Security Issues in Health Information Technology

In 2009, the U.S. Government passed The Health Information Technology for Economic and Clinical Health (HITECH) Act, as part of the American Recovery and Reinvestment Act of 2009, to promote the adoption and meaningful use of health information technology (Mangalmurti, Murtagh and Mello 2060). The HITECH Act authorizes grants and incentives to promote the “meaningful use” of electronic health records (EHR) by providers (2060). The effect is a high commitment to a technology-led system reform, urging a renewed national commitment to building an information infrastructure to support health care delivery, consumer health, quality measurement and improvement, public accountability, clinical and health services research, and clinical

There is no doubt in that technology has multifaceted benefits but, at the same time, it has forced mankind to feel insecure. Every industry depends upon the data of the customers and the health industry is no more an exception here. The data of each patient is shared to facilitate health itself and for more rigorous and authentic research. Hence, protecting patient data is very important. It is so important that in 1996, the federal government introduced the Health Insurance

Regulation placed upon the healthcare system only seek to improve safety and security of the patients we care for. The enactment of the Health Insurance Portability and Accountability Act (HIPPA) and the enactment of Meaningful Use Act the United States government has set strict regulations on the security of health information and has allotted for stricter penalties for non-compliance. The advancement of electronic health record (EHR) systems has brought greater fluidity and compliance with healthcare but has also brought greater security risk of protected information. In order to ensure compliance with government standards organizations must adapt

The Affordable Care Act of 2010 marks a new era in American health care. Yet in many ways, this era began more than a year earlier, with the passage of the American Recovery and Reinvestment Act (ARRA) of 2009 and its Health Information Technology for Economic and Clinical Health (HITECH) provisions. Although HITECH may be viewed narrowly as legislation to

HIPAA and HITECH lay out strict standards governing information security and privacy of patient information. While HIPAA/HITECH may be a boon to the security of healthcare information, they also throw up a number of challenges like high costs, tracking regulatory changes, extensive documentation and several others. HITECH is the Health Information Technology for Economic and Clinical Health Act, which brings additional compliance standards to healthcare organizations. It is directly related to HIPAA, and was part of the American Recovery and Reinvestment Act of 2009.EHR systems can also offer increased patient privacy & security when compared to traditional paper records. Encrypted electronic patient records can be protected against unauthorized

Under the HIPAA Security Rule, health care providers are required to conduct an accurate and thorough analysis of the potential risks and vulnerabilities. Protecting the confidentiality, integrity, availability, and privacy of data in health care is very important. For a risk analysis, health care providers would prioritize risks based on the severity of the impact that it would cause their patients and practices (Security Risk Analysis TipSheet, 2014). In addition, identifying the potential threats to patient privacy and security (Security Risk Analysis TipSheet, 2014). A risk analysis process would include determining the likelihood and impact of potential risk to electronic protected health information, implementing security measures to

Securing larger volumes of data than before, health care providers must be able to adapt to new methods of data storage and access of patient records. Security breaches in health care organizations is lost or stolen from unencrypted devices and media where the provider is using to retrieve records. As more health providers continue to use mobile devices to access pertinent information from electronic medical records systems the chances for breach increases so dramatically. (Rogers,

According to McMillan (2011), the Health Information Technology for Economic and Critical Health (HITECH) Act was passed in 2009 to addressed privacy and security concerns related to the electronic transmission of patients’ medical records. Furthermore, the HITECH Act which has sanctioned programs intended to improve healthcare quality, safety, and efficiency using health information technology (health IT) has raised some legislative and ethical issues. McMillan stated that the HITECH Act broadened the range of privacy and security protections provided under the Health Insurance Portability and Accountability Act (HIPAA) to include notification of security breach; education of health information privacy; and holding business associates liable,

Ong (2011) notes HITECH provisions increase the civil and criminal enforcement of the HIPAA Privacy, Security and Breach Notification rules that address the privacy and security concerns associated with transmitting health information electronically. According to Ong (2011), under HITECH business associates must now fully comply with HIPAA requirements that prohibit disclosure of confidential protected health information (PHI). At the time Congress passed HITECH, protection for the privacy of health information was imperative especially with the HIV/Aids epidemic. Moreover, the adoption of EHRs by healthcare providers was only minimal according to Ong (2011). Additionally, the Institute of Medicine (IOM) reported that the number of Americans

