Remote access is a necessity in modern healthcare. Medical directors review charts from home, billing staff work off-site, administrators check systems on weekends, and vendors need to connect to troubleshoot software and devices. Each of those connections is also a door into your network. Attackers know this, and exposed remote access services are among the most commonly exploited entry points in ransomware incidents.
Here is how to provide remote access without leaving that door unguarded.
Start with an inventory:
Which staff members work remotely, and what do they need to reach?
Which vendors have remote access: EHR, phone, imaging, building systems, copier and device suppliers?
What tools do they use: VPN, remote desktop, third-party support software, cloud-hosted applications?
Are there any old, forgotten methods still enabled, such as a port opened on the firewall years ago?
Many facilities discover remote access paths that no one currently remembers authorizing.
Every remote connection should require more than a password. This single control stops a large share of account takeover attempts. Apply it to VPNs, remote desktop gateways, cloud portals and vendor tools.
Each person gets their own login. Shared vendor accounts make it impossible to know who did what and are rarely removed when staff leave the vendor.
Give each person access only to the systems their job requires. A billing clerk does not need a path to the medication cart network. Use network segmentation and firewall rules to enforce this, not just policy.
Directly opening remote desktop services to the internet is a frequent cause of ransomware incidents. Place such services behind a VPN or a secure gateway that enforces MFA.
VPN appliances and gateways are high-value targets, and vulnerabilities in them are exploited quickly after disclosure. Put them at the top of your patching priority list and subscribe to the vendor's security notices.
If a staff member connects from a home computer, that computer becomes part of your risk. Options include:
Providing a managed, encrypted laptop with security software.
Using a virtual desktop or web-based access so no data is stored on the home device.
Setting a policy for personal devices, including screen locks, updates and no storing of PHI locally.
Vendors deserve a stricter process because you do not control their staff or computers.
Require a business associate agreement where PHI may be accessible.
Enable vendor accounts only when needed, or require them to request access for each session.
Prefer access methods that you can supervise and record.
Restrict vendor access to specific systems and times.
Ask vendors how they protect their own credentials and whether their technicians use MFA.
Review vendor accounts quarterly and remove those no longer needed.
If a vendor's tool requires a permanently open connection to your network with broad rights, ask whether a safer alternative exists.
Log all remote sessions, with who, when and from where.
Alert on unusual activity, such as logins from unexpected countries, logins at odd hours or multiple failed attempts.
Review logs regularly, or have your IT provider do so.
Keep logs long enough to investigate an incident that is found weeks later.
A brief remote access policy should cover:
Who may connect and how approval works.
Required controls such as MFA and encryption.
Rules for personal devices and public Wi-Fi.
Vendor access procedures.
What to do when a device is lost or an account is suspected to be compromised.
Leaving old VPN accounts for former employees.
Allowing broad network access for convenience.
Neglecting to update the VPN appliance.
Letting vendors install their own remote tools without approval.
Having no way to see who is connected right now.
The HIPAA Security Rule's access control, authentication and transmission security standards apply to remote connections just as they do to on-site ones. Documenting your remote access controls in your risk analysis shows reasonable diligence.
UnityCare IT reviews and secures remote access for healthcare organizations, from VPN configuration and multi-factor authentication to vendor access governance. If you are not sure who can connect to your network today, we can help you find out.
Call or text: 405-285-3845
New customers: start@unitycareit.com
Existing customers: support@unitycareit.com
Address: UnityCare Technologies, 2524 N Broadway Ste 554, PMB 947974, Edmond, Oklahoma 73034-4172