After three jam packed days of activity inside and outside our booth, HIMSS15 came to a close. Our final panel presentation of the week focused on the important topic of healthcare data privacy and security. Marianne Kolbasuk McGee, Executive Editor of Information Security Media Group (ISMG) moderated and shared information from ISMG’s annual information security study. Also on the panel were Steve Shihadeh, Senior Vice President of North America Sales Caradigm, Mac McMillan, Chief Executive Officer CynergisTek, and Shane Whitlatch, Executive Vice President FairWarning. The survey results that Marianne shared were really interesting because they showed that despite the high profile breaches that have occurred over the past couple of years, there’s still plenty of room for healthcare organizations to give information security greater focus. Some of the statistics shared were:

• Only about half of organizations indicated that preventing and detecting breaches is a top priority in 2015.
• Just 31 percent of healthcare organizations have “high” or “somewhat high” confidence in the security controls of their business associates and subcontractors.
• Nearly 80 percent of organizations rely on usernames and passwords as the dominant method of authentication used for on-site and remote access to clinical data with use of more advanced forms of authentication still rare.
• 51 percent of organizations reported having no breaches of any size in 2014 compared to 37 percent in 2013.

The panelists advised that healthcare organizations need to guard against complacency in order to stay ahead of security risks. Everyone should be doing more because of the continuous presence of insider threats and increasing hacking threats that are targeting healthcare heavily because of the value of the data and intellectual property. The panel also stressed the importance of tools to help control identity and access management and ongoing workforce training that needs to be put into greater context for how employees do their jobs.

Another very cool event that took place today was that patient rights advocate and renowned artist, Regina Holliday was in the Caradigm booth painting a mural on population health to raise awareness for the Society for Participatory Medicine. The mural is inspired by the idea that healthcare needs powerful and disruptive change and was completed in a single day. To learn more about Regina’s patient advocacy, I recommend reading her blog and following her on Twitter.

 

 

Identity and access management (IAM) is getting harder. It used to be a single physician would view one record for one patient during one visit at one location, but now everything is multiplied. Healthcare providers are rapidly expanding their scope of influence by adding independent physicians, hospitals and other providers to their network. IAM is now a broader business challenge that not only affects security and compliance, but also patient safety, clinician satisfaction as well as IT resource utilization.

If anyone knows about the challenge of IAM, it’s Bobby Stokes, AVP Identity Management and Development Services of Hospital Corporation of America (HCA). HCA, recognized for security excellence, must share patient information securely and efficiently across 160+ hospitals, 1000 hospital affiliates, and 100,000+ users. Five percent of all U.S. inpatient admissions take place in a HCA facility. As Stokes said on last week’s webinar, “That’s an interesting mix of concerns.”

Today, IAM is a balancing act. First, healthcare organizations have a responsibility to ensure the privacy of protected health information from internal and external threats. Inappropriate access to data has resulted in multiple data privacy violations recently (see here and here), and is an area that providers need to take greater control of. Second, data has to be easily available for clinicians to consume and comprehend. Clinician workflows can be streamlined by reducing the number of system log-ins and by providing patient context across those systems. Lastly, from a provisioning perspective, IT needs tools to manage the sheer volume of requests they are faced with. Without solutions that can automate provisioning processes, IT is forced to spend excessive amounts of time on user provisioning, which can also cause delays in clinician access.

If you missed last week’s webinar where Bobby Stokes talked about how HCA approaches identity and access management, then you can catch the recording here.

When you have the operational scale of Healthcare Corporation of America (HCA), identity and access management (IAM) is a massive undertaking. Recognized as a security innovator by CSO Magazine, HCA is continuing to set the bar high by improving security and access to protected health information across 160+ hospitals, 1000 hospital affiliates, and 100,000+ users. While the primary goals of IAM are security and compliance, it is an area with broader business value. IAM enables security leaders to partner with clinical leaders to drive efficiencies in how clinicians consume patient data, which impacts patient safety and the overall quality of care.

If you’d like to hear how HCA approaches IAM, it’s not too late to register for our webinar today at 1 PM ET. The always entertaining Bobby Stokes, AVP Enterprise Systems at HCA, will be discussing how HCA is taking control of its data to manage security and compliance risk while improving clinician access. You can register here.