How Healthcare Remains Insecure, and What One HIE Decided to Do About It
Exchanging patient data securely takes planning and effort.
|By: Tod Ferran|
The quick, easy, and digital exchange of patient data has rocketed the healthcare industry light-years into the future. Health Information Exchanges (HIEs), for example, allow healthcare providers within a geographic area to contribute and access electronic patient data, usually to and from a centrally managed data repository.
I’m sure you can see how this would increase quality through all stages of the healthcare process. Now, all providers are linked together and can see, share, and provide additional data to a patient’s clinical context, potentially improving the timeliness and accuracy of care decisions and avoiding duplicate procedures.
BUT, exchanging patient data in a secure fashion is more difficult than it seems.
Perhaps that is why The Ponemon Institute reported that 72% of providers aren’t confident in the security and privacy of patient data shared via HIEs.
Let’s discuss HIE members. HIEs can connect tens of thousands of healthcare providers. But if HIE members do not have secure controls in place and one is breached, the HIE connection between all providers could potentially become a path to your patient data.
HIE member security
Data exchange also has legal liabilities as well. If an HIE member is breached, they can be brought to court by fellow HIE members in a civil lawsuit.
SEE ALSO: The #1 Way to Help Your HIPAA Audits Go Faster
Some HIEs work hard to reinforce their systems against hackers, apply security best practices, and encourage each member’s individual data protections. Here’s a great example of one of them.
The Utah Health Information Network (UHIN) wanted to go further than just passing their OCR pilot audit with flying colors. To do that, they needed to get their members on board. They created a customized, already-paid-for member program that includes security consulting, a self-assessed risk analysis, external network vulnerability scans, and a breach protection checklist.
This is a great example of an HIE protecting and bringing their members to the next level of security. Now….what’s your HIE doing?
Our advice for HIE members
At the speed the healthcare industry is going, data exchange will continue to outpace security.But for those who truly wish to avoid a devastating data breach, ensure your HIE partner has the expertise, resources, and implemented safeguards to secure your patient data, no matter who it is exchanged with.
If you’re not sure what your HIE should be doing, have a look at ONC’s health IT security resources. They discuss security from the standpoint of an EHR user, but some of the same best practices should be followed by HIEs – such as encrypting all data maintained by the HIE, safeguarding its computer network with a firewall, and protecting its employee workstations with passwords and anti-virus software.
Find out what your HIE is doing for security. Challenge them on it. If you’re not satisfied, it’s time to go shopping.
Did this post help you? If so, please share!
Tod Ferran (CISSP, QSA) is a Mensa aficionado, Cancun expert, and Security Analyst for SecurityMetrics with over 25 years of IT security experience. In addition to his many speaking engagements and webinars, he provides security consulting, risk analysis assistance, risk management plan support, and performs security, HIPAA, and PCI compliance audits. Connect with him for recommendations on excellent places to stay, activities, and restaurants in Cancun, or check out his other blog posts here.