Home » News » Currently Reading:

Bowtie Confidential: The Internal Security Threat 6/30/12

June 30, 2012 News No Comments

Despite the potential impact of negative publicity, penalties, fines, and lawsuits, healthcare organizations continue to breach patient information. The threat to privacy and security is not only external; it is also internal, including employees, temporary staff, and third parties.

Technology can be a culprit (it is easier to access and transfer data online), but it can also be part of a solution. Although it is impossible to prevent all insider attacks, you can leverage technology to minimize the risk.

Culture is also a culprit. Look at Facebook – people are becoming comfortable putting personal information online. There is a cultural “loosening” of privacy boundaries, which can affect an organization’s culture and therefore its security.

The following action steps should be part of your plan for reducing internal security threats:

  • Cultivate a leadership culture of respect for individual privacy regarding access to information
  • Include the “insider threat” plan in the organizational strategic plan
  • Create and assign the role of a chief information security / privacy officer
  • Develop enhanced human resource screening processes and interview techniques to seek out potential insider threats
  • Develop ongoing and consistent HIPAA (security and privacy) training and awareness programs that extend beyond orientation
  • Implement appropriate data and application access monitoring software
  • Establish clear policies and procedures to address identity, access management and overall data protection
  • Develop and implement a system and data access monitoring process that includes summary dashboard reports to leadership
  • Implement and schedule risk assessment audits

Internal threats are just as dangerous as external threats – or more. By creating and implementing a specific strategy to reduce and address insider threats, healthcare organizations can better manage their risk. Everyone is accountable for privacy and security. However, the message has to come from the top with policies, procedures, and monitoring to reinforce it.

Rob Drewniak is vice president, strategic and advisory services, for Hayes Management Consulting.

Leave a comment

*

*

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Platinum Sponsors


  

  

  

Gold Sponsors


 

Subscribe to Updates




Search All HIStalk Sites



Recent Comments

  1. Re: Walmart Health: Just had a great dental visit this morning, which was preceded by helpful reminders from Epic, and…

  2. NextGen announcement on Rusty makes me wonder why he was asked to leave abruptly. Knowing him, I can think of…

  3. "New Haven, CT-based medical billing and patient communications startup Inbox Health..." What you're literally saying here is that the firm…

  4. RE: Josephine County Public Health department in Oregon administer COVID-19 vaccines to fellow stranded motorists. "Hey, you guys over there…

  5. United is regularly referred to as "The Evil Empire" in the independent pediatric space (where I live). They are the…