Medical errors can be a significant threat to the the health of Americans and can lead to the downfall of a health care system. These errors can be anything from a data entry error or simply a patient’s information getting into the wrong hands. The importance of a health care system is to provide extraordinary care all while protecting the rights and information of their patient. A new generation of federal efforts emerged in order to address these concerns, in part through the effective use of information technology. Thus, the Health Information Exchange was born. The Health Information Exchange (HIE) is a system that allows health care information to be appropriately and securely shared electronically across organizations within a region,

In some cases, the unpreparedness of most physicians to use new technologies, may raise another problem. This would be difficult when attempting to meaningfully use the system properly. A great way to leverage EHR to improve quality is to achieve meaningful use. For example, “the emergence of electronic health records (EHRs) also is complicating organizational efforts to define and disclose information [3].” By implementing and putting EHRs into action, it will benefit providers not just financially but also by reducing medical errors, and increasing the availability of records and data. The 2016 Report to Congress on HIT Progress stated that “many health care providers still face challenges accessing and viewing individuals’ electronic health information for a variety of reasons, including confusion about privacy and security considerations, cumbersome enrollment processes, or complex contracts with technology vendors [6].” Furthermore, meaningful use also elevates in legal issues, such as privacy threats on patients and data breaches. These may happen because electronic documents and electronic use of medical information could get exposed as they get implemented in health care services. In this case, private information of

Health information technology (HIT) involves trading of health information in an electronic format to advance health care, reduce health expenditures, improve work efficiency, decrease medication errors, and make health care more accessible. Maintaining privacy and security of health information is crucial when technology is involved. Health information exchange plays an important role in improving the quality and delivery of health care and cost-effectiveness. “There is very little electronic information sharing among clinicians, hospitals, and other providers, despite considerable investments in health information technology (IT) over the past five years” (Robert Wood Johnson Foundation, 2014, p. 1).

Security breaches of EMRs vary from someone without consent viewing the patient’s information, to a hacker using the information to steal one’s identity. According to Privacy Rights Clearing House, more than 260 million data breaches have occurred in the United States, including those of health related records. Approximately 12 percent of data breaches involve medical organizations (Gellman, 2012). According to Redspin, a provider of Health Insurance Portability and Accountability Act risk analysis and IT security assessment services, more than 6 million individual’s health records were compromised during a period from August 2009 and December 2010 (Author Unknown, 2010). A provision of the Health Information Technology for Economic and Clinical Health (HITECH) Act requires all breaches affecting 500 or more people to be reported to the Department of Health and Human Services. This reporting is to be accomplished within 60 days of discovery. The Redspin report covering the period above involved 225 breaches of protected health information. The amount of people with access to an individual’s health record creates concern with confidentiality. According to the Los Angeles

The road to patient-centered care was paved with the passing of the HITECH act, which authorized incentive payments through Medicare and Medicaid to clinicians and hospitals when they use EHRs privately and securely to achieve specified improvements in care delivery. If providers do not become meaningful users of EHRs by 2015, penalties will be triggered through reduced Medicare payments. These provisions aim to create a nationwide electronic health system that is efficient and secure to improve health outcomes and lower the cost of healthcare. To accomplish these goals, the federal government allotted $19.2 billion of funding to promote the adoption and meaningful use of interoperable health information technology and electronic health records (EHRs).

The rapid changes in technology over the past few decades has left the healthcare industry ill-prepared to operate in today’s environment. Most substantial protections of sensitive consumer information has come as a result of federal regulation, most notably in 1996 with the Health Insurance Portability and Accountability Act and 2009 as part of the American Recovery and Reinvestment Act. Protection of information in the healthcare industry has lagged behind all other industries, perhaps because the records aren’t financial in nature or sensitive government information. Implementing simple steps for many organizations may be enough to limit the vast majority of breaches, although a layered, comprehensive security approach should be the ultimate goal for companies.