Recommendations for Healthier Organizations in 2013: Data Security

It’s time for some New Year’s resolutions; and they have nothing to do with eating right, losing weight or exercising.  Instead, they have everything to do with protecting against the organizational and financial stresses of data breaches—which have become an everyday disaster.

As noted in a post last month, the Third Annual Benchmark Study on Patient Privacy & Data Security, reports that data breaches in healthcare are growing; insider negligence is the root cause; and mobile devices pose threats to patients’ protected health information (PHI). Despite the fact that 94 percent of healthcare organizations surveyed suffered data breaches, data breaches don’t have to be disastrous if organizations take steps to operationalize pre-breach and post-breach processes to better protect patient data and minimize breach impact.

The results of this survey have lead to a few of us bing invited to share our recommendations for a healthier organization in 2013 and beyond:

1. Establish mobile device and Bring Your Own Device (BYOD) policies that include technical controls and employee and management procedures.

Rick Kam, CIPP/US, president and co-founder, ID Experts

2. Control the cloud or it'll control you. Make it a point to fully understand what cloud service-level agreements mean in practice and then push for meaningful information on failover and disaster recovery practices used.”

Richard Santalesa, senior counsel, InfoLawGroup LLP

3. Have a current breach response plan that is ready and tested. This will help pave the way for a well-executed response that can mitigate the financial, legal and reputational harm caused by a security incident involving patient information.

Marcy Wilder, partner and director of global privacy and information management practice, Hogan Lovellis

 4. Conduct small but focused risk assessments rotating control review on a monthly basis to continually understand and measure risk. Most importantly, have a plan to address the risk, through remediation, mitigation or risk transfer activities.

Chad Boeckmann, president and chief strategy officer, Secure Digital Solutions, LLC

5. Immunize mobile devices against viruses that might steal patient data.

Dr. Larry Ponemon, chairman and founder, Ponemon Institute

 6. Attack your leadership team with phishing and other social engineering campaigns. Nothing raises awareness like catching people and correcting them on the spot—and it's a lot more interesting than the annual 30-minute online security training.

Michael Boyd, Director of Information Security Management, Providence Health & Service

7. Use a checklist to evaluate periodically whether covered entities and business associates are in compliance with all privacy and security requirements. Sign and date the checklist to show that your organization is not guilty of "willful neglect" in complying with privacy and security laws.