There have been a number of recent developments affecting healthcare security and compliance.
One
is a significant penalty levied against CVS by the FTC and DHHS-
$2.25M. First, let's look at the compliance issue- CVS employees
apparently disposed of sensitive data (PHI, credit card, and insurance
information) by dumping it in the trash, where anyone could discover
it. And here I thought dumpster diving was a lost art form.
Because
this was a joint investigation, and because historically the FTC has
been far more willing to impose stiff penalties that has DHHS/CMS, I
think the serious penalty probably has more to do with the FTC's
involvement, rather than any real shift in HIPAA compliance enforcement
on the part of DHHS. As I previously blogged about here,
DHHS is doing a handful of audits (<20) of large healthcare
providers, which is a move towards getting more serious, but not a huge
move, given there are ~5,000 hospitals in the US.
Another
recent development in the healthcare security area is the HITRUST
Alliance, which is comprised of a number of large healthcare providers.
This organization has a laudable goal of building a "common security
framework" for healthcare organizations. They have buy-in and
involvement from CISO's at large HCO's. They are apparently making
progress, as they have a launch event scheduled for 3/3/09. From the
information available on the website, they are getting to a more
detailed level than the HIPAA Security rule gets to, which is a good
and welcome thing.
I wonder about adoption, given that this is
not attached to any compliance regulation or enforcement. The
healthcare industry has been famous for avoiding getting serious about
security for a long time. Perhaps this will be picked up as something
required for JCAHO accreditation, which is important to HCS's, or
perhaps it will get referenced in new privacy and security standards
that are mentioned in the recovery bill, as a future requirement to be
addressed as part of a move towards electronic health records. Time
will tell. Certainly, if the healthcare industry moves seriously
towards EHR's, and linking of different provider's networks via
regional/nation health information networks, security and privacy are
BIG issues, and the current HIPAA Security and Privacy rules aren't
sufficient.
The Joint Commission, which is a non-profit organization that publishes standards for healthcare organizations and runs an accreditation program, is updating some of their standards for 2009, including some which impact information security.
Compliance Regulations
