---
title: How do you Prevent Unauthorized Access to ePHI?
description: How do you Prevent Unauthorized Access to ePHI?
---

[Ostendio Blog ](https://www.ostendio.com/blog)

# [How do you Prevent Unauthorized Access to ePHI?](https://www.ostendio.com/blog/how-do-you-prevent-unauthorized-access-to-ephi)

 Written by [Ostendio](https://www.ostendio.com/blog/author/ostendio) | Aug 9, 2018 6:39:02 PM

That’s a million dollar question. No, really, it could literally cost you millions not to know. In doubt? Fresenius isn’t. It’s cost the dialysis chain [a $3.5 million settlement](https://www.fiercehealthcare.com/privacy-security/fresenius-medical-care-ocr-3-5m-settlement-hipaa-data-breach-theft) for data breaches in 2012. The resolution agreement cites instances of unauthorized access and “impermissible disclosure.” So how do you stop it from happening?

**5 Ways to Stop Employees from Unauthorized Access**

1. **Training.** The most obvious prevention method is to be sure every employee understands both the definition of privacy and of sensitive data. To understand that it’s a serious privacy breach to share information, including photographs, screenshots, etc. amongst fellow employees who have no authorization to view the ePHI.
2. **Access controls**. Assure the person(s) accessing ePHI only sees what is absolutely necessary to perform their role. The person scheduling appointments doesn’t need the same access as a medical records clerk or claims administrator.
3. **Device controls**. Implement the policies and procedures necessary to assure you know where and when the data moves regardless of device (hardware or electronic media), internally and externally.
4. **Encryption**. How do you assure that the devices leaving the building are secure? If a tablet or thumb drive is stolen or lost, can you prove it was encrypted and ePHI kept secured? Ensure that you have adequate encryption in place. 
5. **Password protection**. Stress how important it is to protect login and other password information that could breach ePHI privacy. Login credentials are tied to a specific person. If that person shares the information with someone else, it’s not just a policy violation, they’re putting their job at risk along with ePHI security.

The ePHI data breaches that list Unauthorized Access/Disclosure on the 2018 “[Wall of Shame](https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf)” tell the story.  [Curiosity is no reason to jeopardize privacy](https://ostendio.com/curiosity-killed-the-healthcare-organization/), nor is lack of asset inventory a valid excuse for not knowing if a lost or stolen device is encrypted. Employees can either be top notch protectors of personal health information or place it at risk daily. It’s top-down percolation, senior management to entry-level employee, that assures everyone knows how even seemingly insignificant actions of sharing a screenshot of an x-ray, violate ePHI’s privacy and security.

*How do you maintain your ePHI’s integrity? Do you have a straightforward way to run internal audits on privacy and security activities? To find out how MyVCM can support your ability to protect ePHI from unauthorized access, [contact Ostendio today](https://ostendio.com/about/contact/).*

[View full post](https://www.ostendio.com/blog/how-do-you-prevent-unauthorized-access-to-ephi)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Ostendio"
  },
  "dateModified" : "2019-08-05T18:15:50.755Z",
  "datePublished" : "2018-08-09T18:39:02Z",
  "headline" : "How do you Prevent Unauthorized Access to ePHI?",
  "image" : {
    "@type" : "ImageObject",
    "height" : 60,
    "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
    "width" : 60
  },
  "mainEntityOfPage" : "https://www.ostendio.com/blog/how-do-you-prevent-unauthorized-access-to-ephi",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "Ostendio Blog 2019"
  }
}
```