It's even argued that paper records are inherently more vulnerable than digital ones. An EHR can be designed, for instance, so that a receptionist accessing a chart can view only demographic data, not clinical data. In contrast, anyone handling a paper record—an orderly pushing a wheelchair, let's say—can look at everything. Also, good EHRs typically come with an audit function that tracks who's perused a record. Still, even staunch supporters of digital medicine acknowledge the need to satisfy the privacy fears of Americans.

"We're not prepared today for the kind of protection and security that we'll need when we have a completely automated network," says internist David Brailer, the National Coordinator for Health Information Technology at HHS.

Brailer characterizes recent privacy disasters in healthcare as simple failures to comply with HIPAA's security regulations. "I used to be a critic of HIPAA when I was in the private sector, but one thing the law did well was lay out requirements for physically protecting information," he says.

But how high do you build the walls? Brailer notes that it's possible, for example, to encrypt data that resides on a computer hard drive. This tactic—routinely used to protect data transmitted over the Internet—might baffle a thief intent on harvesting IDs from a stolen laptop. However, encryption could make it hard to retrieve information in a medical emergency. "It's a question of protecting privacy vs protecting life," notes Brailer.

A sister issue, he says, is user authentication—proving to a computer that you're somebody who's entitled to view patient data. Again, it's possible to move beyond a simple user ID and password and force doctors to possess special cards or so-called RFID tags that communicate with a computer. But more-strenuous forms of authentication may prove impractical in a hectic clinical setting.

Brailer and the Feds are working on several fronts to settle such issues and build reasonably tight defenses around patient data. HHS is helping fund a group called the Health Information Security and Privacy Collaboration that consists of IT experts and the National Governors Association. They'll work with state governments to harmonize security and privacy policies that go beyond HIPAA. Another HHS-funded group, the nonprofit Certification Commission for Healthcare Information Technology, has come out with proposed standards for EHRs that would require, among other things, audit mechanisms to detect snoopers.

The architecture of the proposed national health information network itself figures into the quest for privacy. Brailer is seeking a decentralized, Internet-based model that will rely on existing repositories of patient data—a clinic or hospital EHR, for instance—rather than one gigantic database. Such an approach is safer because it doesn't give hackers a tempting mother lode to attack. Right now, four IT umbrella groups funded by HHS are developing prototypes with this strategy in mind.

Meanwhile, there's also a debate about the patient's role. A coalition of consumer and privacy advocates, clinicians, IT experts, insurers, ethicists, and federal policymakers assembled by the nonprofit Markle Foundation recently issued a veritable Patient Data Bill of Rights. They include a patient's right to access his own data, authorize who can see it, review who's already seen it, and even opt out of the NHIN entirely. Brailer's sympathetic to these principles, but he says the hard part will be applying them in real life. "Can we expect patients to continually click Yes or No to requests to use their information?"

Fortunately, healthcare software vendors have already gotten a head start in giving patients greater control over their records. EHRs used by some medical groups allow patients to access the same health information their doctors access (see "Personal health records: What's the status now?" in the Feb. 17, 2006 issue). The security advantage? Patients can tell whether an identity thief received a prescription in their name.

Take these steps to prevent data theft

So, what can a small medical practice do to ensure privacy right now? Plenty, say the experts, and it's easier than you might think. Here are nine steps you can take to minimize the chance that your patient data will end up as booty for an identity thief:

1. Put a lock on the door to the room where you keep your network server. Ponderosa Medical Health & Wellness Center in Bend, OR, goes several steps further. Its two servers sit in a locked closet inside a locked room. The servers themselves are locked to a rack, and their casings are locked, too. "We need to be very careful," says internist C. Frost Lee.

2. Position desktop monitors so "shoulder surfing" patients and visitors can't easily read them. Set screen savers to come on if a computer has been idle for a few minutes, with reactivation requiring a password.

3. Stave off hackers by installing a firewall, or a router that incorporates one.

4. Password-protect laptops, tablets, and PDAs since they can be easily snatched.

5. Replace patient-sensitive e-mail with secure messaging that's encrypted and password-protected. Wireless transmissions inside the office also warrant encryption.

6. Destroy the hard drive of any computer you're throwing away. If you're selling or giving it to somebody, don't delete patient files the routine way—they can be easily recovered. Instead, treat the hard drive with special "data wiping" software.

7. Regularly audit who sees what in your EHR. This tracking capability can deter snooping, but only if you use it. Consider auditing a random sample of 50 charts per month. And put teeth in your policy, says FP David Kibbe, director of the Center for Health Information Technology at the American Academy of Family Physicians. "Give a warning to someone who had no business looking at a record, and make it clear that further infractions could get them dismissed."

8. Forbid sharing passwords, or writing them on paper. They should be memorized.

9. Be choosy about third parties that handle your practice's data, like billing companies and transcription services. HIPAA requires you to have such companies sign business associate agreements that oblige them to safeguard patient privacy. Before signing up, for example, ask a transcription service if it farms out work overseas, where HIPAA might be hard to enforce.

The best thing to remember, though, says David Kibbe, is that computer security is an ongoing process. It involves reviewing policies and procedures each year, analyzing security breakdowns, and making the necessary adjustments. And more than anything, it means creating a culture of vigilance. That takes leadership.

"If a doctor sets up policies and procedures and puts them into practice, the staff will follow," says Kibbe. "But if he tolerates people sharing passwords, say, that security breach will have a cascading effect through the office."

With identity thieves on the prowl, nobody can afford to let down his guard.

To minimize data theft, watch your backup

As recent security breaches illustrate, backing up data on a tape, disk, or removable hard drive and taking it home is a risky routine. Someone could steal the backup medium from your car. Or you could simply lose it.

So how do you avoid toting around backup media? One way is switching to a web-based EHR from an application service provider, or ASP. In this arrangement, your data resides on a remote server instead of your office computer and the ASP is responsible for backups. True, the ASP could do something stupid with your data, but New York City attorney and HIPAA expert Margaret Davino says these companies typically run a tighter ship than doctors do since security is part of their business.

Even if you don't opt for an ASP, you can follow the same principle by backing up your computer's data via the Internet to a remote server operated by a company like LiveVault (www.livevault.com) or First Backup (www.firstbackup.com). Again, the idea is to find someone who will handle your data better than you will.

A third option is backing up the traditional way, then stashing your tape, disk, or removable hard drive inside a fireproof safe.