Key Takeaways
- Printers, copiers, scanners, and multifunction devices should be considered part of a healthcare organization’s broader information-security strategy.
- Some devices can process or store electronic protected health information (ePHI).
- Healthcare organizations should consider access controls, secure printing, encryption, network security, and device settings when evaluating office equipment.
- Equipment containing sensitive information should also be addressed when it is replaced, reused, returned, or disposed of.
- Printer security can support HIPAA security efforts, but no single device or feature makes an organization HIPAA compliant.
Printers and multifunction devices are easy to overlook when evaluating information security in a healthcare environment.
However, these devices can process, transmit, and—in some cases—store sensitive information. That makes HIPAA printer security an important consideration for healthcare organizations handling electronic protected health information.
The U.S. Department of Health and Human Services requires regulated entities to implement safeguards for electronic information systems containing ePHI. The HIPAA Security Rule also includes requirements related to access controls, transmission security, and device and media controls.
So where do printers and multifunction devices fit into the picture?
Printers and Copiers Can Process Sensitive Information
Today’s multifunction devices do much more than make copies.
Employees may use them to print, scan, email, fax, or route documents. Depending on the equipment and configuration, these processes can involve information stored on or transmitted through the device.
NIST specifically identifies printers, scanners, copiers, and multifunction devices as replication devices that can process, store, or transmit information.
For healthcare organizations, these devices should therefore be considered alongside other technology that interacts with sensitive information.
1. Control Access to the Device
Not every employee necessarily needs access to every device function.
Depending on the equipment and configuration, organizations may be able to use authentication and access controls to manage who can print, scan, or use certain device capabilities.
Compatible Canon imageRUNNER ADVANCE DX devices, for example, offer authentication and access-management capabilities. Available features vary by model and configuration.
2. Consider Secure Print Release
Sensitive documents shouldn’t be left sitting unattended in an output tray.
Secure print capabilities can hold a print job until an authorized user releases it at the device.
This can be particularly useful in shared healthcare environments where multiple employees use the same multifunction device.
3. Evaluate Data and Network Security Features
When selecting equipment, healthcare organizations should evaluate the security capabilities available on the specific device.
Depending on the model and configuration, these can include features related to:
- Data encryption
- User authentication
- Secure printing
- Network communications
- Access management
- Device integrity
- Activity monitoring
For example, compatible Canon imageRUNNER ADVANCE DX devices offer security capabilities including HDD encryption and erase functions, Secure Print, Encrypted Secure Print, authentication, TLS, IPsec, and other protections.
These features should be evaluated as part of the organization’s broader IT and cybersecurity strategy.
4. Don’t Forget Scanning Workflows
Printing isn’t the only consideration.
Employees may scan documents to email, network folders, document-management systems, or other destinations.
Healthcare organizations should evaluate where scanned information is being sent, who has access to those destinations, and what safeguards are appropriate for their environment.
Device security should work alongside the organization’s existing policies and technical controls.
5. Plan for Equipment Replacement and Disposal
Security considerations don’t end when a copier is removed from the office.
HHS requires regulated entities to maintain policies and procedures addressing the final disposition of ePHI and hardware or electronic media on which it is stored. Procedures are also required for removing ePHI before electronic media is made available for reuse.
NIST’s current media-sanitization guidance likewise addresses information-storage media found in office equipment and recommends sanitization practices based on the sensitivity of the information involved.
Organizations should therefore understand what storage media their equipment contains and establish appropriate procedures when equipment is replaced, returned, reused, or disposed of.
6. Include Printers in Your Overall Security Strategy
Printer security shouldn’t exist separately from the rest of your organization’s cybersecurity program.
Healthcare organizations should work with their IT and security teams to evaluate devices, network configurations, user access, document workflows, and policies involving sensitive information.
Managed Print Services can provide additional visibility into the print environment and help organizations manage equipment, usage, supplies, and maintenance. However, MPS should support—not replace—an organization’s broader cybersecurity and HIPAA compliance program.
How Offix Can Support Healthcare Print Environments
Offix can help healthcare organizations evaluate their print environment and explore multifunction devices, print management software, Managed Print Services, and available device-security capabilities.
The appropriate solution depends on your organization’s equipment, network, workflows, security requirements, and internal policies.
Contact Offix today to discuss office technology and print-management solutions for your healthcare organization.
This article is provided for general informational purposes and should not be considered legal, compliance, or cybersecurity advice. Organizations should work with qualified legal, compliance, and IT professionals to evaluate their specific HIPAA obligations.
Frequently Asked Questions
Do printers and copiers create HIPAA security concerns?
They can. Printers, copiers, scanners, and multifunction devices may process, transmit, or store information. Healthcare organizations should include relevant devices when evaluating safeguards for ePHI.
Can a copier be HIPAA compliant?
HIPAA compliance applies to regulated organizations and their safeguards and practices rather than being achieved simply by purchasing a particular copier. Device security features can support an organization’s security strategy, but they don’t independently establish HIPAA compliance.
What printer security features should healthcare organizations consider?
Depending on the equipment and environment, organizations may consider authentication, secure print release, access controls, encryption, network security, device-integrity features, and appropriate data-sanitization capabilities.
What happens to stored information when a copier is replaced?
Organizations should determine whether equipment contains electronic media with sensitive information and follow appropriate sanitization and disposal procedures. HHS specifically requires regulated entities to address the final disposition and reuse of hardware or electronic media containing ePHI.