The stakes have never been higher for healthcare providers to deliver a positive patient experience. According to a recent study by Prophet, 81 percent of consumers are unsatisfied with their healthcare experience, while only 40 percent believe providers are best meeting their needs. At the same time, data breaches in the healthcare sector are at an all-time high, occurring at a rate of more than one per day in the United States.

These security incidents not only jeopardize patients’ privacy but also put both patient trust and brand reputation at risk.

All the while, medical practitioners, hospitals, and insurers are pressed to keep up with the ever-evolving regulatory compliance landscape. This not only includes the Health Insurance Portability and Accountability Act (HIPAA) but also the Payment Card Industry Data Security Standard (PCI DSS), the EU General Data Protection Regulation (GDPR), and a long list of individual state regulations and data breach notification laws.

With HIPAA violations alone incurring fines as high as 50,000 dollars (for each violation or exposed record), healthcare organizations are finding themselves wedged between conflicting objectives: How do you protect patient data and maintain compliance without losing sight of providing the best possible patient experience? 

Contact Center Security

While you can’t please every patient, you can strike a balance between care and data security. The first place to address this is the contact center.

Although online interaction tools and patient portals are gaining in popularity, you can’t underestimate the value of the voice channel. Research by PatientPop shows that 58.5 percent of patients still prefer to schedule an appointment via phone.

As such, your contact center is often the go-to point of interaction for your patients and can set the tone for their entire experience. But this also means that your contact center intrinsically holds, processes, and stores copious amounts of personally identifiable information (PII), from medical records to payment card data. This makes the contact center an alluring target for fraudsters and hackers.

However, it’s not only devious cybercriminals who threaten your patients’ data. Company insiders, such as rogue call center service representatives or contact center agents, pose a massive threat, especially if they have access to patient data given over the phone or stored in desktop applications. In fact, 58 percent of all healthcare data breaches and security incidents are the result of insiders, according to Verizon’s Protected Health Information Data Breach Report.

Security Best Practices

With inside and outside threats, as well as vulnerable legacy systems serving as entry points for enterprise-wide breach incidents, contact centers are undoubtedly a weak link in your security chain. But protecting PII, maintaining compliance, and providing a positive patient experience first involve a hearty dose of security best practices:

• Treat all data as potentially toxic. The more information that is available in the event of a breach, the easier it will be for a malicious insider or cybercriminal to steal a patient’s identity or access their private medical records.
• Train all employees and always perform thorough background checks. Go beyond basic employee vetting and background checks, especially when hiring for your contact center environments. Educate staff and agents on data security best practices and on how to spot social engineering and phishing tactics.
• Prepare your response management policy. Have an incident response management policy and process in place, preferably as part of an information security management system. Prepare for a worst-case scenario and assess your incident response plan at least annually.
• Tokenize data. Replace PII with a meaningless equivalent, so even if a breach is successful, the hacked data will be of no value to the cybercriminal. This approach can also assist in the event of a social engineering attack, which can put even the most trustworthy employee at risk for exposing PII.
• Enforce the principle of least privilege. Give employees the minimum level of access required to perform their job function at the appropriate time. Introduce exception procedures for when emergency access is needed.
• Authenticate the user to authenticate the service agent. Prevent agents from accessing patient data until they have received the right data from the user. This means that until the caller has been successfully identified using the appropriate secure authentication approach, access to detailed PII will be denied.

Descoping Technologies

With these tactics creating a foundation for security in your contact center, you can introduce descoping technologies. Such technologies not only strengthen data security and compliance by removing sensitive data from your infrastructure, but they also garner a positive patient experience and journey.

For the voice channel dual-tone multifrequency (DTMF), masking solutions hold great promise, allowing patients to discretely enter numerical PHI—such as payment card, insurance, or account numbers—using their phone’s keypad. The keypad tones, however, are masked with flat tones, so they are not exposed to anyone but the patient. The data collected is encrypted and sent to a compliant third party, bypassing the contact center’s environment completely.

