magazine

The growing threat
to the security of
our health data
By Brad Tritle, global product owner for Vitaphone
Health Solutions and co-founder of eHealth Nexus
Shutterstock © Syda Productions
For 2015, there are three areas of
health IT security (and privacy)
that I believe will be taken much
more seriously than in the past:
HIPAA training (an American law
that helps to guarantee security
of health data for patients),
role-based access and security
of mobile device applications.
Anyone who has worked at either
a HIPAA-covered entity or business
associate has undergone some form
of HIPAA training, and then signed an
agreement indicating that they have
been trained and will comply with
HIPAA, with intentional noncompliance
serving as cause for
release from employment.
When I served on The Office of the
National Coordinator’s Health
Information Security and Privacy
Collaborative (HISPC) several years
ago, we found that most healthcare
providers erred on the side of doing
more than HIPAA required from a
privacy perspective. Since that time,
however, security requirements (e.g,
HITECH) and associated threats have
increased. Meaningful Use (MU) has
both required performance of HIPAA
security audits for those wanting their
MU payments, and created a marketplace
where other organizations, such as
HIPAA Business Associates, can more
readily perform such audits. The result:
stronger security guidelines are being
put in place across the industry, and
employees will be required to not just
sit through a 30-minute video, but to
be thoroughly trained and tested on
specific employee requirements that
will facilitate the organization’s
HIPAA compliance.
Role-based access, or the ability for a
healthcare professional to have only
access to the protected health
information for which he is authorized
(e.g., a treating physician looking at the
record of the patient under their care),
is going to become more granular.
Many in-patient, ambulatory and payer
systems have facilitated a single user
having practical access to any patient
record on that system, regardless of
whether there was a reason for that
8 welivesecurity.com