How important is a patient's privacy? If your organization is a health care facility, the instinctive answer that comes to mind is "Very important!" After all, a patient's privacy is the basis upon which a doctor/patient relationship is based. Right?
When it comes to patient data, the real answer may surprise you. According to a study released by the Ponemon Institute, "Patient data is being unknowingly exposed until the patients themselves detect the breach."
Entitled "Benchmark Study on Patient Privacy and Data Security," the independent study examined the privacy and data protection policies of 65 health care organizations in accordance with the mandated Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009. HITECH requires health care providers to provide stronger safeguards for patient data and to notify patients when their information has been breached.
According to the study, 70% of hospitals say that protecting patient data is not a top priority. Billing information and medical records are not being protected and are considered most at risk. More significantly, there is little to no oversight of the data itself. Patients are often the first to detect breaches and end up notifying the health care facility themselves.
The study reports that most health care organizations do not have the staff or the technology to adequately protect their patients' information. The majority (67%) say that they have fewer than two staff members dedicated to data protection management.
And perhaps because of this lack of resources, 60% of organizations in the study had more than two data breaches in the past two years, at a cost of almost $2M per organization. The estimated cost per year to our health care systems is over $6B.
Why is this happening?
HITECH encourages health care organizations to move to Electronic Health Records (EHR) systems to help better secure patient data. And, indeed, the majority of those organizations in the studies (89%) said they have either fully implemented or planned soon to fully implement EHR. Yet the HITECH regulations to date do not seem to have diminished security breaches at all, as the Ponemon Institute's study provides a sobering evaluation:
Despite the intent of HITECH rules, the majority (71%) of respondents do not believe these new federal regulations have significantly changed the management practices of patient records.
According to the report, the primary causes of data loss or theft were unintentional employee action (52%), lost or stolen computing device (41%), and third-party mistakes (34%).
It would seem, with the use of EHR systems, that technologies should be deployed to assist in these unintentional breaches. And while 85% believe they do comply with the loose legal privacy requirements of HIPAA, only 10% are confident that they are able to protect patient information when used by outsourcers and cloud computing providers. More significantly, a mere 23% of respondents believed they were capable of curtailing physical access to data storage devices and severs.
The study lists 20 commonly used technology methodologies encouraged by HITECH and deployed by these institutions, including firewalls, intrusion prevention systems, monitoring systems, and encryption. The confidence these institutions feel in these technologies are also listed, with firewalls as the top choice for both data breach prevention and compliance with HIPAA. Also popular for accomplishing both are access governance systems and privileged user management. Respondents favor anti-virus and anti-malware for data breach prevention. For compliance with HIPAA, they favor encryption for data at rest.
The study points to the value of encryption technologies for compliance purposes and the prevention of unintended disclosure. This value is perceived as particularly high by those who participated in the study: 72% see it as a necessary technology for compliance, even though only 60% currently deploy it for data breach prevention. These identified needs for encryption falls just behind the use of firewalls and the requirements of access governance.
Encryption for data at-rest is one of the key technologies that HITECH specifically identifies. An encrypted file can not be accidentally examined without the appropriate credentials. In addition, some encryption packages, like Crypto Complete, monitor and record when and by whom data has been examined. These safeguards permit IT security to audit the use of data to ensure that if a intrusion breach occurs, the scope and seriousness of the breach can be assessed quickly and confidently.
So how important is a patient's privacy? We believe it's vitally important. And this report from the Ponemon Institute should make good reading to help your organization understand and identify the growing epidemic of security breaches.
It might be time to secure your file transfers with a managed file transfer solution. See how Bristol Hospital uses GoAnywhere Managed File Transfer to streamline and encrypt their files, protect patient data, and meet several HIPAA and HITECH requirements.