Healthcare Providers Face Security Challenges

Many healthcare organizations are unprepared for new federal regulations and other security challenges, according to a study. Security budgets are low, organizations don't have response plans for threats or a security breach, and a designated chief security officer isn't in place.

The Health Information Technology for Economic and Clinical Health Act (HITECH) provisions of the U.S. American Recovery and Reinvestment Act (ARRA) of 2009 includes new regulations for maintaining privacy and security of patient health data, but healthcare providers aren't ready, according to the results of the 2009 Security Survey from the Healthcare Information and Management Systems Society, sponsored by Symantec.

The survey, which questioned healthcare IT and security professionals, found that three quarters of organizations that conduct formal risk assessments found patient data at risk due to inadequate security controls, policies, and processes.

Three-quarters of surveyed organizations conduct formal risk analyses, but only half of those do so on a yearly basis or more frequently. The figure has remained the same in the past year. "Conducting this analysis positions organizations to identify gaps in their security controls and/or policies and procedures," HIMSS said.

"One-third of respondents reported that their organization has had at least one known case of medical identity theft at their organization. Only a handful of these organizations, however, has experienced direct consequences from the breach," HIMSS said.

Healthcare organizations aren't using current security technologies, the study found. Respondents widely use logs from firewalls, applications, and servers as information sources, yet only 25% of respondents reported electronic analysis of the data. While respondents use firewalls and user access controls, only 67% of responding organizations use encryption, and half encrypt stored data.

About 60% of respondents reported their organization spends 3% or less of their organization's IT budget on information security, consistent with the level of spending identified in 2008. Respondents described their environments at a middle rate of maturity, with an average score of 4.27 on a scale where 7 is the most mature. Fewer than half of respondents said their organizations have a formally designated chief information security officer or chief security officer.

Nearly all respondents said their organizations actively work to determine the cause and origin of security breaches. But only half have a plan for responding to threats or incidents related to security breaches, the study said.

Nearly all respondents said their organizations share patient data electronically, mostly with state government entities. Organizations are also likely to share data in the future with Health Information Exchanges and Regional Health Information Organizations (two types of organizations for disseminating e-health records, mandated by ARRA).

A little less than half of these organizations, 41%, "indicated that these sharing arrangements have resulted in the use of additional security controls beyond those that were already in place at their organizations. This is consistent with the data reported in the 2008 survey," HIMSS said.

E-mail encryption and single sign-on were the security technologies not present in organizations that were most likely to be installed in the future, according to the report.

For Further Reading:

Why Your Next IT Job Will Be In Healthcare

Healthcare IT Career Tips

Blue Cross of Northeast Pennsylvania, the University of Louisville School of Medicine, and a range of large and small healthcare providers are using mobile apps to improve care and help patients manage their health. Find out how. Download the report here (registration required).br