Meaningful Use a Higher Priority to Medical Practices Than Privacy and Security

Published on Healthcare IT News (http://www.healthcareitnews.com/)

Home > Privacy, security not as high-priority as meeting meaningful use

---

Privacy, security not as high-priority as meeting meaningful use

By Patty Enrado, Special Projects Editor

Created 10/07/2011

 

SAN FRANCISCO – Eighty percent of respondents to a March 2011 Healthcare IT News survey of hospital and health system IT professionals cited compliance as the highest expectation of achieving meaningful use. Only 38 percent, however, are in the process of enterprise-wide adoption of secure EHRs.
The survey results confirm what Oracle and Deloitte, who commissioned the survey, are seeing in the marketplace, attendees were told at a healthcare session at Oracle OpenWorld Conference on Wednesday.
While meaningful use is very important, privacy and security are down on the priority list, partly as a result of limited resources and competing requirements, said Russell Jones, partner at Deloitte & Touche LLP, in the session “Secure EHRs: Achieving ‘Meaningful Use’ Compliance and Preventing Data Theft and Fraud.”
[See also: Privacy concerns accompany push for EMRs.]
With the Department of Health and Human Services "serious about enforcement" – HHS has engaged a Big 4 auditor to conduct up to 150 HIPAA security and privacy audits between now and the end of 2012 – Jones says hospitals and health systems need to deploy a set of controls that are robust and at the same time flexible and don’t impede physician workflow.
Jones recommended healthcare organizations take a framework approach to securing EHRs. Kaiser, Baylor Health Systems and a number of other healthcare organizations came together in a collaboration with HITRUST and developed the CSF for the healthcare industry a couple of years ago. Hospitals and health systems need to protect electronic personal health information (PHI) and PHI outside the EHR, said Jones. Finding a solution that can be implemented and tested once that can satisfy many requirements is ideal, he said.
“Meaningful use should not be a siloed approach,” said Jones. Security should be a line item in the meaningful use initiative. “Being compliant doesn’t mean you’re secure,” he added. “You’re going to need technology solutions that are data centric.”
[See also: Meaningful use top priority for healthcare executives.]
Reid Oakes, senior director of healthcare technology for Oracle, noted that technology solutions should look across the entire enterprise within the integrated framework approach. Once hospitals and health systems determine what they are trying to secure and where it is, they need to build, from the top down, a data map that encompasses business and clinical processes, and then deploy the technology.
Oakes took a deep dive into the various types of solutions for protecting data, including database security, identity management and information rights management to the data. An information rights management solution, for example, should be able to provide document-level access control, as well as provide control on the policy level to be able to de-identify the data, he said.
“You have to secure data in the right places and dynamically manage access,” Oakes said. “You have to look at security as a constant iterative process.”

---

Source URL: http://www.healthcareitnews.com/news/privacy-security-not-high-priority-meeting-meaningful-use

Links:
[1] http://www.healthcareitnews.com/news/privacy-concerns-accompany-push-emrs
[2] http://www.healthcareitnews.com/news/meaningful-use-top-priority-healthcare-executives

Verizon Security Tools for EHR's

Published on Healthcare IT News (http://www.healthcareitnews.com/)

Home > Verizon offers security tools for EHRs, HIEs, eRx

---

Verizon offers security tools for EHRs, HIEs, eRx

By Mike Miliard, Managing Editor

Created 09/29/2011

 

NEW YORK – When it comes to security and credentialing, healthcare is "one of the most heavily-regulated industries," says Tracy Hulver, director of identity marketing in the Security Innovation Group at Verizon Business.

At the same time, however, it can be one where people are "the least technology-savvy, in a lot of cases," he says. Compound that situation with tight budgets for IT and security, and the result is a “tremendous challenge."

But that's no excuse, as Mac McMillan, chair of the HIMSS Privacy & Security Policy Task Force, told Healthcare IT News recently. "It's not that it’s too complicated. It’s just a matter of really figuring out how to do it.

"Providers do not see security as an imperative yet," he added. "That’s not across the board, obviously. There are some folks out there who are actually getting it and trying to do a good job. And they’re making the investment, and I think they’re seeing the benefit of doing that now. But that’s not the majority."

With its revamped Universal Identity Services platform for healthcare, Verizon hopes to reach that majority, offering economical and easy-to-use applications that takes on proofing, credentialing and authentication duties – both at the user level and at the transaction level – for cash-strapped providers.

