Study: Most Healthcare Organizations Not Ready For New Privacy, Security Compliance Regulations
A recent survey of healthcare organizations found that 94 percent believe they are not ready to comply with the privacy and security provision of the Health Information Technology for Economic and Clinical Health (HITECH) Act.
The new provisions take effect in February. The survey of 77 U.S. healthcare organizations was conducted by the Ponemon Institute and sponsored by Crowe Horwath LLP, one of the largest public accounting and consulting firms in the U.S.
The HITECH Act extends the Health Insurance Portability & Accountability Act's (HIPAA) rules for security and privacy safeguards, including increased enforcement, penalties and audits. According to the survey, many current HIPAA compliance programs have deficiencies in the areas of privacy and security, including inadequate program testing and failure to update the programs. Yet only 47 percent of the respondents feel they have the necessary funding and resources to fully comply with the new regulations.
"We believe that most organizations are not ready for HITECH as a result of compliance issues within their existing HIPAA programs," said Raj Chaudhary, a principal in Crowe Horwath's risk consulting group. "Even though most organizations acknowledge that their HIPAA compliance programs are deficient, our survey found that implementing necessary controls or securing third-party assistance to help ensure compliance may be limited due to budgetary restraints."
The study also found that 79 percent of organizations do not regularly have the required independent assessment or audit of their program to determine adequacy. Fifty-seven percent say they have known deficiencies concerning privacy or security, or both. Only 29 percent of respondents report no deficiencies.
Other survey findings include:
- Most organizations experienced one or more data breach incidents involving the loss or theft of protected health information during the past two years. Ninety percent of respondents had a breach involving at least one protected health record.
- Lack of management support may slow down compliance goals. Fifty-five percent of respondents report there is no management support for HITECH compliance.
- Many organizations report significant gaps in their privacy and security programs. Sixty percent say their organizations have only partially implemented a risk-based program for protecting the privacy of protected health information (PHI). Approximately half of respondents say they do not provide adequate staff training for privacy and security. Forty-five percent believe their organizations have not effectively developed a privacy policy that clearly summarizes appropriate use and sharing of PHI.
- Third-party assistance may be necessary for achieving certain compliance goals. Nearly half of all respondents said they may need assistance from a third party to conduct a detailed risk assessment. Forty-five percent need outside support for staff training, while 42 percent will need assistance in implementing procedures for fielding complaints. Thirty-nine percent will rely on help in developing the privacy program.
- Responsibility for ensuring HITECH compliance varies considerably among organizations. Security leaders and chief compliance officers are the roles identified as most likely to be responsible for achieving HITECH compliance, according to respondents. Organizations with more than 5,000 employees were much more likely to see the security leader as having primary responsibility than smaller companies.
"It is disappointing, though not surprising, to learn that a majority of companies do not believe they are prepared for the latest in healthcare information security regulations," said Dr. Larry Ponemon, chairman and founder, Ponemon Institute. "Our research consistently finds that a lack of budgetary and moral support from the executive suite is a common barrier to proper data security and management programs, even with the specter of regulatory enforcement looming."