Zombie Accounts May Be Putting Your Practice at Risk

In our fluid economy, it’s fairly commonplace to have regular employee turnover. But what happens when a key team member, such as the person in charge of your practice’s data security, moves on. Is your practice safety at risk?

According to an article by Avrim Pitch published in The A Register, this scenario happens too frequently. He described a dental practice in which a contractor had been paid to set up an electronic dental practice system. The office manager was the point person for the system, which included more than 4,000 patient health records. It wasn’t until a safety audit of the practice’s data was conducted that a breach was discovered.

The audit found that there were three login accounts for the system, but only two were used by current employees. The third was active with access to patient health records and financial information; however, neither the office manager nor the dentist knew it existed. It had been created by the initial practice consultant and never eliminated.

This poses a significant Health Insurance Portability and Accountability Act violation and puts patient data at risk. According to the California Dental Association, 30% of all data breaches occur in healthcare settings, including dental practices. Small or independent dental practices may be easy targets as many do not have dedicated security staff but house highly valuable data such as social security numbers and payment information.

Pitch suggests that all dental practices have policies in place for terminating an employee or consultant relationship and perform regular audits on who has access to your practice’s data. Click here to read more.