The topic of managing an increasing volume of electronic data securely, while keeping up with regulatory compliance requirements dominated
the recent 2011 Southern California HiMSS Chapter’s Second Annual Healthcare IT Conference, Healthcare Reform: Driving to 2015 and Beyond.
That title may give the appearance of a conference agenda driven by healthcare policies and politics. While there was a certain amount of discussion surrounding those topics, the underlying tone of the event was less about policies and politics and more about the practical implications of the exploding growth of healthcare electronic data, and the associating compliance demands that come with it. In other words, the concerns of the conference attendees aligns with Sword & Shield’s mission of supporting healthcare organizations’ information security and compliance challenges and requirements.
The pains of managing electronic data is felt the most by healthcare executives from covered entities such as hospitals. Two of those executives, Thomas Priselac, president & CEO of Cedars-Sinai Health System and Dr. Sajjad Yacoob, chief medical information officer and physician from Children’s Hospital of Los Angeles, provided unique, but similar, perspectives on the issue of healthcare information security and compliance.
Consistent with the conference’s theme, Priselac focused on the state of healthcare reform, including industry progress. He also shared his thoughts on key factors for the future of healthcare reform. Not surprisingly one of the key factors is uncertainty – there are no guarantees that the current healthcare law will remain in its current form. In fact, there is a high likelihood that parts of it or even the entire law could change in the short or long term.
The ever-changing healthcare information technology landscape and the security and compliance challenges presented with it was the focus of Yacoob’s presentation as well. Yacoob offered an interesting paradox: the healthcare industry is completely dependent on information technology, which changes at a rapid rate. However, IT users, especially doctors, are very slow to adapt to technological changes. One of the unintended consequences of this paradox is greater potential for security breaches and vulnerabilities. Resisting technological change often means resisting crucial security best practices once the change is adopted. Backing up that notion is a recently released study by the Ponemon Institute, which found that the leading cause of breaches is negligence, accounting for 41 percent, up slightly from 40 percent in 2009. The cost of these breaches averaged $196 per record, up 27 percent from 2009, according to the study.
The growing cost of breaches underscores the importance of healthcare organizations securing electronic protected health information (ePHI), along with addressing risks, specifically in regard to information privacy and security. Alongside that requirement is the need to implement the appropriate safeguards for managing and controlling those risks. Sword & Shield is uniqqualified to help healthcare organizations secure ePHI while helping them become and remain compliant with regulations such as uely HIPAA, HITECH, and Meaningful Use.
Speaking of Meaningful Use, today’s healthcare IT conference would not be complete without including that topic on the agenda. And on that note, the SoCal HIMSS Heathcare IT Conference delivered by offering a Meaningful Use panel, featuring presentations from a number of experts. Among them was Lori Hack, who serves as the chair of the board of directors for the California eHealth Collaborative.
Hack’s presentation, Finding Meaning in Meaningful Use,offered insightful information about Meaningful Use while providing practical advice on approaches to meeting the requirements. Even more impressive was Hack’s coverage of the Meaningful Use risk assessment requirement. The context of her message – that the Meaningful Use process should not be just about getting funds, but should be done with security and risk management in mind – was refreshing to hear. And it was another indication that this conference was much more than about healthcare policies and politics.
Bowe Hoy is an Enterprise Security Consultant for Sword & Shield. If you need more information regarding HIPAA, HITECH, and Meaningful Use risk assessment and compliance, please contact him via our website or by phone at 865-244-3521.
Global Payments Credit Card Data Breach
Adrian Sanabria, PCI Qualified Security Assessor at Sword & Shield
On Sunday, card processor Global Payments announced that data from 1.5 million credit/debit card accounts had been “exported.” It isn’t so much the size of this breach that is significant, but the fact that the company breached is one of the world’s largest payment processors.
Visa has allowed them to continue processing credit cards, but dropped them off their service provider registry (which is a BIG deal). The breach only affects North American merchants and cardholders. To give you an idea of how bad a breach at a large credit card processor can be, if a month’s worth of the transactions they handle were exposed, it is entirely possible that more than 90% of all cardholders in the US would need new credit/debit cards.
This doesn’t happen often. I only know of two other cases where a payment processor was hit by a breach. CardSystems Services, as a business, was literally destroyed by their breach. VISA and AMEX revoked processing rights, forcing CardSystems to have to shut down operations and sell off assets almost overnight. Heartland Payment Systems is the most recent case, and the second largest breach ever at 130 million. They were also stripped from the registry, but managed to recover, regain PCI compliance, and get back onto the registry within a year.
Global Payments had a public conference call at 8AM this morning that I didn’t have time to attend, but which has resulted in an explosion of news stories on the breach.
The worst thing I’ve been able to determine from the details so far, is that it seems Global Payments was storing Track Data – information swiped from the magnetic stripe on the back of the card. The PCI DSS explicitly forbids storing track data (requirement 3.2.1), and PCI considers the storage of sensitive data to be one of the most serious PCI violations. CardSystems was effectively shut down for a lesser violation, though their breach was much larger.
It will be interesting to see if any of the details of the breach are released. These details are essential for the rest of the industry to learn from Global’s mistakes. I’d like to see:
Time will tell.
Adrian Sanabria is a security consultant and PCI Qualified Security Assessor for Sword & Shield Enterprise Security. He draws on years of security experience in financial institutions to help large and small companies solve complex compliance and security problems. He is skilled with both high-level design as a system and security architect, and detailed analysis with a background in penetration testing, forensics and incident response. His blog is averysawaba.blogspot.com, and you can reach him on Twitter @sawaba.