Verizon's managed identity services, delivered via the cloud through its Terremark IT services delivery subsidiary, now supports additional standards for accessing EHRs and health information exchanges, as well as credentials for e-prescribing, including prescriptions for controlled substances.

The enhanced services deliver legally binding digital signature capabilities, enabling healthcare providers to digitally sign patient health information – such as treatment plans, electronic prescriptions, laboratory reports and discharge orders – with strong user authentication and security protections. Other digitally signed documents that can be securely shared include filings to government agencies and official communications with contractors and business partners.

Moreover, officials tout Verizon's new ID Message Center, through which users can easily monitor and track their digital signature activities with a convenient mobile application or optional Web-based portal.

The updated package also allows providers to use their smartphones and tablets to authenticate their identity to gain access to these new capabilities.

"Because it's a managed service, the organization does not have to manage a lot of costs like infrastructure or administrative overhead," says Hulver. "It's a very economical solution."

Verizon's services pass muster with federal regulations from agencies such as the Drug Enforcement Administration and Food and Drug Administration – CFR-1311, a set of guidelines from the DEA, regulates the use of e-prescribing for controlled substances, for example. CFR-21 Part 11, from the FDA, provides digital signature guidelines for the submission of electronic records.

This past June, Verizon announced that the service supports the SAFE-BioPharma standard, the only life science digital standard that offers interoperability with government agencies, such as the FDA and the European Medicines Agency. Additionally, say officials, its healthcare identity platform incorporates the standards established by the Initiative for Open Authentication, an industry group working toward an open, standards-based system to support multi-factor identity credentials.

"Securely and quickly authenticating the digital identity of healthcare professionals is a key foundational element supporting the electronic exchange of healthcare information," adds Peter Tippett, vice president of industry and security solutions, Verizon. "By streamlining and strengthening the issuance of health identities, our newly enhanced universal identity service for healthcare will help boost widespread adoption and act as a catalyst for further transformation of the U.S. healthcare delivery system."

The multi-factored credentials delivered by Verizon's service are designed to meet the Level 3 authentication requirements created by the National Institute of Standards and Technology (NIST), the federal agency that works with industry to develop and apply technology, measurements and standards. The credentials also help enable U.S. healthcare professionals to meet federal meaningful use requirements contained in the HITECH Act.

"Ten years ago, before all this information about 'the cloud,' people were certainly apt to outsource applications," says Hulver, "but the security element is something they really wanted to hold on to as long as possible."

Nowadays, with the threat level increasing – and the penalties for breaches doing the same – the situation has changed. But that doesn't mean, of course, that getting more money from the CFO for security is any easier, he adds.

More and more providers are looking for ways to meet these stringent regulations with the budgets they have, says Hulver. "Outsourcing elements of security is something people are starting to look at as a valid alternative."

---

Source URL: http://www.healthcareitnews.com/news/verizon-offers-security-tools-ehrs-hies-erx

Links:
[1] http://www.healthcareitnews.com/issue/34897

Health IT News.....

Published on Healthcare IT News (http://www.healthcareitnews.com/)

Home > PwC: Health industry under-prepared to protect privacy

---

PwC: Health industry under-prepared to protect privacy

By Mike Miliard, Managing Editor

Created 09/22/2011

NEW YORK – Most health organizations are under-prepared to protect patient privacy and secure personal health information as new uses for digital health data emerge and access to confidential patient information expands, according to a new report from PwC's Health Research Institute.
Old privacy and security controls no longer suffice to comply with existing privacy laws and patient consent agreements, say to PwC officials – who emphasize that health organizations need to update practices and adopt a more integrated approach to ensure that patient information doesn't fall into the wrong hands.
The report, titled "Old data learns new tricks: Managing patient privacy and security on a new data-sharing playground," shows how existing privacy and security controls have not kept pace with new realities in healthcare: increased access to information in electronic health records; greater data collaboration with external partners and business associations; the emergence of new uses for digital health information to improve the quality and cost of care; and the rise of social media and mobile technology to better and more efficiently manage patient health.
A recent nationwide PwC Health Research Institute survey of 600 executives from US hospitals and physician organizations, health insurers, and pharmaceutical and life sciences companies found:

• Theft accounted for 66 percent of total reported health data breaches over the past two years. Also, medical identity theft appears to be on the rise. Over one third (36 percent) of provider organizations (hospitals and physician groups) confirmed that they have experienced patients seeking services using somebody else's name and identification.
• More than half (55 percent) of health organizations surveyed have not addressed privacy and security issues associated with the use of mobile devices, and less than one-quarter have addressed privacy and security implications of social media.
• More than half (54 percent) of health organizations surveyed reported at least one issue with information privacy and security over the past two years.
• The most frequently reported issue among providers was the improper use of protected health information by an internal party. Over the past two years, 40 percent of providers reported an incident of improper internal use of protected health information.
• The most frequently reported issue among health insurers and pharmaceutical and life science companies was the improper transfer of files containing personal health information to unauthorized parties. Over the past two years, one in five (21 percent) pharmaceutical and life sciences companies and one in four (25 percent) of health insurers improperly transferred files containing protected health information.

