Healthcare Security Pros Must Speak More Like CFOs
Financial Impact of Breached Protected Health Information report helps health IT pros make the business case for patient data protection.
As the number of healthcare data breaches continues to snowball, executives put in charge of safeguarding protected health information (PHI) can't keep up with the risks inherent with increased deployment of electronic health records (EHRs) without enough financial backing to get the job done. And the only way that these PHI protectors can squeeze that juice from the C-suite is if they make themselves fluent in the language of financial justification, say authors of a new report on healthcare IT security.
A collaboration between the American National Standards Institute (ANSI), via its Identity Theft Prevention and Identity Management Standards Panel (IDSP), in partnership with the Santa Fe Group/Shared Assessments Program Healthcare Working Group, and the Internet Security Alliance (ISA), the free report, The Financial Impact of Breached Protected Health Information, took input from 100 healthcare leaders from 70 organizations. It was the culmination of a yearlong initiative called the PHI Project.
According to Rick Kam, president and co-founder of ID Experts and chair of the PHI Project, the team hopes to establish the document as the go-to resource for security and privacy officers taking a disciplined approach to assessing and mitigating risk of healthcare data breaches. He says that the state of the industry is such that those in charge of securing PHI are crying out for guidance.
"Because of the move toward electronic health records and the number of stakeholders that are now involved in handling our sensitive patient information, the PHI protectors are literally being outpaced in terms of their ability to protect our information," Kam says. "The magnitude and the frequency of healthcare breaches has increased rapidly because of the number of stakeholders and the move to electronic health records. These individuals need help."
One of the biggest ways they need help is in simply how to package PHI security issues in a way that makes sense to CEOs and CFOs. He and his co-authors found that these healthcare security initiatives are drastically underfunded and one of the main reasons is no one knows how to make a case for the cash.
"They basically put the CFO and the CEO to sleep because they're talking compliance, talking costs, and talking about things that are not that interesting to these executives," he said. "What we realized is we have to arm that chief privacy officer with the same tools and business case that speaks in investment language to help them enhance their business cases for things that would enhance privacy and security of protected health information."
Healthcare providers must collect all sorts of performance data to meet emerging standards. The new Pay For Performance issue of InformationWeek Healthcare delves into the huge task ahead. Also in this issue: Why personal health records have flopped. (Free registration required.)
Published: 2014-11-21 Multiple cross-site request forgery (CSRF) vulnerabilities in Huawei HiLink E3276 and E3236 TCPU before V200R002B470D13SP00C00 and WebUI before V100R007B100D03SP01C03, E5180s-22 before 21.270.21.00.00, and E586Bs-2 before 21.322.10.00.889 allow remote attackers to hijack the authentication of users ...
Published: 2014-11-21 Multiple SQL injection vulnerabilities in Dolibarr ERP/CRM before 3.6.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) contactid parameter in an addcontact action, (2) ligne parameter in a swapstatut action, or (3) project_ref parameter to projet/tasks/contact.php; (4...
Published: 2014-11-21 SQL injection vulnerability in Open-Xchange (OX) AppSuite before 7.4.2-rev36 and 7.6.x before 7.6.0-rev23 allows remote authenticated users to execute arbitrary SQL commands via a crafted jslob API call.
Published: 2014-11-21 The REXML parser in Ruby 1.9.x before 1.9.3 patchlevel 551, 2.0.x before 2.0.0 patchlevel 598, and 2.1.x before 2.1.5 allows remote attackers to cause a denial of service (CPU and memory consumption) a crafted XML document containing an empty string in an entity that is used in a large number of nes...
Published: 2014-11-21 Cross-site scripting (XSS) vulnerability in Guests/Boots in AdminCP in Moxi9 PHPFox before 4 Beta allows remote attackers to inject arbitrary web script or HTML via the User-Agent header.