Insiders responsible for majority of privacy breaches, survey finds

August 30, 2011 | Molly Merrill, Associate Editor

Suggested Content

NextGen, ScImage bring universal image integration to EHRs

LOS ALTOS, CA – A new survey on protected health information (PHI) privacy breaches found that 70 percent of the participants had suffered one or more breaches within the last 12 months.

The survey results were announced Wednesday by Veriphyr, a provider of identity and access intelligence solutions. According to the survey, insiders were responsible for the majority of breaches, with 35 percent snooping into medical records of fellow employees and 27 percent accessing records of friends and relatives.

[See also: 12 steps for surviving a privacy breach investigation]

The report – Veriphyr’s 2011 Survey of Patient Privacy Breaches – summarizes the findings of a survey of compliance and privacy officers at mid-to-large hospitals and healthcare service providers. Respondents were queried on their perceptions of privacy and compliance initiatives within their organization, adequacy of tools to monitor unauthorized access to PHI, and the number and type of breaches sustained in the past year.

“Given that data breaches of patient information cost healthcare organizations nearly $6 billion annually, we were not very surprised to discover that more than 70 percent of the organizations surveyed were victimized last year,” said Alan Norquist, CEO of Veriphyr. “However, we did not expect the prevalence of insider abuse reported, and that nearly 80 percent of the respondents feel they lack adequate controls to detect PHI breaches in a timely fashion.”

Some of the report’s key findings include:

[See also: Top 6 data security questions you should be asking your BAs]

Top breaches in the past 12 months by type:

Snooping into medical records of fellow employees (35 percent)
Snooping into records of friends and relatives (27 percent)
Loss /theft of physical records (25 percent)
Loss/theft of equipment holding PHI (20 percent)

When a breach occurred, it was detected in:

One to three days (30 percent)
One week (12 percent)
Two to four weeks (17 percent)

Once a breach was detected, it was resolved in:

One to three days (16 percent)
One week (18 percent)
Two to Four weeks (25 percent

Other findings:

79 percent of respondents were “somewhat concerned” or “very concerned” that their existing controls do not enable timely detection of breaches of PHI
52 percent stated they did not have adequate tools for monitoring inappropriate access to PHI

Click here for the full results of the survey.

[See also: 5 ways a PHI breach is like an epidemic]

Reader Comments (2)Login to Post a Comment

Keith.Allen says: Innovation advances HIT security

September 24, 2011 | 4:30AM GMT

Very interesting article. As I understand the identity and access intelligence model in the cloud, it is data concerning employee access to patient records -- not the confidential patient records themselves -- that are subject to review. In that case, risks of PHI breach seem minimal, especially if strong encryption is in place (both in transit and at rest).

The other commenter's concerns regarding Veriphyr seem self-serving. Perhaps other vendors are feeling some competitive pressure?

Innovation in health care compliance is to be embraced, otherwise we will continue to be saddled with approaches anchored in technology that is 20+ years old. Product and service development advances security for the health care industry. Complaining on message boards does not.

MarcusT says: Care providers cannot afford to take major risks

September 15, 2011 | 11:55AM GMT

The risks of solutions from companies like Veriphyr are that care providers are being asked to provide their data to an unproven third party business associate which, as we have seen in the New York Times, can be extremely risky to a care provider’s reputation, as well as financially damaging: http://www.nytimes.com/2011/09/09/us/09breach.html

Secondly, since the company’s business model is “free”, what happens to all of the care provider’s data if Veriphyr goes out of business? Since the company is by definition under-resourced, they face a big challenge in ensuring that as a Business Associate they have put themselves under privacy & security scrutiny that their customers go under.

Leading care providers cannot afford to take major risks with regulatory obligations on patient privacy and should look to vendors with proven customers, proven solutions that map to regulatory compliance and are proven to be viable.