How to Assess Security Risks When Choosing a Patient Intake Kiosk Manufacturer

A patient intake kiosk can handle names, contact details, insurance information, and health history. Before choosing a manufacturer, find out what data the kiosk touches, how it is protected, and what happens when something goes wrong.

HIPAA does not prescribe a single kiosk design or set of security products. It requires covered entities and business associates to use reasonable and appropriate administrative, physical, and technical safeguards based on their circumstances and risks. Use the questions below to assess a manufacturer’s safeguards and decide what your organization needs to verify. HHS’s HIPAA Security Rule overview explains this risk-based approach.

What patient information does the kiosk store and how is it protected?

Start by asking the manufacturer to map every place patient information may go. A kiosk might handle data only long enough to send it to your practice-management system, or it might also retain information in local storage, cloud services, backups, diagnostic logs, or support tools. Ask whether logs, screenshots, crash reports, and analytics can contain patient details.

Find out what information is necessary for intake and whether unnecessary fields or local storage can be disabled. For information that is stored, ask how the vendor protects encryption at rest, manages encryption keys, and securely deletes data when it is no longer needed. For information sent between the kiosk, your systems, and the vendor’s services, ask how encryption in transit and connection authentication are configured. HIPAA’s encryption specifications are addressable: the organization must assess whether encryption is reasonable and appropriate, and document its decision and any suitable alternative safeguards. HHS guidance on addressable specifications explains this distinction.

Request a data-flow diagram and written details about encryption, key handling, storage locations, and deletion. A clear account of where data travels—and where it remains—is more useful than a general statement that the kiosk is “secure.”

How are user access, permissions, and sessions secured?

Ask how the kiosk separates a patient’s intake session from staff and manufacturer access. A patient should not be able to open administrative screens, and staff permissions should match their job duties. Look for role-based access control, unique staff accounts, appropriate authentication, and audit logs that record administrative activity. HIPAA’s technical safeguards address access control, authentication, and audit controls. HHS’s Security Rule summary describes those safeguards.

For patient sessions, verify that the kiosk clears entered information and returns to a clean starting screen after submission, cancellation, or inactivity. Ask the vendor to demonstrate automatic session termination and explain what happens to temporary data, browser state, and unfinished forms. Do not assume that a screen reset alone clears stored or cached information.

For vendor support and staff administration, ask whether access is limited, logged, and promptly removed when no longer needed. Request details about remote-access authentication and whether your organization can review access records.

What physical safeguards protect the kiosk from tampering and disclosure?

Evaluate the kiosk in its intended location, not just in a product demonstration. Consider whether people nearby can see the screen, overhear dictated information, or reach exposed ports and cables. Privacy filters, careful screen placement, secure enclosures, and controlled access to the device can reduce these risks.

Ask what protects the kiosk from unauthorized physical access to its storage, ports, power controls, or internal components. A practical kiosk lockdown policy may disable unused USB ports, prevent access to the desktop or operating-system settings, restrict boot options, and limit the applications that can run. These are recommended safeguards to evaluate—not kiosk-specific requirements named in HIPAA.

Confirm how the organization will inspect the device, identify tampering, and protect it when it is moved, serviced, or taken out of use. HHS describes physical safeguards as measures, policies, and procedures that protect electronic systems and equipment from hazards and unauthorized intrusion. HHS guidance on physical safeguards provides more detail.

How are software updates and remote administration managed?

Ask which operating systems and software components the kiosk uses, how long the manufacturer supports them, and how it communicates security updates. Find out how quickly the vendor evaluates and addresses vulnerabilities, whether updates are authenticated, and how failed updates can be rolled back. An operating system that no longer receives security fixes may leave known vulnerabilities unaddressed; HHS advises considering known operating-system vulnerabilities in the organization’s risk analysis. HHS’s operating-system guidance explains that the Security Rule does not set a specific minimum OS, but does require attention to information-system risks.

Remote administration can help a vendor maintain kiosks, but it also creates a route into your environment. Ask whether remote access is disabled by default or can be disabled by your organization, how support personnel authenticate, and whether access is time-limited and logged. Clarify who approves maintenance, what data support staff can view, and how access is restricted to the task at hand.

Request written update and support policies, including the end-of-support date for each device model. Agree on how the manufacturer will communicate urgent vulnerabilities and provide fixes.

How does the manufacturer secure network connections and isolate compromised devices?

Ask how the kiosk connects to your network and which destinations, ports, and services it needs. Where practical, use network segmentation to separate kiosks from guest Wi-Fi, general-purpose workstations, and systems that do not need to communicate with them. Restrict connections to approved services and avoid exposing administrative interfaces directly to the public internet.

