Big data hacks prompt providers to up security spending

Two recent huge breaches of health insurers' information technology systems in which the personally identifiable records of more than 83 million individuals were stolen have had significant financial and psychological effects on healthcare organizations, according to Modern Healthcare's Survey of Executive Opinions on Key Health Information Technology Issues.

Nine out of 10 survey respondents indicated the breaches will have either a “considerable” (12%) or “some” (78%) impact on IT security spending at their organizations in the next 12 months.

Eighty percent of respondents indicated their spending on health IT security will increase this year, while 20% predicted it would not change. None reported a security spending cut.

Spending increases are needed because 59% of those surveyed reported spending 3% or less of their organizations' IT budgets on security, a level deemed inadequate by security experts.

More than three-fourths of respondents (78%) reported their organizations encrypt all personally identifiable data in motion outside their organizations; 26% encrypt some data at rest while 35% encrypt all data at rest. Nearly 2 in 3 healthcare leaders surveyed (64%) predicted their organizations will increase their use of encryption this year.

A 2009 amendment to the Health Insurance Portability and Accountability Act requires providers to honor a patient's request not to disclose to their health insurer records of a visit, treatment or procedure if the patient pays for it out of pocket. The attendant privacy rule went into effect in 2013. Yet few healthcare providers have electronic health-record systems capable of handling these special privacy situations, Modern Healthcare's survey shows.

Asked whether their current EHRs were able to “tag” patients' electronic records to facilitate honoring these privacy requests, 37% said they were unsure, while 9% said they were not familiar with the rule. Another 28% said they had no such EHR capability. That left only 26% of providers saying they were equipped with systems capable of complying with the law. Privacy advocate Dr. Deborah Peel, founder of the Patient Privacy Rights Foundation, said she was “shocked and surprised” that the percentage was as high as 26% of providers that are capable of complying with the patient's right to keep treatment records from being disclosed to insurers. They deserve “accolades,” she said.