News | February 19, 2014

2013 HIMSS Security Survey Shows Progress, Remaining Concerns

HIMSS 2013 Security Survey Information Technology Cardiac PACS

February 19, 2014 — Results of the 2013 HIMSS Security Survey show progress toward hardened security and use of analytics, but more work is needed to mitigate insider threat, such as inappropriate access of data by employees. Federal initiatives such as OCR audits, Meaningful Use (MU) and the HIPAA Omnibus Rule encourage healthcare organizations to increase the budgets and resources dedicated to securing patient health data. However, over the past year, 19 percent of respondents reported a security breach. Additionally, 12 percent of organizations have had at least one known case of medical identity theft reported by a patient.

The 2013 HIMSS Security Survey is supported by the Medical Group Management Association and underwritten by Experian Data Breach Resolution. It profiles the data security experiences of 283 information technology (IT) and security professionals employed by U.S. hospitals and physician practices. The data from respondents suggests the greatest perceived “threat motivator” is of healthcare workers potentially looking at electronic health information of friends, neighbors, spouses or co-workers.

There has been a response to the risk of security breach via inappropriate data access by insiders. Efforts include increased use of several technologies related to employee access to patient data, such as user access control and audit logs of each access to patient health records. 

More than half of the survey’s respondents (51 percent) have increased their security budgets in the past year. Still, 49 percent of these organizations are still spending 3 percent or less of their overall IT budget on security initiatives that will secure patient data.

“Though progress is noticeable, it is critical that healthcare organizations put in place a comprehensive plan that addresses potential security threats – whether internal or external — to prevent electronic health data breaches and minimize the impact of a breach should one occur,” said Michael Bruemmer, vice president for Experian Data Breach Resolution.

Other findings from the survey include: 

  • 92 percent of organizations conduct a formal risk analysis
  • 54 percent of organizations report having a tested data breach response plan and 63 percent of these organizations test their plan annually
  • 93 percent of organizations indicate their organization is collecting and analyzing data from audit logs
  • Healthcare organizations are using multiple means of controlling employee access to patient information; 67 percent of survey respondents use at least two mechanisms, such as user-based and role-based controls, for controlling access to data

 

The survey also identifies barriers to improving an organization’s security posture included budget, dedicated leadership and the following: 

  • Organizations reported an average score of 4.35 regarding the maturity of the security environment (where 1 is not at all mature and 7 is highly mature).
  • Nearly half (49 percent) of the survey’s responding organizations are still spending 3 percent or less of their overall IT budget on security initiatives that will secure patient data.
  • 52 percent of the hospital-based respondents reported that they had a CSO, CISO or other full-time leader in charge of security of patient data.

 

For more information: www.himss.org, www.experian.com

Related Content

RamSoft Reaches Distribution Agreement With Medical Equipment Dynamics
News | PACS | September 21, 2017
September 21, 2017 — Medical Equipment Dynamics, provider of new, used and refurbished medical equipment, will now of
ScImage and Invia Partnership Announced
News | PACS | September 19, 2017
ScImage Inc. and Invia Imaging Solutions recently announced formation of a joint partnership at the American Society of...
The Endless Possibilities Created by a Cross-Enterprise Workflow
Sponsored Content | Case Study | Cross-enterprise Imaging | September 19, 2017
Located in Fort Collins, Colo., Advanced Medical Imaging Consultants (AMIC) is the exclusive medical imaging provider
Telemis Supplying Complete PACS to French Radiology Group
News | PACS | September 18, 2017
Telemis announced that the Groupement Radiologues Associés (GRA) in Bordeaux, France, chose Telemis's picture archiving...
News | PACS | September 13, 2017
Nuance Communications Inc. announced that Citizens Medical Center, a critical access hospital in rural Kansas, has...
Fujifilm Secures DIN-PACS IV Contract From U.S. Department of Defense
News | Enterprise Imaging | September 12, 2017
September 12, 2017 — Fujifilm Medical Systems U.S.A.
Fujifilm Brings Synapse Enterprise Imaging Solutions to Seven Healthcare Systems
News | Enterprise Imaging | August 31, 2017
Fujifilm Medical Systems U.S.A. Inc. was recently designated the enterprise imaging partner of choice for several...
Nine U.S. Health Systems Choose Nuance to Improve Radiology Reporting
News | PACS Accessories | August 30, 2017
Nuance Communications Inc. announced that nine U.S. healthcare organizations have recently chosen Nuance solutions to...
Rayence Launches New Cloud PACS Product Across South Carolina IDN
News | PACS | August 28, 2017
August 28, 2017 — Rayence Inc.
ScImage Awarded U.S. Government DIN-PACS IV Contract
News | PACS | August 16, 2017
ScImage Inc. was recently awarded a new DIN-PACS IV (Digital Imaging Network/Picture Archiving and Communications...
Overlay Init