The HITECH Act extends the Health Insurance Portability & Accountability Act's (HIPAA) rules for security and privacy safeguards, including increased enforcement, penalties and audits. According to the survey, many current HIPAA compliance programs have deficiencies in the areas of privacy and security, including inadequate program testing and failure to update the programs. Yet only 47 percent of the respondents feel they have the necessary funding and resources to fully comply with the new regulations.
"We believe that most organizations are not ready for HITECH as a result of compliance issues within their existing HIPAA programs," said Raj Chaudhary, a principal in Crowe Horwath's risk consulting group. "Even though most organizations acknowledge that their HIPAA compliance programs are deficient, our survey found that implementing necessary controls or securing third-party assistance to help ensure compliance may be limited due to budgetary restraints."
The study also found that 79 percent of organizations do not regularly have the required independent assessment or audit of their program to determine adequacy. Fifty-seven percent say they have known deficiencies concerning privacy or security, or both. Only 29 percent of respondents report no deficiencies.
Other survey findings include:
"It is disappointing, though not surprising, to learn that a majority of companies do not believe they are prepared for the latest in healthcare information security regulations," said Dr. Larry Ponemon, chairman and founder, Ponemon Institute. "Our research consistently finds that a lack of budgetary and moral support from the executive suite is a common barrier to proper data security and management programs, even with the specter of regulatory enforcement looming."
For more information about the survey findings, please visit http://www.crowehorwath.com/benchmark. Crowe Horwath and the Ponemon Institute will also be discussing the findings during a one-hour webinar on Nov. 17 at noon EST. To register, please visit https://www323.livemeeting.com/lrs/8000074673/Registration.aspx?pageName=2923nt1w90s8tc38.
About the survey
Respondents were categorized by HIPAA classifications of covered entities and business associates. Of the 77 respondents, 45 were covered entities, which have to comply with the new regulations, including private and public healthcare providers and healthcare insurance companies. Thirty-two respondents were business associates, which include companies who handle patient data, such as professional services firms, pharmacies and public health care vendors. The largest number of respondents came from organizations with up to 1,000 full-time employees (37 percent), followed by those with 1,001 to 10,000 full-time employees (35 percent) and those with more than 10,000 full-time employees (28 percent). The most common job titles of those completing the survey were chief security officer, chief risk officer and IT manager.
About Crowe Horwath
Crowe Horwath LLP (www.crowehorwath.com) is one of the largest public accounting and consulting firms in the United States. Under its core purpose of "Building Value with Values'," Crowe assists public and private company clients in reaching their goals through audit, tax, risk and consulting services. With 25 offices and 2,500 personnel, Crowe is recognized by many organizations as one of the country's best places to work. Crowe serves clients worldwide as an independent member of Crowe Horwath International, one of the largest networks in the world, consisting of more than 140 independent accounting and management consulting firms with offices in more than 400 cities around the world.
About the Ponemon Institute
The Ponemon Institute is dedicated to advancing responsible information and privacy management practices in business and government. To achieve this objective, the Institute conducts independent research, educates leaders from the private and public sectors, and verifies the privacy and data protection practices of organizations in a variety of industries.