It’s time for some New Year’s resolutions; and they have nothing to do with eating right, losing weight or exercising. Instead, they have everything to do with protecting against the
organizational and financial stresses of data breaches—which have become an everyday
disaster.
As noted in a post last month, the Third Annual Benchmark Study on Patient Privacy
& Data Security, reports
that data breaches in healthcare are growing; insider negligence is the root
cause; and mobile devices pose threats to patients’ protected health information (PHI). Despite the fact that 94 percent of
healthcare organizations surveyed suffered data breaches, data breaches don’t have to be disastrous if
organizations take steps to operationalize pre-breach and post-breach processes
to better protect patient data and minimize breach impact.
The results of this survey have lead to a few of us bing invited to share our recommendations
for a healthier organization in 2013 and beyond:
1. Establish
mobile device and Bring Your Own Device (BYOD) policies that include technical
controls and employee and management procedures.
Rick Kam, CIPP/US, president and co-founder, ID
Experts
2. Control the cloud or it'll
control you. Make it a point to fully understand what cloud service-level
agreements mean in practice and then push for meaningful information on
failover and disaster recovery practices used.”
Richard
Santalesa, senior counsel, InfoLawGroup LLP
3. Have a current breach response plan that is
ready and tested. This will help pave the way for a well-executed response that
can mitigate the financial, legal and reputational harm caused by a security
incident involving patient information.
Marcy Wilder, partner and director of global
privacy and information management practice, Hogan Lovellis
4. Conduct small but focused risk assessments rotating control review on a
monthly basis to continually understand and measure risk. Most importantly,
have a plan to address the risk, through remediation, mitigation or risk
transfer activities.
Chad Boeckmann, president and chief strategy officer, Secure Digital
Solutions, LLC
5.
Immunize mobile
devices against viruses that might steal patient data.
Dr. Larry Ponemon, chairman and
founder, Ponemon Institute
6.
Attack
your leadership team with phishing and other social engineering campaigns.
Nothing raises awareness like catching people and correcting them on the spot—and
it's a lot more interesting than the annual 30-minute online security training.
Michael
Boyd, Director of Information Security
Management, Providence Health &
Service
7. Use a checklist to evaluate periodically
whether covered entities and business associates are in compliance with all
privacy and security requirements. Sign and date the checklist to show that
your organization is not guilty of "willful neglect" in complying with
privacy and security laws.
Jim Pyles, founding partner, Powers, Pyles,
Sutter & Verville, P.C.
8.
Educate all staff to
recognize applications, mobile devices and medical equipment that collect,
contain or transmit patient information and/or biometric data; and train them
to communicate the risk to those responsible for information security
management.
Christina Thielst, FACHE,
Vice President, Tower
9. Decide how to handle the residual risk of a data breach, how
much risk to accept, and how much, if any, risk to transfer through cyber
insurance.
Christine Marciano, President, Cyber Data Risk Managers LLC
10.Boards should ensure
their organizations have robust, board-reviewed
and approved security policies and procedures.
Larry W. Walker,
president, The Walker Company
11.
"Big
data" is a source of both the disease and the cure for privacy and information security symptoms. Currently, we have
to deal with data minimization, but in
the future, look for applications that may collect broadly, but protect
against unauthorized disclosure or misuse very, very well.
Jon Neiditz, partner, Nelson Mullins Riley & Scarborough LLP
Rick Kam, president and co-founder of ID Expertis isn't a physician, but he believes “patient
information is at risk for infection” and “organizations need to make a commitment to a healthier organization
from top to bottom, otherwise a common cold data breach will turn into
tuberculosis.” I have to agree and in some respects it is just another HAI - hospital acquired infection.
Also, one more recommendation is in order.... be careful with #6. It could lead to a bit of personal risk -- otherwise known as a CLM or "career limiting move".
Social Media Tools