Safety

Different industries often put out policies, procedures and handbooks for their industry, but what if what has been produced is not enough?

A recent google survey of medical practices and their practice procedures and policies revealed a disturbing trend.  Most of the practices are using the same template!

What is the issue with this?

First question is, has each practice done a hazard and risk assessment of their site?  If they had they would realise that they must adhere to all the legislation that is relevant to their business not just follow the guidelines put out by Royal College of General Practitioners (RCGP).  One area that has not been addressed effectively is fire safety.

Most practices tend to rely on the guidelines put out by RCGP and it talks about having fire safety in place but does not fulfil the requirements of the Building Fire Services Act 2008 or AS3745 Managing Emergencies in Facilities.

In the past nine years I have audited about a dozen medical practices and on first audit none of them were fire compliant, though they maintained their belief they were fire compliant as they had followed the RCGP guidelines.

Medical practitioners need to understand that they MUST as a minimum, by law do the following:

• Conduct and document a Hazard & Risk Assessment of their practice
• Install Evacuation Signs and Diagrams
• Have a separate Emergency Evacuation Response Plan (separate to their other procedures)
• Have ALL staff, including doctors complete, General Evacuation Training every year
• Have ALL staff, including doctors complete First Response Training every two years
• Have the wardens (usually practices managers or nurses) do training every year if in QLD and in the other states every six months.
• Conduct a Practice Fire Drill for all shifts on an annual basis

The costliest exercise for most practices is the loss of income that they receive when they take doctors out of circulation for these training courses, so most practices fail to have ALL staff trained.  One way to alleviate the expense of this training on practices is to have customised online training for each practice.  This means that doctors can do the training at a time that suits them.  Proper training is more than just telling someone, “there is the door, get out”!

General Evacuation training, for medical practices should include training on what to do if they get an aggressive person or someone with a gun trying to rob them of drugs.  Other unique issues for doctors is, what if they are conducting internal examination on patients who are undressed, and an immediate evacuation is required of all people from premises.  Are they prepared to deal with people who insist on getting dressed and putting their shoes on?

To determine if your business is fire compliant you need to conduct a Fire Safety Audit, work with us and we teach you how to do an audit and what to look for.  You will receive a documented audit report that cites the legislation that you may be breaching, and the cost of the penalties for non-compliance.  Call today to book a Virtual Fire Safety Audit and ask us how you can get one for free!

So What is a Virtual Fire Audit?

For More Info on Fire Compliance

Are medical institutions protecting my personal information adequately?

This week the company The Answer is Yes is highlighting how vulnerable medical institutions are concerning protecting private and personal medical information of patients with some examples of breeches.  Read on to see what you can do.

Recent events, as reported by trusted sources, has shown that personal medical records can easily be accessed and misused on the internet.

One report stated that there was a design floor in a software design used in virtually all hospitals in the world. The software allows attackers to exploit the software and once exploited; they could distribute their malicious code to access medical imaging information.

Another report identified criminals selling doctors information on the dark web.

“A hacker compromises the corporate network of a healthcare provider to find administrative paperwork that would support a forged doctor’s identity,” states a report detailing the researchers’ findings.[1]

“The buyer [of the data] then poses as the stolen doctor’s identity and submits claims to Medicare or other medical insurance providers for high-end surgeries.”

“Beyond doctors’ identities, other data targeted included personal medical records and hacked health insurance company, login information.” Stated a representative from a company Carbon Black.

In the case of the hospital software, the user can be tricked into executing the malicious code through social engineering[2]

My medical records are safe, aren’t they?

Simple Steps

A few Simple steps can help mitigate some of the risks mentioned above, such as having decent security software installed, and reviews online can help, which are the best products to choose from.

Train staff to be more ‘Cyber Aware’ through online training.  Online training is proven to be the most cost-effective and least time-consuming approach with the most benefits, as highlighted in an Australian report released last year.

Also, you cannot rely on technical solutions entirely; you need a hybrid approach to be more effective.  Of course, there is no silver bullet, but you can make a difference, it’s not just the IT departments responsibility within the organisation to stay secure and operationally resilient, it’s everyone!

(Ask your doctor if the practices staff have undergone training in cyber)

Stay tuned for more tips this week.

[1] https://www.independent.co.uk/life-style/gadgets-and-tech/news/dark-web-hackers-doctor-identities-medical-records-cyber-crime-a8943581.html

[2] Social engineering is the art of manipulating people so they give up confidential information or have them do something that would cause a negative effect.

Book a Strategy Session to Discuss the Next Step