11 Data Security Tips For Healthcare Organizations In 2013

PORTLAND, Ore., Jan. 8, 2013 /PRNewswire/ -- It's that time of year when everyone wants to be healthier. Eat better. Lose weight. Manage stress. Save money. These rank as peoples' top New Year's resolutions. The same holds true for healthcare organizations nationwide. They want and need to protect against the organizational and financial stresses of data breaches--which have become an everyday disaster--according to a recent report issued by Ponemon Institute. The Third Annual Benchmark Study on Patient Privacy & Data Securityreports that data breaches in healthcare are growing; insider negligence is the root cause; and mobile devices pose threats to patients' protected health information (PHI).

Despite the fact that 94percent of healthcare organizations surveyed suffered data breaches, data breaches don't have to be disastrous if organizations take steps to operationalize pre-breach and post-breach processes to better protect patient data and minimize breach impact. Here are 11 tips for a healthier organization--meant to be kept longer than peoples' typical New Year's

resolutions:

1. Establish mobile device and Bring Your Own Device (BYOD) policies that

include technical controls and employee and management procedures.

Rick Kam, CIPP/US, president and co-founder, ID Experts

2. Control the cloud or it'll control you. Make it a point to fully understand

what cloud service-level agreements mean in practice and then push for

meaningful information on failover and disaster recovery practices used."

Richard Santalesa, senior counsel, InfoLawGroup LLP

3. Have a current breach response plan that is ready and tested. This will

help pave the way for a well-executed response that can mitigate the

financial, legal and reputational harm caused by a security incident

involving patient information.

Marcy Wilder, partner and director of global privacy and information

management practice, Hogan Lovellis

4. Conduct small but focused risk assessments rotating control review on a

monthly basis to continually understand and measure risk. Most importantly,

have a plan to address the risk, through remediation, mitigation or risk

transfer activities.

Chad Boeckmann, president and chief strategy officer, Secure Digital

Solutions, LLC

5. Immunize mobile devices against viruses that might steal patient data.

Dr. Larry Ponemon, chairman and founder, Ponemon Institute

6. Attack your leadership team with phishing and other social engineering

campaigns. Nothing raises awareness like catching people and correcting

them on the spot--and it's a lot more interesting than the annual 30-minute

online security training.

Michael Boyd, Director of Information Security Management, Providence

Health & Services

7. Use a checklist to evaluate periodically whether covered entities and

business associates are in compliance with all privacy and security

requirements. Sign and date the checklist to show that your organization is

not guilty of "willful neglect" in complying with privacy and security

laws.

Jim Pyles, founding partner, Powers, Pyles, Sutter & Verville, P.C.

8. Educate all staff to recognize applications, mobile devices and medical

equipment that collect, contain or transmit patient information and/or

biometric data; and train them to communicate the risk to those responsible

for information security management.

Christina Thielst, FACHE, Vice President, Tower

9. Decide how to handle the residual risk of a data breach, how much risk to

accept, and how much, if any, risk to transfer through cyber insurance.

Christine Marciano, President, Cyber Data Risk Managers LLC 10. Boards should ensure their organizations have robust, board-reviewed and

approved security policies and procedures.

Larry W. Walker, president, The Walker Company 11. " Big data" is a source of both the disease and the cure for privacy and

information security symptoms. Currently, we have to deal with data

minimization, but in the future, look for applications that may collect

broadly, but protect against unauthorized disclosure or misuse very, very

well.

Jon Neiditz, partner, Nelson Mullins Riley & Scarborough LLP "Patient information is at risk for infection," said Rick Kam, president and co-founder of ID Experts. "Organizations need to make a commitment to a healthier organization from top to bottom, otherwise a common cold data breach will turn into tuberculosis."

About ID Experts

ID Experts delivers complete data breach care. The company's solutions in data breach prevention, analysis and response are endorsed by the American Hospital Association, meet regulatory compliance and achieve the most positive outcomes for its customers. ID Experts is a leading advocate for privacy as a contributor to legislation, a corporate and active member in both the IAPP and HIMSS, a corporate member of HCCA and chairs the ANSI Identity Management Standards Panel PHI Project. For more information, join the LinkedIn All Things HITECH discussion at bit.ly/AllThingsHITECH or All Things Data Breach at http://linkd.in/TsbwgJ; follow ID Experts on Twitter @IDExperts; and visit http://www2.idexpertscorp.com/.