Bowtie Confidential: The Internal Security Threat 6/30/12

Despite the potential impact of negative publicity, penalties, fines, and lawsuits, healthcare organizations continue to breach patient information. The threat to privacy and security is not only external; it is also internal, including employees, temporary staff, and third parties.

Technology can be a culprit (it is easier to access and transfer data online), but it can also be part of a solution. Although it is impossible to prevent all insider attacks, you can leverage technology to minimize the risk.

Culture is also a culprit. Look at Facebook – people are becoming comfortable putting personal information online. There is a cultural “loosening” of privacy boundaries, which can affect an organization’s culture and therefore its security.

The following action steps should be part of your plan for reducing internal security threats:

• Cultivate a leadership culture of respect for individual privacy regarding access to information
• Include the “insider threat” plan in the organizational strategic plan
• Create and assign the role of a chief information security / privacy officer
• Develop enhanced human resource screening processes and interview techniques to seek out potential insider threats
• Develop ongoing and consistent HIPAA (security and privacy) training and awareness programs that extend beyond orientation
• Implement appropriate data and application access monitoring software
• Establish clear policies and procedures to address identity, access management and overall data protection
• Develop and implement a system and data access monitoring process that includes summary dashboard reports to leadership
• Implement and schedule risk assessment audits

Internal threats are just as dangerous as external threats – or more. By creating and implementing a specific strategy to reduce and address insider threats, healthcare organizations can better manage their risk. Everyone is accountable for privacy and security. However, the message has to come from the top with policies, procedures, and monitoring to reinforce it.

Rob Drewniak is vice president, strategic and advisory services, for Hayes Management Consulting.