With California's data breach notification law now being extended to cover health care organizations, businesses in this space must pay closer attention to how the personal health information entrusted to their care is safeguarded.
It was 1996 when Congress passed the Health Insurance Portability and Accountability Act (HIPAA). But even with this long-standing legislation, it seems only recently that organizations started taking notice.
Why? The oft-heard answer was that HIPAA, say it with me now, "had no teeth." While that seems to have held some truth over these many years, it no longer stands. As you'll read in this edition's Special Section on IT Security and Health Care, there is a fairly recent data exposure case that has grabbed the health care industry's interest.
As SystemExpert's Jon Gossels tells us, the Department of Health and Human Services (HHS) conducted an audit of Atlanta's Piedmont Hospital. According to many bloggers on the subject, neither the hospital nor HHS confirmed the audit and still few details have emerged. But, some reports indicate that HHS demanded to review the hospital's policies and procedures specifically related to data and systems access, employee violations of security rules, and more.
Meantime, rumors are circulating that HHS has set its sights on a big hospital in California for its second audit concerning possible HIPAA violations. Now, on top of HIPAA, with at least one hospital's security practices having been scrutinized by auditors, there is AB1298. Suddenly, these groups must publicly notify their patients of possible exposures.
What's interesting about these developments is where we've come. There are a ton of people out there saying that if anything is going to compel organizations to implement the right security tools and procedures, regulations will. Naysayers, on the other hand, believe that federal mandates will not necessarily help the numerous data theft incidents experienced today.
But you can't ignore that it is legislative enforcement that has put an industry on high alert. And now, with AB1298, there is even more reason for the health care vertical to come into line — especially given the critical information it traffics everyday.
Undoubtedly, as we enter a recession, budgets are just as short in this space as in any other, but so is the public's patience. And sound business means sound security, as well as keeping your brand and bottom line unharmed.
Illena Armstrong is U.S. editor-in-chief, SC Magazine.
