Scribd Logo
Upload

Welcome to Scribd!

  • 44 views

    Info Security April 2010

    Uploaded by

    mackingt
    1) Electronic health records provide potential benefits but also security risks as they contain sensitive personal information. The US government has invested billions to encourage healthcare providers to adopt electronic records through the HITECH Act. 2) However, some experts argue that many healthcare providers have rushed to adopt electronic records without properly addressing security issues, leaving personal information vulnerable to theft and hackers. Proper security practices and compliance with evolving standards are important to protect privacy and avoid penalties. 3) Opinions vary within the industry, as some providers feel confident in their security efforts while others worry about meeting compliance deadlines and keeping pace with changing requirements. Overall, most agree that more needs to be done to secure electronic health information from potential theft and mis

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PDF, TXT or read online from Scribd

    Info Security April 2010

    Uploaded by

    mackingt
    44 views3 pages
    1) Electronic health records provide potential benefits but also security risks as they contain sensitive personal information. The US government has invested billions to encourage healthcare providers to adopt electronic records through the HITECH Act. 2) However, some experts argue that many healthcare providers have rushed to adopt electronic records without properly addressing security issues, leaving personal information vulnerable to theft and hackers. Proper security practices and compliance with evolving standards are important to protect privacy and avoid penalties. 3) Opinions vary within the industry, as some providers feel confident in their security efforts while others worry about meeting compliance deadlines and keeping pace with changing requirements. Overall, most agree that more needs to be done to secure electronic health information from potential theft and mis

    Copyright

    © Attribution Non-Commercial (BY-NC)

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    1) Electronic health records provide potential benefits but also security risks as they contain sensitive personal information. The US government has invested billions to encourage healthcare providers to adopt electronic records through the HITECH Act. 2) However, some experts argue that many healthcare providers have rushed to adopt electronic records without properly addressing security issues, leaving personal information vulnerable to theft and hackers. Proper security practices and compliance with evolving standards are important to protect privacy and avoid penalties. 3) Opinions vary within the industry, as some providers feel confident in their security efforts while others worry about meeting compliance deadlines and keeping pace with changing requirements. Overall, most agree that more needs to be done to secure electronic health information from potential theft and mis

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    44 views3 pages

    Info Security April 2010

    Uploaded by

    mackingt
    1) Electronic health records provide potential benefits but also security risks as they contain sensitive personal information. The US government has invested billions to encourage healthcare providers to adopt electronic records through the HITECH Act. 2) However, some experts argue that many healthcare providers have rushed to adopt electronic records without properly addressing security issues, leaving personal information vulnerable to theft and hackers. Proper security practices and compliance with evolving standards are important to protect privacy and avoid penalties. 3) Opinions vary within the industry, as some providers feel confident in their security efforts while others worry about meeting compliance deadlines and keeping pace with changing requirements. Overall, most agree that more needs to be done to secure electronic health information from potential theft and mis

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 3

    Strategy

    Securing Electronic Health Records


    Electronic health records are supposed to improve the efficiency and accuracy of healthcare delivery. However, with electronic records come security headaches, and the potential for data breaches. John Sterlicchi examines what the industry is doing thus far to facilitate a secure transition toward electronic health records.
    is the US healthcare industry focused enough on security as it races headlong toward electronic patient records, spurred on by billions of dollars in federal government stimulus money? There are good reasons it needs to be. First and foremost, a condition of the stimulus money is that patient privacy is paramount, and there will be real consequences for organizations that go the EHr (electronic health records) route but fail to protect the information. Second, criminals are realizing that within EHrs there is a treasure trove of information, such as SSNs, and a recent report shows that hack-attacks on healthcare organizations are skyrocketing. out of medicare and medicaid business. providers suffering breaches caused by their lack of preparedness will, for the first time, face possible prosecution by states attorneys general a penalty not included in the original Health insurance portability and accountability act(Hipaa).

    Providing a Stimulus for Change


    While healthcare organizations and politicians have talked about the value EHrs since before the failed clinton healthcare initiative back in the 1990s, their use came mightily into focus after February 17, 2009. That was the day the $787bn american recovery and reinvestment actof 2009 was signed into law. included in the legislation was the Health information Technology for Economic and clinical Health act, or HiTEcH act, which designated a total of $19.2bn to boost the meaningful use of EHrs by hospitals and physicians. The carrot of stimulus money came with several sticks that will penalize providers if they do not attain increasingly stringent transactional and security standards between now and 2015. The actual technical standards are still being developed with the help of the National institute of Standards and Technology (NiST). penalties for non-compliance and negligent breaches of security could be harsh, as non-compliant providers will be frozen

    I dont think HITECH is that complicated. I think everybody is making it complicated. I think they just need to simplify it and quit listening to vendors trying to scare the living daylights out of them
    Jana Grose

    That last provision gives Hippa teeth says Beau Woods, solutions architect for SecureWorks, a company that reported a doubling of attempted hacker attacks launched at its healthcare clients in the fourth quarter of 2009. attempted attacks increased from an average of 6500 per healthcare client per day in the first nine months of 2009 to an

    marcH/april 2010 US Edition

    19

    STRaTEgy
    He is worried that stimulus-hungry companies are rushing into EHrs without appreciating the security implications. Van Dyke says that as soon as the companies put the apis (application programming interfaces) into their databases to make their systems capable of communicating with an individuals e-records, they are opening themselves up for more fraud risk. So things have gotten worse rather than better in the short term as a result of HiTEcH, and we would expect that from an industry that is in disarray, he adds.

