Breach In Delivery

Healthcare industry struggles to leverage mobility while protecting patient information

In order to streamline inefficiencies, reduce errors and drive down the costs associated with delivering medical care, healthcare organizations worldwide have transitioned abruptly from a largely paper-based administration system to one based on electronic health records. With the widespread adoption of EHRs and mobile computing technology, the administrative gap between the standards of healthcare and other industries has narrowed and exposed a new threat: data breaches associated with lost or stolen computers.

With electronic protected health information stored on laptop computers in the hands of physicians, nurses, HMO brokers and insurance underwriters, health organizations face negative publicity, fines—averaging $197 per record across all industries—and increased costs if even a single laptop goes missing. To avoid becoming the next media headline, healthcare organizations now must demonstrate that they know where their mobile computers are, who is using them and what information is stored on them. They also must be able to demonstrate that patient information is protected in the event that a computer goes missing.

Move Toward Mobility In 2008, one in every two computers in the world will be a laptop. Health organizations, including HMOs, clinics, hospitals and related organizations such as pharmacies and home care services, are participating in this trend. At the same time, pressure to drive down costs and improve administrative efficiency has fueled a convergence of electronic protected health information on laptops. Together, these trends make healthcare organizations profitable targets for identity thieves and other computer criminals.

Identity thieves typically attempt to use stolen information to obtain credit cards, mortgages or travel documents. Recently, a new breed of thieves has begun to use stolen identities for free medical care. For example, having gone into the hospital for shoulder surgery, a 56-year-old retired schoolteacher was shocked to receive a bill for the amputation of her foot. Her foot was intact, and the person who had stolen her identity had received the operation free of charge. The teacher faced a lengthy process to prove that she was the victim of identity theft and not the perpetrator.

The Regulatory Landscape No single factor in recent history has had a greater impact on the administration of healthcare than regulatory compliance. For healthcare IT professionals, the impact of regulation ranges from relatively nontechnical auditing requirements to sophisticated technical procedures aimed at protecting health information.

The 2002 California Security Breach Information Act added a new, public dimension to regulatory compliance in healthcare. In the event of a data breach such as a lost laptop computer containing sensitive information, the law compels organizations—healthcare included— to notify all parties whose personally identifying information has been exposed. Following California’s lead, the majority of states have enacted similar data breach laws.

So, while the much-talked-about HIPAA has mandated a more methodical approach to managing sensitive health information, state data breach laws have provided strong motivation for healthcare organizations to protect information and, consequently, themselves.

Prevention Strategies How can healthcare organizations take advantage of recent advances in mobile computing while safeguarding patient and HMO member information?

While many watchdogs and analysts promote encryption technology as healthcare’s data security savior, recent headlines have made it abundantly obvious that no single data security measure will provide adequate protection. Many times, this is because employees undermine otherwise robust data security plans. After a laptop theft at a 2,400-physician Michigan-based hospital, for example, a nurse sheepishly admitted to taping her laptop encryption key to the laptop’s keyboard. In fact, a recent Research Concepts survey indicates that only one in 100 employees consistently follows company policies regarding data security such as those requiring the encryption of sensitive data.

While encryption is a necessary security measure, only a multilayered approach to protecting health information provides adequate protection when a laptop containing health information is lost or stolen. A typical multilayered strategy includes clear data security policy, physical deterrents such as cable locks and encryption backed by BIOS-supported remote data delete and theft recovery capabilities.

Data Breach Preparedness After a 2007 data breach resulting from the theft of a nurse’s laptop, IT staff at Minneapolis-based Allina Hospitals and Clinics changed the way the 11-hospital system managed mobile devices. Two weeks after the incident, Allina deployed Computrace IT asset management, remote data delete and theft recovery services from Vancouver, Canada-based Absolute Software as a complement to its Utimaco encryption system.

“Computrace immediately gave us visibility into our laptop population. We can see where the laptop is, who is logging in and what software is installed,” said Brad Myrvold, Allina’s manager of desktop technology. “It also allows us to verify that the laptop’s encryption is up to our standard, which is key for regulatory compliance.”

With a multilayered data security plan in place, Allina is able to use laptop computers while delivering the highest standard of protection for its computers and the sensitive information they contain.

“Computrace makes managing laptops much safer and easier,” Myrvold said. “We know immediately if a laptop begins to drift off our radar, and we can send the department manager a message asking them to investigate. If a computer is lost or stolen, Computrace is a lifeline. If we are concerned about the information on it, we use Computrace to remotely delete it. We can also use Computrace to verify that the computer’s encryption was up to standard at the time of the theft. Finally, we can physically recover the computer, which puts everyone’s mind at rest.”

Featured

  • Smarter Access Starts with Flexibility

    Today’s workplaces are undergoing a rapid evolution, driven by hybrid work models, emerging smart technologies, and flexible work schedules. To keep pace with growing workplace demands, buildings are becoming more dynamic – capable of adapting to how people move, work, and interact in real-time. Read Now

  • Trends Keeping an Eye on Business Decisions

    Today, AI continues to transform the way data is used to make important business decisions. AI and the cloud together are redefining how video surveillance systems are being used to simulate human intelligence by combining data analysis, prediction, and process automation with minimal human intervention. Many organizations are upgrading their surveillance systems to reap the benefits of technologies like AI and cloud applications. Read Now

  • The Future is Happening Outside the Cloud

    For years, the cloud has captivated the physical security industry. And for good reason. Remote access, elastic scalability and simplified maintenance reshaped how we think about deploying and managing systems. But as the number of cameras grows and resolutions push from HD to 4K and beyond, the cloud’s limits are becoming unavoidable. Bandwidth bottlenecks. Latency lags. Rising storage costs. These are not abstract concerns. Read Now

  • Right-Wing Activist Charlie Kirk Dies After Utah Valley University Shooting

    Charlie Kirk, a popular conservative activist and founder of Turning Point USA, died Wednesday after being shot during an on-campus event at Utah Valley University in Orem, Utah Read Now

  • The Impact of Convergence Between IT and Physical Security

    For years, the worlds of physical security and information technology (IT) remained separate. While they shared common goals and interests, they often worked in silos. Read Now

New Products

  • Camden CM-221 Series Switches

    Camden CM-221 Series Switches

    Camden Door Controls is pleased to announce that, in response to soaring customer demand, it has expanded its range of ValueWave™ no-touch switches to include a narrow (slimline) version with manual override. This override button is designed to provide additional assurance that the request to exit switch will open a door, even if the no-touch sensor fails to operate. This new slimline switch also features a heavy gauge stainless steel faceplate, a red/green illuminated light ring, and is IP65 rated, making it ideal for indoor or outdoor use as part of an automatic door or access control system. ValueWave™ no-touch switches are designed for easy installation and trouble-free service in high traffic applications. In addition to this narrow version, the CM-221 & CM-222 Series switches are available in a range of other models with single and double gang heavy-gauge stainless steel faceplates and include illuminated light rings.

  • Camden CV-7600 High Security Card Readers

    Camden CV-7600 High Security Card Readers

    Camden Door Controls has relaunched its CV-7600 card readers in response to growing market demand for a more secure alternative to standard proximity credentials that can be easily cloned. CV-7600 readers support MIFARE DESFire EV1 & EV2 encryption technology credentials, making them virtually clone-proof and highly secure.

  • EasyGate SPT and SPD

    EasyGate SPT SPD

    Security solutions do not have to be ordinary, let alone unattractive. Having renewed their best-selling speed gates, Cominfo has once again demonstrated their Art of Security philosophy in practice — and confirmed their position as an industry-leading manufacturers of premium speed gates and turnstiles.