The results of the 2013 HIMSS Security Survey reveals that breaches of protected health data (PHI) remain a concern by U.S. hospitals and physician practices, specifically the practice of inappropriate data access.
The survey of 283 information technology (IT) and security professionals employed by provider organizations revealed that there is increased use of several technologies related to employee access to patient data, including user access control and audit logs of each access to patient health records. Ninety-three percent of organizations indicate their organization is collecting and analyzing data from audit logs and 67 percent are using at least two mechanisms, such as user-based and role-based controls, for controlling access to data.
“Healthcare organizations are increasingly deploying technologies to increase data security, but continued analysis is crucial in ensuring the proactive prevention of data breaches within hospitals and physician practices. Without these anticipatory measures, security of patient data will remain a core challenge within our nation’s healthcare organizations,” Lisa A. Gallagher, vice president of technology solutions at HIMSS said in a statement.
Other findings from the survey reveal 49 percent of healthcare organizations are still spending 3 percent or less of their overall IT budget on security initiatives that will secure patient data. More than half have increased their security budgets in the past year, the data also revealed.
There are areas where healthcare providers are doing well. Ninety-two percent of organizations conduct a formal risk analysis, 54 percent of organizations report having a tested data breach response plan, and 63 percent of these organizations test their plan annually.
Another recent report, from Redspin, Inc., a Carpinteria, Calif.-based provider of IT security assessments, revealed that in 2013 breaches of PHI were up 138 percent from 2012.
