Privacy and Security: Joke or No Joke?
The Wall of Shame welcomes Sutter Health. Another computer with unencrypted protected health information on over 4 million patients – gone. Now, those guys are pretty smart, so why don’t they encrypt all computers with PHI? One of life’s persistent questions.
The Wall of Shame welcomes Sutter Health. Another computer with unencrypted protected health information on over 4 million patients – gone. Now, those guys are pretty smart, so why don’t they encrypt all computers with PHI? One of life’s persistent questions. I mean, I can accept the fact that a health plan operator like Cignet Health might have issues with getting a grip on HIPAA compliance, but Sutter Health?What were they thinking? Can’t happen here? Encryption is a drag? It’s an easy way to avoid major egg-on-face and to avoid spending significant coin on PR, credit reporting services, and potentially on court judgments — all in addition to significant administrative fines payable to HHS and state regulators.
So the federales are piloting the HIPAA audit program. I know it’s required by the HITECH Act, but who believes that it will motivate behavior change? Anyone? Sutter Health was clearly not motivated to seek a safe harbor that would have made the loss of 4 million patient records a non-event. I know encryption can be a drag, but I’m not a techie. If you are, I invite you to educate me (and the other non-techies out there) on the question of how miserable it really is to have to deal with encrypted data; if you’re really a techie, write a program to enable light-touch encryption that doesn’t interfere with use of data.
Whether or not encryption is miserable, we should be asking: Why is this data on a barely secured computer (password-protected desktop) in the first place? Shouldn’t it be stored on a server that stays in a secure facility, or in a secure private cloud?
Furthermore, as data loss incidents like this keep happening — even among other industry leaders (see, e.g., Mass General) — perhaps we need a new framework for thinking about access to health information. If we knew for sure that employment and insurance decisions would not be affected by the availability of otherwise private health record information, perhaps we would be more sanguine about their release. Perhaps government resources would be better spent on beefing up education and enforcement in those arenas (vs. auditing and enforcing compliance with privacy and security standards).
You may be interested
Can Natural Remedies Like RediCalm Decrease Stress and Anxiety?Ryan Kh - August 16, 2017
According to research from the National Institute of Mental Health, anxiety disorders are the most common mental illness in the…
How to Alleviate Stress Related InsomniaJohnHenning - August 15, 2017
Do you have difficulty falling asleep or staying asleep every night? You aren't alone. According to multiple studies, including one…
4 Hormones That Play a Critical Role in Your Well beingErica - August 15, 2017
Hormonal health and wellbeing have received plenty of attention lately, both from the medical community as well as from health-conscious…