Survey: Access Is Top IT Security Concern In Healthcare
According to a survey conducted at the HIMSS 2008 Annual Conference and Exhibition, 64 percent of respondents cited “access” as their number one IT security concern, highlighting the importance of controlling user access to clinical systems and applications in healthcare environments.
Additionally, 60 percent of attendees surveyed cite the threat of a HIPAA compliance audit as the strongest driver for security initiatives. These findings are the results of a HIMSS attendee survey conducted by Courion Corp.
Despite heightened access concerns, healthcare providers continue to be vulnerable to security and compliance risks. In fact, according to the HIMSS attendee survey, over the past year:
- 60 percent of respondents reported issues with users sharing passwords.
- 52 percent found orphan accounts not properly disabled.
- 38 percent identified instances of inappropriate access.
While risk management issues are clearly viewed as a priority, a Courion-commissioned focus group conducted by HIMSS Analytics uncovered an increasing concern that the pressure to deploy comprehensive electronic medical record (EMR) systems is taking budget and resources away from other priorities -- specifically security and compliance efforts. EMRs are often viewed as a priority by executive management to support operational goals associated with delivering high quality patient care. This demonstration of dueling operational and IT priorities often pits quality of care against patient privacy.
“The HIMSS research supports an interesting dichotomy we’re seeing in the healthcare market today. With CIOs taking on increasing responsibility for risk management issues along with operations, security is being looked at more strategically by hospitals,” said Todd Chambers, chief marketing officer, Courion. “But with limited budgets, it’s a challenge to prioritize. With more hospitals relying on remote and non-employee workforces, combined with the use of mobile and virtualization technology, the IT environment is increasingly difficult to secure, and without the enforcement of proper policies and checks and balances, audits will become increasingly difficult to pass.”
Following are key themes and results derived from the research efforts conducted at HIMSS 08 by HIMSS Analytics and Courion. The research was conducted with HIMSS attendees, including a cross-section of healthcare providers ranging from community hospitals to multi-hospital systems. The focus group and survey were developed to gain more insight into how healthcare providers view the importance of security and compliance efforts, especially in context of patient care and privacy priorities, and increasing enforcement of HIPAA guidelines.
There is no doubt that HIPAA remains a primary driver of IT and security decision-making, especially as more frequent federal audits have become a reality -- and not just for those that have suffered breaches. In fact, according to the HIMSS attendee survey, 75 percent of respondents were concerned/very concerned about facing a HIPAA audit and the majority of respondents (60 percent) cited the threat of a HIPAA compliance audit as the strongest driver for their security initiatives.
“The threat of a HIPAA audit has certainly become a significant factor in keeping compliance and security issues top of mind. This is something we didn’t see as prominently over the past few years, and is yet another indication of why there is increasing emphasis being put on controlling user access and proactively enforcing business policies,” Chambers said.
Focus group participants voiced that EMR deployments had become such a priority for their hospitals that budget and resources are being shifted away from HIPAA compliance and security efforts. These results show that many hospitals may be leaving themselves potentially exposed, especially as audits become “not if, but when” scenarios. While the fear of a federal audit and cost of litigation often help justify new security investments, security and compliance don’t often rank as budget priorities.
There was an overriding sentiment among focus group participants that compliance and security don’t become top priorities unless there is a security breach or the hospital is facing an external audit. This decidedly “reactive” approach to compliance and security is an increasing concern, particularly as high-profile privacy breaches, most recently impacting the UCLA Medical Center and unauthorized access to medical records for Britney Spears and Farrah Fawcett, will certainly continue to make headlines. In fact, many felt there was a sense of denial at the executive level about their facility actually being vulnerable to a security breach.
Quality of patient care and patient data privacy were cited as the top operational concerns keeping respondents “up at night” in the attendee survey. Sixty-four percent of respondents agreed that user “access” was their number one IT security concern. Healthcare providers remain challenged to better manage system access by non-employees who need certain systems and medical record information to do their jobs. These non-employees could include contractors, non-staff nurses or physicians and third-party vendors. Access issues are a major concern not only in terms of opening up their hospitals’ systems to possible computer viruses and hackers, but also in terms of being able to meet HIPAA audit requirements that require hospitals to attest that they know who is accessing the systems, what is being accessed, and whether or not that access is in compliance with existing policies.
Despite having formal security policies and compliance environments in place, it’s often the number of policies and lack of standard, centralized enforcement that create the greatest security concerns. According to the focus group, this is a particular problem when policies, and the consequences of non-compliance, vary across multi-hospital systems and even interdepartmentally within a single hospital and range from “zero tolerance” to taking a more educational “slap on the wrist” approach.
The survey found that over past year, the most common compliance vulnerabilities experienced by respondents were: Users sharing passwords, orphan accounts left active, and inappropriate access. Enforcement of security policies addressing these vulnerabilities is typically handled through a variety of manual and automated controls for staff onboarding, transfer and termination processes.
While most hospitals conduct regular audits to determine if data has been compromised, it can be a time-consuming process if done manually, and more importantly, audits alone do nothing to prevent a breach from happening in the first place. They only report what has already happened. While some hospitals are addressing this challenge by implementing policies where staff are warned about the consequences of accessing questionable information as they attempt to access it, known as “break the glass” policies, many focus group members said “education” was in fact a deterrent to internal security breaches.