Hit Security: Health Care Organizations Need To Work On It

By Author: Angela Martin
Total Articles: 206
Comment this article

Healthcare IT trends are changing but health care organizations, notwithstanding new legal requirements like HITECH, have not made many inroads in the last year in gearing up for security challenges such as privacy breaches and electronic PHI.


The industry group in its 2009 Security Survey warns, “Healthcare organizations have made relatively little change since the assessment of the market HIMSS conducted in 2008 across a number of key areas of the security environment.” Respondents characterized their own maturity level as mid-range, budgets dedicated to security remain low, and many organizations still don't have a formally designated CSO/CISO.



According to HIMSS, organizations often don't have a plan for responding to threats or incidents relating to a security breach. Only three-quarters of the respondent organizations perform risk assessments. Out of the organizations that perform risk assessments, another three-quarter indicated that patient data at their organization was found to be at risk owing to inadequate security controls, policies and/or procedures.


One requirement under the American Recovery and Reinvestment Act of 2009, audits log, are being used, though only one-quarter of respondents in the survey said that analysis of log data is done entirely electronically. HIMSS cautions that without the help of some automated/electronic means to analyze log data, organizations may not be well positioned to provide patients with a PHI breach notification.


Eventually, while tools such as firewalls and user access controls are widely used, many organizations are not making use of all available technologies to secure data, such as encryption to secure data in transmission ( which is used by just 67 percent of responding organizations) and lesser than half encrypt stored data.


And all these factors are going to be even more complicated in the future, as organizations will have to continue to deal with an increasingly complex operating setting.

We provide the latest news of Healthcare IT trends according to PHI breach notification and offers advanced Learning Opportunities for healthcare executives, hospitals and physicians.