Home » News » Currently Reading:

Bowtie Confidential: The Internal Security Threat 6/30/12

June 30, 2012 News No Comments

Despite the potential impact of negative publicity, penalties, fines, and lawsuits, healthcare organizations continue to breach patient information. The threat to privacy and security is not only external; it is also internal, including employees, temporary staff, and third parties.

Technology can be a culprit (it is easier to access and transfer data online), but it can also be part of a solution. Although it is impossible to prevent all insider attacks, you can leverage technology to minimize the risk.

Culture is also a culprit. Look at Facebook – people are becoming comfortable putting personal information online. There is a cultural “loosening” of privacy boundaries, which can affect an organization’s culture and therefore its security.

The following action steps should be part of your plan for reducing internal security threats:

  • Cultivate a leadership culture of respect for individual privacy regarding access to information
  • Include the “insider threat” plan in the organizational strategic plan
  • Create and assign the role of a chief information security / privacy officer
  • Develop enhanced human resource screening processes and interview techniques to seek out potential insider threats
  • Develop ongoing and consistent HIPAA (security and privacy) training and awareness programs that extend beyond orientation
  • Implement appropriate data and application access monitoring software
  • Establish clear policies and procedures to address identity, access management and overall data protection
  • Develop and implement a system and data access monitoring process that includes summary dashboard reports to leadership
  • Implement and schedule risk assessment audits

Internal threats are just as dangerous as external threats – or more. By creating and implementing a specific strategy to reduce and address insider threats, healthcare organizations can better manage their risk. Everyone is accountable for privacy and security. However, the message has to come from the top with policies, procedures, and monitoring to reinforce it.

Rob Drewniak is vice president, strategic and advisory services, for Hayes Management Consulting.

Comment on this Article:







Founding Sponsors


  

Search All HIStalk Sites


Loading


Tweets

Platinum Sponsors


  

  

  

  

  

  

  

  

  

  

  

  

  

  

Gold Sponsors


  

Subscribe to Updates




Follow

Reader Comments

  • Aaron Berdofe: It may be nitpicking, but "data visualization" can be done well, which would help the interpretation of lab results, or ...
  • Andy Spooner: Best speech-recognition flub I've seen: Genitalia: Normal male circumcised became: Genitalia, Normal male circu...
  • Denise Apcar: thank you, thank you, thank you! The funniest thing I have read in a long time! I absolutely hate having to correct HER ...
  • stick a fork in Practice Fusion: Any remote shot of Practice Fusion winning a large medical group/health system can be kissed good by...put a fork in 'em...
  • Anon: Square doesn't have to store medical information in order to bump into HIPAA. They are notoriously deliberately ignoran...