Home » News » Currently Reading:

Bowtie Confidential: The Internal Security Threat 6/30/12

June 30, 2012 News No Comments

Despite the potential impact of negative publicity, penalties, fines, and lawsuits, healthcare organizations continue to breach patient information. The threat to privacy and security is not only external; it is also internal, including employees, temporary staff, and third parties.

Technology can be a culprit (it is easier to access and transfer data online), but it can also be part of a solution. Although it is impossible to prevent all insider attacks, you can leverage technology to minimize the risk.

Culture is also a culprit. Look at Facebook – people are becoming comfortable putting personal information online. There is a cultural “loosening” of privacy boundaries, which can affect an organization’s culture and therefore its security.

The following action steps should be part of your plan for reducing internal security threats:

  • Cultivate a leadership culture of respect for individual privacy regarding access to information
  • Include the “insider threat” plan in the organizational strategic plan
  • Create and assign the role of a chief information security / privacy officer
  • Develop enhanced human resource screening processes and interview techniques to seek out potential insider threats
  • Develop ongoing and consistent HIPAA (security and privacy) training and awareness programs that extend beyond orientation
  • Implement appropriate data and application access monitoring software
  • Establish clear policies and procedures to address identity, access management and overall data protection
  • Develop and implement a system and data access monitoring process that includes summary dashboard reports to leadership
  • Implement and schedule risk assessment audits

Internal threats are just as dangerous as external threats – or more. By creating and implementing a specific strategy to reduce and address insider threats, healthcare organizations can better manage their risk. Everyone is accountable for privacy and security. However, the message has to come from the top with policies, procedures, and monitoring to reinforce it.

Rob Drewniak is vice president, strategic and advisory services, for Hayes Management Consulting.

Leave a comment


Founding Sponsor


  

Platinum Sponsors


  

  

  

  

  

  

  

  

Gold Sponsors


  

Subscribe to Updates




Search All HIStalk Sites


Loading

Recent Comments

  • HackersFriend: Darn you! Now I'll have to change my password. Thanks to you for posting the list, I'll have to think of a new one. ...
  • Obfuscator: Nokia is once again in the mobile phone market though, with new Android handsets being produced by Finnish HMD Global, u...
  • In the know: Interesting that you did not highlight the listing of eClincalWorks as the only HIT vendor with a reported breach in MA...
  • Not quite accurate: Mr. Slavitt's comment about "free preventative care" doesn't reach the young hard working people My daughter with her h...
  • Calling you out: Dr Detroit: You call that slanted diatribe "facts"? Please, stop criticizing others for being political when you're so...

Tweets

Follow