Digital Health Records May Increase Identity Theft
President Obama has proposed sweeping reform of the nation's healthcare system and said he believes all medical records should be computerized and standardized within five years. The President hopes this will result in increased quality of care, decreased costs, and creation of thousands of new jobs. Todd Feinman, a published security expert and CEO of Identity Finder , cautions, however, that electronic medical records add higher risk of identity theft unless they are carefully protected. "The HIPAA Privacy rules have only been around for a couple of years; many healthcare providers are still unprepared to protect patients' personally identifiable information (PII), which if stolen could lead to identity fraud." Feinman discusses below the special HIPAA compliance initiative his firm has enacted to ensure electronic patient health information (ePHI) is protected.
In 2006, the Health and Human Services issued final ruling regarding HIPAA enforcement and set civil money penalties for violating HIPAA rules. These regulatory requirements call for organizations to proactively protect patient health information, but still too often PHI ends up unprotected in a spreadsheet on a nurse's computer. "If healthcare providers have a security breach, not only would that be a violation of patients' privacy, but also the associated costs would be dramatically higher than implementing some simple, preventive measures," says Feinman. The upcoming changes by the Obama Administration could make organizations' exposure of PHI even worse.
Feinman's company, Identity Finder, has developed software that searches for and secures PHI, the type of sensitive information specifically referred to by HIPAA privacy legislation. Many healthcare providers and healthcare payers are now cleaning PHI from computers using Identity Finder. Wayne Martin, Information Security Officer at University of Virginia's Health System, had the following to say, "Identity Finder helps us locate patient health information so that we can protect it at the source and educate users on the proper handling of information in accordance with University, State, and Federal policies."
Identity Finder has taken a groundbreaking approach by giving organizations insight into the root cause of the problem. Most organizations don't even know where their PHI is. "Not only do we help organizations find and protect PHI, but we also give them the ability to monitor how much exposure the organization has to unsecured PHI so they can prevent data leakage issues." Feinman's engineers have spent years developing proprietary search algorithms to find confidential personal information quickly and accurately.
The software automatically finds PHI such as social security numbers, medical record numbers, dates of birth, driver licenses, personal addresses, and other private data within files, e-mails, databases, websites, and system areas. Once found, the software makes it simple for users or administrators to permanently shred, scrub, or secure the information. Their recently released management console aggregates the data and provides a report card for organizations to see how their policies are performing.
Identity Finder can be run centrally by administrators or stand-alone on a PC or Mac by data owners. For this reason, Identity Finder is an ideal fit for both smaller and larger healthcare providers and payers, as well as other organizations who want to minimize their risks and prevent confidential data loss.