Home » News » Currently Reading:

Bowtie Confidential: The Internal Security Threat 6/30/12

June 30, 2012 News No Comments

Despite the potential impact of negative publicity, penalties, fines, and lawsuits, healthcare organizations continue to breach patient information. The threat to privacy and security is not only external; it is also internal, including employees, temporary staff, and third parties.

Technology can be a culprit (it is easier to access and transfer data online), but it can also be part of a solution. Although it is impossible to prevent all insider attacks, you can leverage technology to minimize the risk.

Culture is also a culprit. Look at Facebook – people are becoming comfortable putting personal information online. There is a cultural “loosening” of privacy boundaries, which can affect an organization’s culture and therefore its security.

The following action steps should be part of your plan for reducing internal security threats:

  • Cultivate a leadership culture of respect for individual privacy regarding access to information
  • Include the “insider threat” plan in the organizational strategic plan
  • Create and assign the role of a chief information security / privacy officer
  • Develop enhanced human resource screening processes and interview techniques to seek out potential insider threats
  • Develop ongoing and consistent HIPAA (security and privacy) training and awareness programs that extend beyond orientation
  • Implement appropriate data and application access monitoring software
  • Establish clear policies and procedures to address identity, access management and overall data protection
  • Develop and implement a system and data access monitoring process that includes summary dashboard reports to leadership
  • Implement and schedule risk assessment audits

Internal threats are just as dangerous as external threats – or more. By creating and implementing a specific strategy to reduce and address insider threats, healthcare organizations can better manage their risk. Everyone is accountable for privacy and security. However, the message has to come from the top with policies, procedures, and monitoring to reinforce it.

Rob Drewniak is vice president, strategic and advisory services, for Hayes Management Consulting.

Comment on this Article:







Founding Sponsors


  

Search All HIStalk Sites


Loading


Tweets

Platinum Sponsors


  

  

  

  

  

  

  

  

Gold Sponsors


  

Subscribe to Updates




Follow

Reader Comments

  • Ann Farrell: Dr. Detroit. My POV is as clinician - public health/patient advocacy driven. Happy for whomever comes up solution tha...
  • Dr. Detroit: To Ann Farrell: This site attempts to stay out of political POVs and remain factual. Many of the things you list about...
  • Ann Farrell: It was heartening to see 3000 physicians stand up for rights for all patients to be treated with dignity and respect in ...
  • Prisoner 4578293: . . . and as clarification lest one suspect employee bias - my comments come from personal experience selling automation...
  • Prisoner 4578293: Re: Prison medicine. I can't open the article but can describe how incarcerated felons can be given very expensive care...