    Transition to EHrs should makes scenes like this a thing of the past, but with them comes data security implications

    average of 13 400 per client per day in the last three months of 2009. interestingly, attempted attacks against other types of organizations, protected by SecureWorks, did not increase in the fourth quarter. While those statistics should have the healthcare providers worried, Woods says, i dont think they are as secure as they need to be, especially taking care of patient information and some of the other things they have floating around their networks: credit card information and that kind of thing.

    The breaches that are injuring the industry and its reputation are perpetrated by authenticated and authorized users who work within the health system

    Protecting Patients Privacy


    Kurt long, the cEO of FairWarning, a company that sells privacy breach detection software for EHrs, believes the bigger healthcare companies have gotten the privacy message and are well aware of their responsibilities under HiTEcH. The leaders are very concerned with privacy, he says. They have received the message and are taking it very seriously. Their motivation is to see the expansion of electronic health records and to see more efficiencies gained from those; and better care delivered through electronic health records. Theyve now realized that privacy will be of the utmost consideration. Because Hipaa had no teeth, long says that for healthcare companies that suffered a breach, a reasonable strategy was to say we will do nothing. We know something has happened but unless someone figures out the media or the patient that there is a problem, then we dont have to do anything, and there is no legal obligation under Hipaa. Doing nothing was a viable option, long says. But now, one year after HiTEcH, doing nothing is illegal. it becomes willful neglect with escalating penalties, he continues. Woods concern is shared by James Van Dyke, president of Javelin Strategy & research, a research firm specializing in trends in security and fraud initiatives. He believes healthcare is, and will remain a goldmine for fraudsters. Van Dyke is unimpressed with the efforts of the healthcare industry particularly small and mid-sized companies since the Obama administration opened the financial spigot in early 2009. Not much has happened in the last 12 months. and what has happened hasnt really been great.

    Kurt long, FairWarning

    20

    US Edition marcH/april 2010

    STRaTEgy

    a mESSagE to thE hEalthcarE indUStry:

    Things have gotten worse rather than better in the short term as a result of HITECH, and we would expect that from an industry that is in disarray
    James Van Dyke

    rElax , itS not that complicatEd


    While much of the healthcare industry seems flustered by compliance and privacy issues caused by HiTEcH, Jana Grose, ciO of the massena Hospital Group in New York, is sanguine. Her first piece of advice to her colleagues is to stop listening to vendors who want their slice of the EHr stimulus pie. i dont think HiTEcH is that complicated. i think everybody is making it complicated. i think they just need to simplify it and quit listening to vendors trying to scare the living daylights out of them. Grose believes that hospital officials should stop going to seminars and listening to someone else tell them what the new regulations are, and they should sit down and read the policies for themselves. Next comes strategic planning with administration and other departments, vendors, and business associates. its pretty simple and you should have been headed in that direction anyway, she claims. Helping Groses peace of mind is her complete faith in risk assessment compliance audit software from acr2 Solutions. Under HiTEcH, the final item on meaningful use is that an organization must do a risk assessment on compliance every quarter. i thought i found the best software ever with acr2 because once you have put your information in at the beginning, then you just hit a button and theres your report. it also shows your progress over time, she said. This software has the regulations in and the interpretation of those regulations; in terms that you can understand, and it tells you what you need to do to fix anything. When we put it in we felt like a giant elephant [was] being lifted off our backs. Grose says she has even tried to convince the government to use the acr2 software as their standard for compliance testing.

    a House Divided
    identity theft that leads to identity fraud will continue to plague the healthcare industry until there is reform leading to more, if not all, people having affordable healthcare. it is too easy to steal an individuals SSN and then use it to impersonate them to receive a medical procedure. as long as you have an industry that, in terms of their own electronic sophistication, is a complete mess, you are more likely to have these crimes go on, Van Dyke says. FairWarnings long said the company recently completed a survey of 200 hospitals across the US, and nearly half of those organizations (47.3%) believe they are already compliant with HiTEcH and Hipaa and are audit ready.

    Security will not be this simple with EHrs

    On the downside though, nearly one-third of survey respondents stated they will not be compliant withHiTEcHrequirements by the established deadlines. The survey indicates that organizations are concerned with the challenges of monitoring dozens of healthcare applications. FairWarnings software, developed specifically to work with healthcare applications from the likes of Siemens, mcKesson, GE and Epic, monitors the actions of authorized and authenticated users to deter theft and other privacy issues, such as Vip snooping. None of those breaches can be stopped by encryption; none can be stopped by authentication, long warns. The breaches that are injuring the industry and its reputation are perpetrated by authenticated and authorized users who work within the health system, he says. So while opinions are divided on the security and privacy qualifications of the healthcare industry, one ciO on the frontline believes that EHrs will be too tempting for nutballs to resist trying to steal the information. Jana Grose, of the massena Hospital Group in New York, believes that sometime in the future there will be a major breach, and then everyone will be rushing around. i dont believe in that, she declares. i want to be ahead of the game.

    marcH/april 2010 US Edition

    21

    You might also like