For data moving across a network, ask the manufacturer to describe its encryption, endpoint authentication, and protections against unauthorized access or alteration. HIPAA requires technical measures to guard against unauthorized access to electronic protected health information transmitted over an electronic network; the appropriate implementation depends on the organization’s risk assessment. HHS guidance on electronic PHI transmission explains the rule’s risk-based approach.

Also ask how your IT team can isolate a kiosk if it is lost, tampered with, or suspected of compromise. Confirm whether the device can be disconnected from the network, remotely disabled, or removed from central management without disrupting other systems. The vendor should explain how it will help investigate while preserving relevant logs and evidence.

What security testing, monitoring, and incident response does the vendor provide?

Ask for evidence that the manufacturer tests its product and addresses identified weaknesses. Useful materials may include a recent vulnerability assessment and penetration testing summary, the scope and date of testing, remediation status, and a description of how fixes are verified. These are practical due-diligence requests; do not assume that HIPAA requires a particular test or testing schedule.

Ask what the vendor monitors, how it detects suspicious activity, and which logs are available to your organization. Confirm how long logs are retained, how they can be exported, and whether they may themselves contain patient information. HHS says regulated entities must review records to track access and detect security incidents, and periodically evaluate whether safeguards remain effective. HHS’s Security Rule overview describes these obligations.

Request the vendor’s incident-response process, including how quickly it will alert your organization, who is reachable during an incident, and what support it provides for containment and investigation. Put notification expectations in the contract; a contractual deadline shorter than a regulatory maximum can give your team more time to assess and respond.

How are third-party access, data retention, and recovery governed?

Identify every cloud provider, support service, and subcontractor that may create, receive, maintain, or transmit electronic protected health information on the kiosk’s behalf. If the manufacturer performs functions that make it a business associate, the covered entity generally needs a written business associate agreement (BAA) with it. A business associate must also have appropriate written arrangements with subcontractors that handle the information. HHS business-associate guidance explains these contract requirements.

Review the BAA and related terms for permitted data uses, safeguards, subcontractors, incident reporting, and cooperation during an investigation. Ask how long the vendor retains intake data, logs, and backups; how data is returned or deleted when the service ends; and whether any backup copies remain temporarily. HIPAA does not make a generic vendor statement a substitute for understanding the actual data lifecycle.

Ask how the vendor backs up configuration and necessary data, protects backups, and restores service after a failure or cyberattack. Clarify who tests recovery, how often it is tested, and what happens if the manufacturer or a critical subcontractor can no longer provide the service. As you compare manufacturers, prioritize clear data flows, limited access, effective physical and network controls, documented testing, and enforceable agreements for retention, recovery, and incident response.

FAQs

What security documentation should a patient intake kiosk manufacturer provide?

Request a data-flow diagram, data inventory, security architecture, encryption and key-management details, access-control and logging descriptions, physical-security guidance, update and support policies, and incident-response procedures. You can also ask for a recent vulnerability assessment and penetration testing summary, remediation information, a list of relevant subcontractors, retention and deletion terms, recovery documentation, and a BAA when the manufacturer’s role requires one. HIPAA does not expressly require a vendor to provide every security document or allow customer audits, so specify the assurances and evidence you need in your contract. HHS guidance on vendor documentation and audits explains this point.

How can a kiosk prevent one patient from viewing another patient’s information?

Require a clean session for each patient, automatic session termination after inactivity, and clearing of entered data and temporary browser state after submission or cancellation. Combine these controls with a privacy-conscious screen layout and a kiosk lockdown policy that prevents access to other applications or stored records. Ask the manufacturer to demonstrate the reset behavior and explain how it verifies that information from one session cannot appear in the next.

Who is responsible for reporting a patient data breach involving a kiosk?

When a business associate discovers a breach of unsecured protected health information, it must notify the covered entity without unreasonable delay and no later than 60 days after discovery. The covered entity is generally responsible for required notifications to affected individuals and HHS, though it may delegate some notification work to the business associate. The parties should define a faster operational notification deadline and cooperation duties in the BAA. HHS’s Breach Notification Rule guidance explains the reporting responsibilities and timelines.

Does a vendor’s compliance claim guarantee that a patient intake kiosk is secure?

No. A compliance claim does not show by itself how the kiosk handles your data, whether its safeguards fit your environment, or whether those safeguards are effective. HHS does not endorse or recognize private organizations’ HIPAA certifications, and an external certification does not remove a covered entity’s obligations. Review evidence and contracts, assess your own risks, and verify that the kiosk’s safeguards fit your workflows. HHS guidance on Security Rule certification explains the limits of such claims.