Cybersecurity and Data Protection Practices Among Australian Dermatologists

Ongoing education, training and regular review of cybersecurity and data protection policies are essential in today's digital healthcare landscape. Dermatology is particularly vulnerable due to its reliance on high-resolution clinical imaging, which often includes personally identifiable and clinically sensitive visual data. We conducted an audit of cybersecurity and data protection practices of Australian dermatology fellows and trainees. Our electronic survey was constructed using the online survey platform SurveyMonkey and was made available for 1 week to fellows and trainees via an electronic link in the college newsletter. In addition to an electronic invitation submitted to fellows and trainees via the college website, attendees at the Australian College of Dermatologists Annual Scientific Meeting were encouraged to participate in the survey during the CPD session on the 13th of May 2024. A total of 108 dermatology consultants and trainees completed the survey (Table 1). The results of the survey are shown in Tables 2 and 3. The digital transformation of healthcare businesses has led to increasing vulnerabilities to cyber threats. Cybersecurity incidents can have serious repercussions, including medicolegal consequences, reputational damage and financial losses [1]. Our survey shows a substantial gap in the employment of a data protection officer and awareness of patient consenting policies, which points towards an area of improvement. Although most participants utilise electronic medical records (EMR) for documentation of patients' data, some participants only use paper-based records or a combination of both. Reassuringly, the majority of participants reported using systems that include regular either onsite, offsite or cloud-based backups of their EMRs and secure access via unique user credentials. There is a disparity in cybersecurity awareness and education among dermatology fellows and trainees, particularly in cybersecurity training and the use of personal devices for reviewing clinical images. Telehealth is widely adopted, with variations in the use of secure teleconferencing platforms and telehealth practices, with less than half of the respondents using secure platforms on work computers. This places practitioners at risk, as studies have demonstrated inadequate data protection and weak or absent passwords as major contributors to data breaches [1]. Healthcare providers may communicate electronically if reasonable safeguards are in place, consistent with the Code of Conduct for Doctors and privacy law [2]. Under Australian Privacy Principle 11, health information must be protected from misuse, loss, or unauthorised access. Failure to take reasonable steps may constitute a privacy breach with legal consequences [3]. Informed consent must be obtained from patients prior to telehealth appointments and when collecting or disclosing any medical information [3]. Secure platforms with features such as end-to-end encryption, MFA for hosts, and access controls using meeting ID, passwords, and secure meeting links are recommended [4]. Recommendations include the use of passphrases—a series of unrelated words with numbers or special characters [5]. Multi-factor authentication (MFA) provides additional protection against unauthorised access. This involves a username or passphrase; a unique code obtained from a token, text message, or smartphone application; and a characteristic unique to the user, like a fingerprint or facial scan [4]. Regular software updates, installing anti-virus software, and ad-blocking browser plugins on work computers can ensure network and device security [5]. Frequent backup of patient data can prevent losing information in the event of a security breach. A data breach response plan should also be formulated in preparation for these security breaches [6]. General data protection practices should be implemented at an organisational level. These include implementing role-based access controls with individual logins, as well as security audits to identify and address potential threats [7]. Our survey identified several critical areas for improvement in cybersecurity practices within dermatology settings. These include a clear need for more regular cybersecurity training, both for dermatologists and their team members. Inconsistent practices and knowledge around password protection have led to many participants not routinely reviewing password security measures. Approximately one-third of respondents were either unaware of the security features associated with their remote EMR access, or were using access methods that do not meet recommended security standards. There is a significant gap in training related to phishing awareness, highlighting the need for ongoing education to help clinicians and staff identify and manage suspicious communications. These findings underscore the importance of proactive, structured cybersecurity protocols and ongoing education to safeguard sensitive clinical data. Cybersecurity and data protection awareness in healthcare is paramount to maintain the confidentiality of patients. Our audit shows a disparity in current cybersecurity and data protection practices among dermatologists and dermatology trainees; hence, further education and training is needed in this digital space. The authors would like to acknowledge the Australasian College of Dermatology for their support in organising the Continuous Professional Development activity. The authors would also like to acknowledge MIGA for medico-legal advice. Open access publishing facilitated by University of New South Wales, as part of the Wiley - University of New South Wales agreement via the Council of Australian University Librarians. The authors declare no conflicts of interest. Data sharing is not applicable to this article as no new data were created or analyzed in this study.