Information security in Colombian healthcare: what every provider should know

Medical records are among the most valuable data there is, and among the most targeted. They contain identity details, diagnoses, treatments, insurance information and often financial data. Unlike a bank card, a diagnosis cannot be “changed” after a leak.

In Colombia, clinics, healthcare providers and private practices of every size digitized their operations within a few years: online scheduling, electronic medical records, electronic invoicing and reporting to the Ministry of Health. That transformation brought efficiency, but it also widened the attack surface.

Attackers look for places where the impact is greatest and the pressure to pay is highest. Healthcare combines several conditions that make it especially vulnerable:

• Operations cannot stop: without scheduling or medical records, patient care is interrupted.
• Clinical data is sensitive data and has high value on illegal markets.
• Many institutions still run old equipment and software that is hard to update.
• Clinical staff rotate frequently and share computers and passwords.
• The supply chain is broad: laboratories, insurers, software, cloud and connectivity providers.

Colombia has already experienced high-impact incidents. In late 2022, a ransomware attack hit one of the country’s largest healthcare groups and took appointment and care systems offline for days. In 2023, an attack on a cloud service provider affected hundreds of public and private organizations, including some in healthcare. In other words: even if your clinic is well protected, a careless vendor can still leave you without service.

Besides being good practice, protecting medical records is a legal duty. The rules that carry the most weight:

• Law 1581 of 2012 and Decree 1377 of 2013: health data is sensitive data; processing it requires explicit consent, a clear purpose and adequate security measures.
• Resolution 1995 of 1999: defines the medical record as a private, confidential document, with rules for custody, access and retention.
• Law 2015 of 2020: creates the interoperable electronic medical record, which requires providers to exchange information securely.
• Reporting to the Ministry of Health, such as RIPS and IHCE/RDA, which demands data quality, integrity and traceability.

The Superintendence of Industry and Commerce (SIC) oversees compliance with the data protection regime and can impose significant fines. In addition, incidents that compromise personal databases must be reported to that authority.

• Generic users or shared passwords at the front desk and in exam rooms.
• Medical records kept in spreadsheets, shared folders or WhatsApp messages.
• Backups that have never been tested or are stored on the same server.
• Phishing emails that impersonate insurers, suppliers or government agencies.
• Outdated software and remote access without two-factor authentication.
• No record of who viewed or changed each medical record.

You don’t need a big budget to take the first steps. What matters is starting with what reduces risk the most:

• Individual users, strong passwords and two-factor authentication.
• Roles and permissions: each person sees only the information they need for their job.
• Encryption of clinical information in transit and at rest.
• Access auditing: knowing who viewed or changed what, and when.
• Automatic backups, kept outside the main system and tested regularly.
• Staff training to recognize phishing emails and messages.
• An incident response plan that defines what to do, who to call and how to keep caring for patients.

Many institutions try to protect a system that was never designed to handle sensitive data. That is why at WolfGIS we built WolfMEDIC, a cloud-based medical and dental software where security is the starting point: encryption of clinical information, per-user roles and permissions, access auditing for medical records, automatic backups and compliance with RIPS and IHCE/RDA.

Discover WolfMEDIC

A security incident in healthcare is felt in the waiting room: the schedule goes down, care slows and someone has to explain what happened to patients and to the regulator. Preparing beforehand usually costs less. If you want to know how well your clinic’s information is protected, WolfGIS can review it with you.