February 19, 2014 — Results of the 2013 HIMSS Security Survey show progress toward hardened security and use of analytics, but more work is needed to mitigate insider threat, such as inappropriate access of data by employees. Federal initiatives such as OCR audits, Meaningful Use (MU) and the HIPAA Omnibus Rule encourage healthcare organizations to increase the budgets and resources dedicated to securing patient health data. However, over the past year, 19 percent of respondents reported a security breach. Additionally, 12 percent of organizations have had at least one known case of medical identity theft reported by a patient.
The 2013 HIMSS Security Survey is supported by the Medical Group Management Association and underwritten by Experian Data Breach Resolution. It profiles the data security experiences of 283 information technology (IT) and security professionals employed by U.S. hospitals and physician practices. The data from respondents suggests the greatest perceived “threat motivator” is of healthcare workers potentially looking at electronic health information of friends, neighbors, spouses or co-workers.
There has been a response to the risk of security breach via inappropriate data access by insiders. Efforts include increased use of several technologies related to employee access to patient data, such as user access control and audit logs of each access to patient health records.
More than half of the survey’s respondents (51 percent) have increased their security budgets in the past year. Still, 49 percent of these organizations are still spending 3 percent or less of their overall IT budget on security initiatives that will secure patient data.
“Though progress is noticeable, it is critical that healthcare organizations put in place a comprehensive plan that addresses potential security threats – whether internal or external — to prevent electronic health data breaches and minimize the impact of a breach should one occur,” said Michael Bruemmer, vice president for Experian Data Breach Resolution.
Other findings from the survey include:
- 92 percent of organizations conduct a formal risk analysis
- 54 percent of organizations report having a tested data breach response plan and 63 percent of these organizations test their plan annually
- 93 percent of organizations indicate their organization is collecting and analyzing data from audit logs
- Healthcare organizations are using multiple means of controlling employee access to patient information; 67 percent of survey respondents use at least two mechanisms, such as user-based and role-based controls, for controlling access to data
The survey also identifies barriers to improving an organization’s security posture included budget, dedicated leadership and the following:
- Organizations reported an average score of 4.35 regarding the maturity of the security environment (where 1 is not at all mature and 7 is highly mature).
- Nearly half (49 percent) of the survey’s responding organizations are still spending 3 percent or less of their overall IT budget on security initiatives that will secure patient data.
- 52 percent of the hospital-based respondents reported that they had a CSO, CISO or other full-time leader in charge of security of patient data.
For more information: www.himss.org, www.experian.com
March 06, 2024 
