Hospitals tighten security on patient data

More than half of the nation’s hospitals and health care providers surveyed intend to buy more cybersecurity tools to safeguard against breaches of electronic medical records as a result of requirements in the economic stimulus law, according to a new survey of 186 health care providers and associates.

The stimulus law has provision known as the Health Information Technology for Economic and Clinical Health (HITECH) Act, which took effect on Sept. 23. It includes a broader definition of what patient health data must be protected against unauthorized release, increased penalties for violations and provides for aggressive enforcement. The law also requires providers to notify the Health and Human Services Department of all data breaches and to call media outlets if more than 500 residents in an area are affected.

As a result of the HITECH Act, 57 percent of the survey respondents said they would make additional investments in security tools or technologies, according to the survey by Healthcare Information and Management Systems Society Analytics released Nov. 17. The survey included got responses from 150 executives with provider organizations and 26 executives with business associates.

More than 90 percent of the survey respondents said their organizations have either changed, or plan to change, their policies and procedures to prevent and detect data breaches. More than 75 percent plan to do additional staff training against breaches, and 75 percent are revising their organization’s security policies and procedures. Forty-six percent said they would take all those steps.

The hospitals and health care organization executives acknowledged their groups are at risk of patient data breaches even while almost all of them (91 percent) are conducting risks assessments and 81 percent using encryption technology.

During the last year, 31 percent of the respondents said they had at least one data breach. Larger hospitals were more at risk, with 52 percent of the executives from large hospitals indicating at least one breach, 33 percent at medium-sized hospitals, and 25 percent at small hospitals.