While this process may invoke notions of automated interactive voice response (IVR) systems, it is not the same. Here, agents can remain on the line in full voice communication with the patient, guiding them through the transaction, answering questions, and even handling wrap-up tasks. There are no challenges with misheard or mis-keyed data, which can lead to premature hang-ups and abandoned calls. In addition, patients have full control over inputting their information and can enjoy peace of mind that their data is protected. This makes for a better overall customer experience.

Conclusion

Data security and privacy are key to providing positive interactions with your customers and patients, and there is no longer any need to compromise in either area. A combination of security best practices, strategies, and emerging descoping technologies are ideal solutions to achieve both. No matter which route you take, the less PII you hold and handle, the better off you’ll be. Remember, no one can hack the data you don’t have.

This article is provided by Semafone, a leading provider of data security and compliance solutions for call and contact centers. Learn more at Semafone or contact Rebecca.Rowe@semafone.com.

By Charu Raheja, PhD

Telemedicine has been a medical buzzword for several years, and the variety and depth of services provided have grown dramatically during this time. There is little argument that telemedicine is a great way to supplement traditional medical practices.

The advantages are clear: more convenient care for patients, more doctor availability, less driving time, and less waiting-room time. But like any new evolving field, there is still a learning curve and a need for developing a process that makes telemedicine viable and profitable and doesn’t require doctors to work 24/7 to meet patients’ requests.

One of the biggest hurdles for doctors is that their time with patients is limited. In a traditional office setting, nurses start the patient visit. Nurses take vitals, talk to patients, and evaluate their needs before a doctor walks in the room. The same type of process needs to be designed for telephone medicine, with the difference being that the nurse will do her job over telemedicine, just like the doctor.

Some practices have the nurses in their office taking patient calls and scheduling visits with a doctor. When managing these calls, the nurse needs to perform two tasks. First, the nurse must evaluate whether the patient actually needs the doctor or whether the nurse can help the patient over the phone with home care advice. Second, the nurse must document patient symptom information before making an appointment for the patient to speak with a doctor.

This is where having a good platform to document patient calls and ensure standard protocols comes in. This can ensure patient safety and help make the process efficient. Medical protocols—such as Dr. Schmitt and Dr. Thompson’s protocols—ensure a standard care process every time a nurse takes a call. These protocols are also available electronically, making them easier to use than textbooks. Electronic protocols can also allow the care advice to be documented directly on the patient chart for review by the physician during the telehealth visit.

However, not all doctors offering telehealth services have nurses available to answer patient calls when they first come in. An alternative for these doctors is hiring a telephone nurse triage service. This can serve as an extension of the office by providing patients with a trained nurse to evaluate patient symptoms and determine what actions to take.

What sets a high-quality telephone nurse triage service apart is the ability for the physician to have custom orders and preferences built into the system so the nurses can act as a true extension of the physician. A high-quality nurse triage service is also able to schedule patient appointments when necessary.

Providing patients with access to triage nurses can also be helpful for those doctors who don’t have the ability to provide telehealth services 24/7. If given the appropriate instructions, triage nurses are typically able to resolve over 50 percent of callers’ issues without the need of a doctor.

From a survey of over 35,000 patient phone calls, in over 50 percent of the cases, the nurses were able to resolve the caller’s medical symptoms by giving them home care advice. These nurses were also able to determine which callers required a physical visit to an urgent care or an ER in an event of an emergency (such as symptoms of a potential heart attack).

Telephone nurse triage allows a practice’s telemedicine program to work seamlessly, whether the office is open or closed. Setting up a nurse triage system where nurses use standardized protocols to answer patient questions increases the productivity and profits for a doctor’s practice.

When nurses use triage protocols, physicians can have confidence that they are asking the right questions and not missing anything. The basic patient information, the protocols used, and the nurse notes can also be used as a quick reference for the physician prior to the telehealth visit—similar to the notes doctors receive when their nurses first see a patient during a physical office visit.

Charu Raheja, PhD, is the CEO of TriageLogic a leading provider of quality, affordable triage solutions, including comprehensive after-hours medical call center software, daytime triage protocol software, and nurse triage on call. Customers include both institutional and private practices. If your hospital or practice is looking for information on setting up a nurse triage service, contact TriageLogic to get a quote or set up a demo.