Medical Data At Risk

A new study from the Healthcare Information and Management Systems Society reports that since January 2008, more than 110 healthcare organizations have reported the loss of sensitive patient data affecting over 5,306,000 individuals.

The findings, published in the 2010 HIMSS Analytics Report: Security of Patient Data, show that the vast majority of the 250 healthcare IT and security professionals surveyed have policies, procedures and technology in place at their organizations to prevent data theft. But changes made to protect medical records haven’t curbed the number of reported breaches, which increased six percent since 2008.

HIMSS’s Analytics unit did the study in partnership with Kroll Fraud Solutions, a provider of data protection and identity theft response services.

More than 40 percent of survey respondents reported that data loss incidents were caused by theft (stolen laptops, computers, or media/tapes. Another 27 percent were the result of loss or by staff or third parties; malicious insiders caused 20 percent; and 9 percent were caused by system hacks, Web exposure, and virus attacks.

The organizations in questions have security policies in place, said Brian Lapidus, Kroll’s chief operating officer. But “the gap between security policy and actual behavioral change is still significant,” he said.

The study’s findings are similar to a 2008 report that also showed gap between policy and behavior, according to Lapidus. What’s changing is the increasing shift toward digitized medical records.

The 2008 survey found that nearly all respondents had formal security policies and procedures, did background checks on potential hires and had IT security infrastructure in place such as firewalls and encrypted e-mails.

Yet there’s room for improvement like background checks for third-party employees, Lapidus said. In fact, 60 percent of respondents said they require third-party vendors to provide proof of employee training, but only half require third-party vendors to provide proof of employee background checks.

More organizations are training staff in best practices and requiring IT managers to take responsibility for data protection. But there continues to be a lack of consensus on who should be the individual responsible for data security, the report said.

Too often a data loss occurs, and the question arises: “is this the CIO’s problem, the risk manager’s problem, or the chief privacy officer’s problem? Whose problem is it? Who owns it?” Lapidus said. There needs to be collaboration across the silos, and organizations don’t always think that way, he said, adding that healthcare organizations need to keep risk at the center of their focus.

Toward that effort, 87 percent of respondents said they have a specific policy in place to monitor electronic patient health information access and sharing. Eighty-six percent said regular audits are conducted of systems that generate, collect and transmit patient information.

Of the IT managers interviewed for the survey, slightly more than half (56 percent) work for a general medical/surgical hospital, and a third work at critical access hospitals.

Some Related Articles


This entry was posted on Wednesday, April 7th, 2010 at 11:29 pm and is filed under Medical News. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.

One Response to “Medical Data At Risk”

  1. dota2hack.org Says:

    Hi Google and yahoo performs well yet your site is loading steadily which went on around
    a minute to be able to load up, I’m not sure whether it’s my very
    own issue or maybe website problems. Around the
    other hand I appreciate you for creating brilliant blog post.

    Everybody who actually discovered this site must have found this article really beneficial.
    I’m hoping I will be able to find even more incredible content and
    I also should certainly compliment you by telling you’ve done wonderful writing.
    Soon after looking at your post, I have book-marked the website.

Leave a Reply

CommentLuv Enabled