"Although paper-based health information breaches must now be disclosed under the breach notification provision under the HITECH Act, electronic data breaches occur three times more frequently and affect 25 times more people when they occur," said James Koenig, director and co-leader, Health Information Privacy and Security Practice, PwC. "Most breaches are not the result of IT hackers, but rather reflect the increase in the risks of the knowledgeable insider related to identity theft and simple human error - loss of a computer or device, lack of knowledge or unintended unauthorized disclosure."
Continued on next page.
A culture of confidentiality
PwC's research found considerable concern for the "knowledgeable insider." On average, improper use of personal health information by an internal party was the leading privacy/security issue experienced by healthcare organizations over the last two years. Because of lack of awareness or training, breaches can result easily and with greater probability from mishandling of paper documents, people talking in the elevator, or comments made via social media channels. In addition, risks of data breaches and the complexity of consent agreements rises when information is shared with business associates, the source of more than half of reported health data breaches affecting more than 11 million people since 2009.
PwC's survey found:

• More than half of healthcare organizations allow access to social networking while at work; less than half have a policy covering the use of social media outside of work.
• Less than half (37 percent) of health organizations surveyed incorporate approved uses of mobile devices and social media as part of company privacy training.
• Only 58 percent of providers and 41 percent of health insurers say they include the appropriate use of electronic health records (EHR) as part of employee privacy training.
• Only 36 percent of health organizations perform a pre-contract assessment of their business associates such as business partners and vendors, and just 26 percent conduct post-contract compliance assessments.

Opportunities and risks
Digitized health data is becoming one of the most highly valued assets in the health industry, and, according to PwC, all kinds of organizations are now converging around the shared use of the information to enable new care delivery models such as accountable care organizations, outcomes-based reimbursement and the advance of wellness, preventive and personalized care.
Organizations also are discovering the potential in secondary uses of the information beyond treating patients, such as in clinical studies, post-market surveillance of drugs and the development of new products and services to better understand patient health and behaviors. Yet PwC found that while many organizations are sharing information, the complexity of consent further increases and few organizations have established proper restrictions and consent agreements to control proper access. PwC's research found that:

• Only 17 percent of providers, 19 percent of payers and 22 percent of pharmaceutical/life sciences companies have a process in place to manage patients' consent for how their information can be used.
• Nearly three quarters (74 percent) of healthcare organizations surveyed said they already do or intend to seek secondary uses for health data; however, less than half have addressed or are in the process of addressing related privacy and security issues.
• Sixty-one percent of pharmaceutical and life sciences companies, 40 percent of health insurers and 38 percent of providers currently share information externally. Of those organizations that share data externally, only two in five pharmaceutical and life sciences companies (43 percent) and one in four insurers (25 percent) and providers (26 percent) have identified contractual, policy or legal restrictions on how the data can be used.

A new approach
PwC's research found that the recent increase in breach enforcement actions have prompted health organizations to focus more on privacy and security, and that there is growing recognition of privacy and security compliance as central to maintaining a trusted brand.
"To protect patient trust and their own brand reputation, organizations need to go beyond minimum regulatory requirements and adopt an integrated approach that combines privacy, security and compliance within a culture where all employees see themselves as champions of confidentiality and where privacy is part of the patient experience," said Peter Harries, principal and co-leader, Health Information Privacy and Security Practice, PwC.
Organizations with integrated approaches to privacy and security say they have realized the benefits, including a significant increase in data security and a slight decrease in the number of privacy/security issues, depending on the extent of their integration. PwC found that health insurers were more likely than providers and pharmaceutical/life sciences companies to have integrated their approach to a great extent.
A full copy of PwC's report can be found here.

---

Source URL: http://www.healthcareitnews.com/news/pwc-health-industry-under-prepared-protect-privacy

Links:
[1] http://www.pwc.com/us/HITprivacysecurity