Security Best Practices
Recommended practices for your staff, to protect patient data and support your organization's HIPAA obligations when using ArkCloud. They are recommendations, not controls ArkCloud enforces - the first section lists what ArkCloud does enforce.
What ArkCloud Enforces, and What Is Up to You
Enforced by ArkCloud
- A password needs at least 12 characters with an upper-case letter, a lower-case letter, a number and a symbol, whether a user chooses it at sign-up or reset or an administrator types it in for someone else. Passwords do not expire.
- 10 failed sign-ins in a row lock the account for 15 minutes.
- Sessions end 8 hours after sign-in, or after 12 hours if a non-administrator chooses Remember me (administrators always 8 hours). There is no inactivity timeout.
- Authenticator-app codes are required for administrators, and for every user when your organization turns that on.
- A password reset signs the user out of every existing session; an administrator can also use Force logout.
- Every screen that opens a patient's record writes the PHI access log, which administrators can review.
- Connections use HTTPS; plain HTTP is redirected.
Up to your organization
- Who gets which role, and removing access when someone leaves
- Screen locks and signing out, since ArkCloud has no inactivity timeout
- Device encryption, operating-system updates and antivirus
- Workforce security training and phishing awareness
- Physical security of printed PHI and workspaces
- Your own incident reporting and breach notification procedures
Everything else on this page is a recommended practice for your staff, not something ArkCloud checks.
Security is Everyone's Responsibility
While ArkCloud implements technical security controls - see the other pages in this section for exactly which - the most effective security posture requires partnership between our platform and your users. Each team member plays a critical role in protecting patient data and meeting your organization's HIPAA obligations.
Security training and vigilance
Platform security features
Organizational guidelines
Security Best Practices
Authentication & Passwords
Use strong, unique passwords (12+ characters, mixed case, numbers, symbols)
Reuse passwords across multiple accounts or share credentials with colleagues
Enable multi-factor authentication (MFA) on your account
Disable MFA for convenience, or keep your backup codes on the same phone as your authenticator
Use a password manager to generate and store complex passwords
Write passwords on sticky notes or save them in unencrypted files
Reset your password immediately (Forgot password on the sign-in page) if you suspect it may be compromised - a reset also signs you out everywhere
Ignore an account lockout or a password-reset email you did not trigger
PHI Access & Usage
Only access PHI necessary for your job responsibilities (minimum necessary)
Access patient records out of curiosity or for non-work purposes
Log out or lock your workstation when stepping away - ArkCloud does not sign you out after a period of inactivity
Leave your session active on shared or unattended computers
Verify patient identity before discussing or accessing their information
Discuss patient information in public areas or where others can overhear
Report any suspicious PHI access or potential HIPAA violations immediately
Ignore unusual access patterns or security warnings in the system
Device Security
Keep your device operating system and applications updated with latest patches
Ignore or postpone critical security updates and patches
Use full-disk encryption on laptops and mobile devices with PHI access
Store PHI on personal devices or unencrypted removable media
Use antivirus software and keep it updated on all devices
Disable antivirus software or security features for convenience
Report lost or stolen devices with PHI access immediately
Wait to report lost devices or fail to remotely wipe if possible
Network & Communications
Always connect to ArkCloud via HTTPS and verify the SSL certificate
Access the system over public Wi-Fi without VPN protection
Use secure, encrypted communication methods for sharing PHI
Send PHI via unencrypted email or text message
Verify recipient email addresses before sending PHI electronically
Use autofill for sensitive emails without double-checking recipients
Use organization-approved file sharing methods for PHI
Use personal cloud storage (Dropbox, Google Drive) for work PHI
Social Engineering & Phishing
Verify unexpected requests for credentials or PHI through another channel
Click links or download attachments from suspicious or unexpected emails
Report suspected phishing emails to your IT security team
Respond to emails requesting passwords, MFA codes, or sensitive information
Hover over links to preview the URL before clicking
Trust emails just because they appear to come from a known sender
Verify phone callers' identity before discussing PHI or account information
Provide sensitive information to unsolicited phone callers
Physical Security
Store printed PHI in locked cabinets or secure areas when not in use
Leave printed PHI on desks, printers, or in open trash bins
Shred documents containing PHI before disposal
Throw PHI documents in regular trash bins
Use privacy screens when working with PHI in public or shared spaces
Display PHI on screens visible to unauthorized individuals
Challenge or report unfamiliar individuals in secure areas
Allow tailgating or hold doors open for unverified individuals
Incident Reporting
Report security incidents immediately, even if unsure of significance
Wait to report incidents or try to fix security issues yourself
Document and report any suspected PHI breach to your privacy officer the same day
Assume minor incidents don't need to be reported
Preserve evidence of security incidents (logs, emails, screenshots)
Delete or modify potential evidence of security incidents
Cooperate fully with security incident investigations
Withhold information or fail to follow incident response procedures
Daily Security Checklist
Make these security practices part of your daily routine:
Security Red Flags
Be alert for these warning signs of potential security issues:
Suspicious Activity:
- Unexpected password reset emails
- Account lockouts you did not cause
- Emails claiming to be from IT requesting credentials
- Urgent requests to bypass normal procedures
- Anyone asking for your authenticator code
- System running slower than normal
Take Action:
- Reset your password - this also ends your other sessions
- Ask an administrator to use Force logout on your account
- Report to security team right away
- Do not click links in suspicious emails
- Verify requests through another channel
- Run antivirus/malware scan if concerned
Security Training & Resources
HIPAA requires your organization to train its own workforce (45 CFR 164.308(a)(5)). ArkCloud does not provide this training. Topics to cover:
Suggested training topics:
- Annual HIPAA Security and Privacy training
- New hire security orientation
- Role-specific security training
- Phishing awareness training
- Incident response procedures
- Security policy acknowledgment
Additional Resources:
- Your organisation's own security policies and procedures
- Your organisation's security awareness training
Security is a Team Effort
By following these practices, you play a critical role in protecting patient data and meeting your organization's HIPAA obligations. When in doubt about security, always err on the side of caution and reach out to your security team.