Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

11/11/2009
03:10 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

Survey: Healthcare Companies Not Ready For New Privacy And Security Regulations

Crowe Horwath LLP and Ponemon Institute release findings on HITECH compliance readiness

OAK BROOK, Ill. (Nov. 11, 2009)—A recent survey of healthcare organizations found that 94 percent believe they are not ready to comply with the privacy and security provision of the Health Information Technology for Economic and Clinical Health (HITECH) Act. The new provisions take effect in February. The survey of 77 U.S. healthcare organizations was conducted by the Ponemon Institute and sponsored by Crowe Horwath LLP, one of the largest public accounting and consulting firms in the U.S.

The HITECH Act extends the Health Insurance Portability & Accountability Act's (HIPAA) rules for security and privacy safeguards, including increased enforcement, penalties and audits. According to the survey, many current HIPAA compliance programs have deficiencies in the areas of privacy and security, including inadequate program testing and failure to update the programs. Yet only 47 percent of the respondents feel they have the necessary funding and resources to fully comply with the new regulations.

"We believe that most organizations are not ready for HITECH as a result of compliance issues within their existing HIPAA programs," said Raj Chaudhary, a principal in Crowe Horwath's risk consulting group. "Even though most organizations acknowledge that their HIPAA compliance programs are deficient, our survey found that implementing necessary controls or securing third-party assistance to help ensure compliance may be limited due to budgetary restraints."

The study also found that 79 percent of organizations do not regularly have the required independent assessment or audit of their program to determine adequacy. Fifty-seven percent say they have known deficiencies concerning privacy or security, or both. Only 29 percent of respondents report no deficiencies.

Other survey findings include:

  • Most organizations experienced one or more data breach incidents involving the loss or theft of protected health information during the past two years. Ninety percent of respondents had a breach involving at least one protected health record.

  • Lack of management support may slow down compliance goals. Fifty-five percent of respondents report there is no management support for HITECH compliance.

  • Many organizations report significant gaps in their privacy and security programs. Sixty percent say their organizations have only partially implemented a risk-based program for protecting the privacy of protected health information (PHI). Approximately half of respondents say they do not provide adequate staff training for privacy and security. Forty-five percent believe their organizations have not effectively developed a privacy policy that clearly summarizes appropriate use and sharing of PHI.

  • Third-party assistance may be necessary for achieving certain compliance goals. Nearly half of all respondents said they may need assistance from a third party to conduct a detailed risk assessment. Forty-five percent need outside support for staff training, while 42 percent will need assistance in implementing procedures for fielding complaints. Thirty-nine percent will rely on help in developing the privacy program.

  • Responsibility for ensuring HITECH compliance varies considerably among organizations. Security leaders and chief compliance officers are the roles identified as most likely to be responsible for achieving HITECH compliance, according to respondents. Organizations with more than 5,000 employees were much more likely to see the security leader as having primary responsibility than smaller companies.

    "It is disappointing, though not surprising, to learn that a majority of companies do not believe they are prepared for the latest in healthcare information security regulations," said Dr. Larry Ponemon, chairman and founder, Ponemon Institute. "Our research consistently finds that a lack of budgetary and moral support from the executive suite is a common barrier to proper data security and management programs, even with the specter of regulatory enforcement looming."

    For more information about the survey findings, please visit http://www.crowehorwath.com/benchmark. Crowe Horwath and the Ponemon Institute will also be discussing the findings during a one-hour webinar on Nov. 17 at noon EST. To register, please visit https://www323.livemeeting.com/lrs/8000074673/Registration.aspx?pageName=2923nt1w90s8tc38.

    About the survey

    Respondents were categorized by HIPAA classifications of covered entities and business associates. Of the 77 respondents, 45 were covered entities, which have to comply with the new regulations, including private and public healthcare providers and healthcare insurance companies. Thirty-two respondents were business associates, which include companies who handle patient data, such as professional services firms, pharmacies and public health care vendors. The largest number of respondents came from organizations with up to 1,000 full-time employees (37 percent), followed by those with 1,001 to 10,000 full-time employees (35 percent) and those with more than 10,000 full-time employees (28 percent). The most common job titles of those completing the survey were chief security officer, chief risk officer and IT manager.

    About Crowe Horwath

    Crowe Horwath LLP (www.crowehorwath.com) is one of the largest public accounting and consulting firms in the United States. Under its core purpose of "Building Value with Values'," Crowe assists public and private company clients in reaching their goals through audit, tax, risk and consulting services. With 25 offices and 2,500 personnel, Crowe is recognized by many organizations as one of the country's best places to work. Crowe serves clients worldwide as an independent member of Crowe Horwath International, one of the largest networks in the world, consisting of more than 140 independent accounting and management consulting firms with offices in more than 400 cities around the world.

    About the Ponemon Institute

    The Ponemon Institute is dedicated to advancing responsible information and privacy management practices in business and government. To achieve this objective, the Institute conducts independent research, educates leaders from the private and public sectors, and verifies the privacy and data protection practices of organizations in a variety of industries.

    Comment  | 
    Print  | 
    More Insights
  • Comments
    Newest First  |  Oldest First  |  Threaded View
    Where Businesses Waste Endpoint Security Budgets
    Kelly Sheridan, Staff Editor, Dark Reading,  7/15/2019
    US Mayors Commit to Just Saying No to Ransomware
    Robert Lemos, Contributing Writer,  7/16/2019
    Register for Dark Reading Newsletters
    White Papers
    Video
    Cartoon Contest
    Write a Caption, Win a Starbucks Card! Click Here
    Latest Comment: Now this is the worst micromanagment I've seen.
    Current Issue
    Building and Managing an IT Security Operations Program
    As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
    Flash Poll
    The State of IT Operations and Cybersecurity Operations
    The State of IT Operations and Cybersecurity Operations
    Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
    Twitter Feed
    Dark Reading - Bug Report
    Bug Report
    Enterprise Vulnerabilities
    From DHS/US-CERT's National Vulnerability Database
    CVE-2018-17210
    PUBLISHED: 2019-07-20
    An issue was discovered in PrinterOn Central Print Services (CPS) through 4.1.4. The core components that create and launch a print job do not perform complete verification of the session cookie that is supplied to them. As a result, an attacker with guest/pseudo-guest level permissions can bypass t...
    CVE-2019-12934
    PUBLISHED: 2019-07-20
    An issue was discovered in the wp-code-highlightjs plugin through 0.6.2 for WordPress. wp-admin/options-general.php?page=wp-code-highlight-js allows CSRF, as demonstrated by an XSS payload in the hljs_additional_css parameter.
    CVE-2019-9229
    PUBLISHED: 2019-07-20
    An issue was discovered on AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware versions F7.20A to F7.20A.251. An internal interface exposed to the link-local address 169.254.254.253 allows attackers in the local network to access multiple quagga VTYs. Attackers can...
    CVE-2019-12815
    PUBLISHED: 2019-07-19
    An arbitrary file copy vulnerability in mod_copy in ProFTPD up to 1.3.5b allows for remote code execution and information disclosure without authentication, a related issue to CVE-2015-3306.
    CVE-2019-13569
    PUBLISHED: 2019-07-19
    A SQL injection vulnerability exists in the Icegram Email Subscribers & Newsletters plugin through 4.1.7 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system.