News | February 19, 2014

2013 HIMSS Security Survey Shows Progress, Remaining Concerns

HIMSS 2013 Security Survey Information Technology Cardiac PACS

February 19, 2014 — Results of the 2013 HIMSS Security Survey show progress toward hardened security and use of analytics, but more work is needed to mitigate insider threat, such as inappropriate access of data by employees. Federal initiatives such as OCR audits, Meaningful Use (MU) and the HIPAA Omnibus Rule encourage healthcare organizations to increase the budgets and resources dedicated to securing patient health data. However, over the past year, 19 percent of respondents reported a security breach. Additionally, 12 percent of organizations have had at least one known case of medical identity theft reported by a patient.

The 2013 HIMSS Security Survey is supported by the Medical Group Management Association and underwritten by Experian Data Breach Resolution. It profiles the data security experiences of 283 information technology (IT) and security professionals employed by U.S. hospitals and physician practices. The data from respondents suggests the greatest perceived “threat motivator” is of healthcare workers potentially looking at electronic health information of friends, neighbors, spouses or co-workers.

There has been a response to the risk of security breach via inappropriate data access by insiders. Efforts include increased use of several technologies related to employee access to patient data, such as user access control and audit logs of each access to patient health records. 

More than half of the survey’s respondents (51 percent) have increased their security budgets in the past year. Still, 49 percent of these organizations are still spending 3 percent or less of their overall IT budget on security initiatives that will secure patient data.

“Though progress is noticeable, it is critical that healthcare organizations put in place a comprehensive plan that addresses potential security threats – whether internal or external — to prevent electronic health data breaches and minimize the impact of a breach should one occur,” said Michael Bruemmer, vice president for Experian Data Breach Resolution.

Other findings from the survey include: 

  • 92 percent of organizations conduct a formal risk analysis
  • 54 percent of organizations report having a tested data breach response plan and 63 percent of these organizations test their plan annually
  • 93 percent of organizations indicate their organization is collecting and analyzing data from audit logs
  • Healthcare organizations are using multiple means of controlling employee access to patient information; 67 percent of survey respondents use at least two mechanisms, such as user-based and role-based controls, for controlling access to data

 

The survey also identifies barriers to improving an organization’s security posture included budget, dedicated leadership and the following: 

  • Organizations reported an average score of 4.35 regarding the maturity of the security environment (where 1 is not at all mature and 7 is highly mature).
  • Nearly half (49 percent) of the survey’s responding organizations are still spending 3 percent or less of their overall IT budget on security initiatives that will secure patient data.
  • 52 percent of the hospital-based respondents reported that they had a CSO, CISO or other full-time leader in charge of security of patient data.

 

For more information: www.himss.org, www.experian.com

Related Content

Partners HealthCare Chooses Visage 7 for Enterprise Imaging
News | Enterprise Imaging | January 18, 2019
Visage Imaging Inc. announced the signing of Partners HealthCare, the largest health system in Massachusetts, for...
Seamless Interoperability – Fact or Fiction? This webinar will show how Nemours Children’s Health System adoption of ScImage’s PICOM365 Enterprise PACS  improved workflow. The product will be highlighted at HIMSS 2019.
Sponsored Content | Webinar | PACS | January 17, 2019
This ScImage-sponsored ITN/DAIC webinar will be held at 2 p.m. Eastern time, Wednesday, Feb. 6, 2019.
NewYork-Presbyterian Hospital Partners With Philips for Health IT and Clinical Informatics
News | Enterprise Imaging | January 16, 2019
Philips announced that NewYork-Presbyterian Hospital has chosen to implement the company’s IntelliSpace Enterprise...
Pacific Northwest VA Network Selects Carestream as Enterprise PACS Supplier
News | PACS | January 08, 2019
Carestream has been awarded a multimillion-dollar healthcare information technology (IT) contract for Veterans Affairs...
Infinitt Showcases New RIS/PACS Features at RSNA 2018
News | PACS | December 19, 2018
Infinitt North America highlighted a range of healthcare information technology (IT) products and applications at the...
Videos | Enterprise Imaging | December 14, 2018
ITN Editor Dave Fornell and ITN Contributing Editor Greg Freiherr share their insights on the new technology and vend
Videos | Artificial Intelligence | December 13, 2018
ITN Editor Dave Fornell and ITN Contributing Editor Greg Freiherr share their insights on the vendors showing...
Fovia Launches F.A.S.T. AI Suite for PACS
Technology | Advanced Visualization | December 05, 2018
Fovia Inc. recently announced the release of a new artificial intelligence (AI) visualization platform, F.A.S.T. AI...
Fujifilm Collaborates With Lunit on AI Pilot Project
News | Artificial Intelligence | December 05, 2018
Fujifilm Medical Systems USA Inc. announced a joint collaboration with Korean-based medical artificial intelligence (AI...