Healthcare security is in for changes in 2009...

There have been a number of recent developments affecting healthcare security and compliance.

One is a significant penalty levied against CVS by the FTC and DHHS- $2.25M. First, let's look at the compliance issue- CVS employees apparently disposed of sensitive data (PHI, credit card, and insurance information) by dumping it in the trash, where anyone could discover it. And here I thought dumpster diving was a lost art form.

Because this was a joint investigation, and because historically the FTC has been far more willing to impose stiff penalties that has DHHS/CMS, I think the  serious penalty probably has more to do with the FTC's involvement, rather than any real shift in HIPAA compliance enforcement on the part of DHHS. As I previously blogged about here, DHHS is doing a handful of audits (<20) of large healthcare providers, which is a move towards getting more serious, but not a huge move, given there are ~5,000 hospitals in the US.

Another recent development in the healthcare security area is the HITRUST Alliance, which is comprised of a number of large healthcare providers. This organization has a laudable goal of building a "common security framework" for healthcare organizations. They have buy-in and involvement from CISO's at large HCO's. They are apparently making progress, as they have a launch event scheduled for 3/3/09. From the information available on the website, they are getting to a more detailed level than the HIPAA Security rule gets to, which is a good and welcome thing.

I wonder about adoption, given that this is not attached to any compliance regulation or enforcement. The healthcare industry has been famous for avoiding getting serious about security for a long time. Perhaps this will be picked up as something required for JCAHO accreditation, which is important to HCS's, or perhaps it will get referenced in new privacy and security standards that are mentioned in the recovery bill, as a future requirement to be addressed as part of a move towards electronic health records. Time will tell. Certainly, if the healthcare industry moves seriously towards EHR's, and linking of different provider's networks via regional/nation health information networks, security and privacy are BIG issues, and the current HIPAA Security and Privacy rules aren't sufficient.

Jim