared workstations without getting in the way of care.
Call or text: 405-285-3845
New customers: start@unitycareit.com
Existing customers: support@unitycareit.com
Address: 2524 N Broadway Ste 554 PMB 947974, Edmond, Oklahoma 73034