Medical Data Breaches Put Patients at Risk
Despite HIPAA, hospitals leave patient data unprotected; one CIO offers tips for getting IT security funding
CIO — Doctors can't cure the common cold and health care IT managers apparently can't stop the common data breach.
Twenty-one of the 101 of the breaches tracked so far this year by information security group Attrition.org occurred at health care organizations.
For example, insurer WellPoint said in early April that lax security on two servers run for it by a vendor likely exposed on the Internet some personal and medical data for 128,000 patients.
Also in April, New York Presbyterian Hospital notified 40,000 patients that their personal information, including names, phone numbers and some Social Security numbers, were stolen, possibly by a hospital employee. A federal investigation and internal audit are underway.
Whether on paper, as so many medical records remain, or electronic, health care data must be protected according to state and federal regulations. But just because health care staff say they know the rules doesn't mean that information is safe, concludes a new survey from the Healthcare Information and Management Systems Society (HIMSS), a nonprofit professional group for IT managers. The group, with security consulting firm Kroll, polled 263 chief security officers and managers of IT and of health care information.
For example, 75 percent of respondents gave themselves the highest rank possible when it comes to familiarity with HIPAA: 7, on a scale of 1 to 7. The Health Information Portability and Accountability Act, or HIPAA, governs whether and how patient data may be seen and by whom.
HIPAA compliance proves difficult in itself for the organizations that must follow those rules. Early this year, the National Institutes of Health had a laptop stolen, containing patient's private information, from an employee's car. In January, Fallon Community Health Plan announced a laptop being used by one of its vendors was stolen and it, too, contained patient data. In reporting those incidents to the public, each said how they "regret" the thefts. While these organizations offered credit monitoring to affected patients, many companies leave identify theft victims to fend for themselves.
What It Takes to Follow Through on Security Rules
Getting employees and contract vendors to follow corporate security policies requires cajoling and sometimes a bit of drama, says John Hummel, chief technology officer at Perot Systems' health care services group. Hummel has also been CIO at Sutter Health> and at the organization that oversees health care in California's state prison system.
