How to leverage a mobile device management system to ensure EMR security in mobile healthcare apps

Mobile applications improve medical professionals’ productivity. One can use an app for communicating with the client, sharing health records with colleagues, and even calculate medication doses. The main issue of all medical software is that it contains health sensitive data that could be stolen by hackers. Even if you make your app HIPAA compliant, you need to consider additional security measures such as mobile device management.  

Unless you want your clinic name to appear on the “Wall of Shame” of the U.S. Department of Health and Human Services, due to data breaches, you need to be aware of the main mobile device management services to integrate into your app.  

But first, let us take a closer look at healthcare mobile apps adoption across the medical industry. 

Use of mobile devices in healthcare

To meet modern healthcare standards, care facilities and hospitals implement a ‘bright your own device’ (BYOD) policy toward medical personnel. The policy may concern mobile devices, tablets, and laptops for accessing EHR and EMR, communication with care staff, record care data, and lookup prescription information, which also have a positive impact on medical treatment results.  

In particular, the need for mHealth app adoption concerns the U.S. health organizations, where the Health Information Technology for Economic and Clinical Health Act, devoted to health records digitization, was agreed on at the governmental level in 2009. Here are some stats:

• Global mHealth Apps Market is expected to reach $111.1 billion by 2025
• 93% of physicians believe mobile medical apps have a positive impact on the treatment outcome. 
• Over 70% of medical personnel use mobile devices to communicate with parents and access Electronic Medical Record (EMR). 
• The majority (84%) of patients think that their medical records are safe from unauthorized viewing.

However, patient sensitive data and medical mobile app security are not as optimistic as they seem. Why? Let’s find out. 

What is wrong with EMR

The adoption of mobile healthcare apps among medical professionals has resulted in an increased number of potential threat vectors and sensitive health data exposure, such as medical history and treatment plans.

•  In the U.S. alone, 1,512 data breaches were affecting 154,415,257 patient records from 2013 to 2017, while 128 violations were related to EMR and affected 4,867,920 patient records. 
• In total, data breaches on healthcare cause annual damage of $6.2 billion, which results in patient mistrust, loss of potential revenue, and penalties by the government.

According to the U.S. Department of Health and Human Services, which keeps an archive of health data breaches, the high percentage of breaches were traced to “other portable electronic device[s]”. What does this mean? Let us explain. 

Even if you develop EMR that competes with HIPAA security requirements, you are also responsible for information kept on mobile devices that access your EMR app. While 31% of decision-makers in healthcare avoid implementing EMR in mobile apps due to security reasons, around 49 consider implementing mobile device management tools to improve the security of their systems. 

In a nutshell, it is easier to keep all patient-related data in one place, but on the other hand, this can be quite risky. Therefore, to make your EMR mobile app secure from breaches, you need to integrate mobile device management software that will regulate user access to medical records.

Mobile device management strategies for healthcare organizations

As we said, consumer mobile devices are not secure by default. Moreover, healthcare organizations from the U.S. must meet recommendations by the Office for Civil Rights (OCR) which includes established policies for mobile device data security and staff training.  Otherwise, you will violate the Health Insurance Portability and Accountability Act or HIPPA. 

The solution is to apply mobile device management software. “What is mobile device management software”, you may ask. Well, MDM software enables you to control and monitor the mobile devices of users that installed your app. 

Before developing an EMR mobile app with MDM, you need to create a BYOD policy that will regulate: 

• EMR app usage cases
• Privacy and data ownership 
• Types of approved devices and device provisioning
• Security policies 
• Evaluation of risks and liabilities

[How does MDM work]

With this in mind, let’s find out more about mobile device management use cases and how to integrate them into your app.  

Geofencing

Geofencing is the type of geolocation app technology that detects user location via GPS and allows or prohibits using your app, or accessing particular data. In terms of the healthcare industry, MDM with geofencing will create boundaries around your hospital. If the app user crosses those boundaries by leaving your facility, the app triggers a response by restricting or allowing access to your EMR app.

To integrate geofencing mobile device management features to your app, your mobile app development team will use MapKit or Google Maps SDK for iOS installed via CocoaPods for Apple devices and Geofencing API to add this feature to Android apps. 

App wrapping

You can enable mobility management and content delivery using existing mobile device management technology for data encryption or “wrapping,” such as XenMobile, which adds additional security to app data. Moreover, this MDM healthcare solution will automatically interrogate incoming users to know who they are, where they’re coming in from, using which device, and what data they’re trying to access. Besides this, XenMobileis includes other benefits of mobile device management:

• Controlling native mobile apps and associated data 
• Proving secure funnel file sharing solutions into management architecture
• Enabling role-based access to different users. 
• Tracking, locking, and wiping mobile devices that use your app
• Enabling micro-app VPN for over-the-air data transmissions

To add this solution into an in-house EMR app, your development team needs to add just one line of code, since XenMobile is extremely easy to integrate. 

Remote management

In terms of the BYOD policy, the staff’s mobile devices could be stolen or lost. In this case, to protect your healthcare organization’s data from breaches, integrate remote user management software. By means of such software, you can remotely lock the device down, encrypt particular data, or erase it from the device while keeping their personal information. 

Remote mobile device management is available in the following MDM solutions: 

• AirWatch MDM from $3.78 per device $6.52 to $20 per device $25 per user
• Meraki Systems Manager from $40.00 per device
• ManageEngine Mobile Device Manager Plus from $1.28 per month

Application control

If an outside app is tainted by malicious code, it can siphon data from other apps on the device, which jeopardizes patient data. Application control lets you decide which apps to permit, and which to blacklist or disable. Also, you can use “containerization” to partition an area of each device for dedicated work-use; that way, distrusted third-party apps are kept separate from the EHR app on a mobile app.

The best MDM products with an application control feature are the following: 

• SureMDM from $3.49 per month
• DriveStrike from $0.75 per month
• Awingu from 9.00 per month, per user

Reporting

To control all the app users that receive access to your EMR, consider a session management feature that will automatically generate reports with the following data:

• List of sessions 
• Search for session 
• View session info with user’s email, duration, session ID

Thanks to this feature, you can track, not only what is happening in your system, but also, identify suspicious patterns and threads. Moreover, the MDM reporting feature will provide you with insights into your organization’s mobile environment, including device status, user information, log-in attempts, and compliance with password policies in real-time. 

To ensure your patients’ health data security is to create a formal device policy that will educate your medical staff about security risks and best practices. Next, consider the integration of mobile device management into your app. By using software built by reliable MDM solution providers, you will receive control over all mobile devices in your corporate network, data stored, third-party and native apps, and data transmission. 

What our clients say 

Related reading: 

A Guide on How to Create a Telemedince App 

Calmerry Telemedicine Platform Case Study 

Nioxin Consultation App for Coty-owned Brand Case Study