Risk
11/9/2009
02:16 PM
Connect Directly
RSS
E-Mail
50%
50%

Healthcare Providers Face Security Challenges

Three-quarters of organizations that conduct formal risk assessments have found patient data at risk, study says.

Many healthcare organizations are unprepared for new federal regulations and other security challenges, according to a study. Security budgets are low, organizations don't have response plans for threats or a security breach, and a designated chief security officer isn't in place.

The Health Information Technology for Economic and Clinical Health Act (HITECH) provisions of the U.S. American Recovery and Reinvestment Act (ARRA) of 2009 includes new regulations for maintaining privacy and security of patient health data, but healthcare providers aren't ready, according to the results of the 2009 Security Survey from the Healthcare Information and Management Systems Society, sponsored by Symantec.

The survey, which questioned healthcare IT and security professionals, found that three quarters of organizations that conduct formal risk assessments found patient data at risk due to inadequate security controls, policies, and processes.

Three-quarters of surveyed organizations conduct formal risk analyses, but only half of those do so on a yearly basis or more frequently. The figure has remained the same in the past year. "Conducting this analysis positions organizations to identify gaps in their security controls and/or policies and procedures," HIMSS said.

"One-third of respondents reported that their organization has had at least one known case of medical identity theft at their organization. Only a handful of these organizations, however, has experienced direct consequences from the breach," HIMSS said.

Healthcare organizations aren't using current security technologies, the study found. Respondents widely use logs from firewalls, applications, and servers as information sources, yet only 25% of respondents reported electronic analysis of the data. While respondents use firewalls and user access controls, only 67% of responding organizations use encryption, and half encrypt stored data.

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0560
Published: 2014-09-17
Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors.

CVE-2014-0561
Published: 2014-09-17
Heap-based buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-0567.

CVE-2014-0562
Published: 2014-09-17
Cross-site scripting (XSS) vulnerability in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on OS X allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Universal XSS (UXSS)."

CVE-2014-0563
Published: 2014-09-17
Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS X allow attackers to cause a denial of service (memory corruption) via unspecified vectors.

CVE-2014-0565
Published: 2014-09-17
Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0566.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
CISO Insider: An Interview with James Christiansen, Vice President, Information Risk Management, Office of the CISO, Accuvant