While organizations have made investments into data security tools, employees remain a major barrier to achieving full privacy, according to a survey commissioned by Biscom.

The survey included more than 600 American employees to gauge how organizations are protecting data. The participants included C-suite executives from more than 20 industries including healthcare, finance and information technology.

Key findings included:

• 98 percent of respondents stated their company cared about data security, and 93 percent stated the organization invests in keeping data safe.
• 95 percent of respondents reported their company provides secure information tools.
• 85 percent believed their organization has policies about sharing, delivering and stealing data, documents and information.
• 88 percent of respondents reported their organization trains employees on how to use secure methods of information sharing and delivery.
• While 78 percent of respondents agree with an organization’s security policies, 74 percent reported insecurely sharing information both internally with their colleagues and 60 percent shared with people outside of their organization.
• 60 percent of respondents admitted doing what was easiest when deciding how to send sensitive documents.
• In respondents who shared data through an insecure internal email, 62 percent sent data that included customer data, 46 percent on strategy documents or presentations, 45 percent on company business or financial data and 43 percent on regulated data.
• Of those sharing data through an external insecure email, 49 percent of respondents reported sharing data that contained highly regulated data like medical or financial information, 35 percent shared strategy documents or presentations and 29 percent shared info about intellectual property.

 “The survey’s results uncover some interesting factors that contribute to non-compliance,” said Bill Ho, CEO of Biscom. “It would surprise most companies who have made major investments in security that so many people just fall back to the easiest method, namely sending confidential messages and files through email.”

In solving a cold case involving a serial rapist and murderer who terrified Northern California for decades, police used a novel approach to track down the killer. Detectives accessed open-source genetic data to locate relatives of a person whose genetic material was collected at a crime scene.

Before arresting the Golden State Killer—believed to be responsible for at least 12 murders and 51 rapes—last week, according to Buzzfeed, authorities subpoenaed FamilyTreeDNA in March 2017 for information associated with a specific customer.

FamilyTreeDNA runs a public database that includes genetic information. With profile names and payment information associated with one account, police found what they thought was a genetic match to the potential suspect. But the elderly man from Oregon was eventually cleared.

Despite this dead end, authorities used public records for relatives of the potential Golden State Killer, eventually identifying 72-year-old former police officer Joseph DeAngelo as their primary suspect.

But what does this case mean for the millions of individuals who have taken commercially available genetic tests? Who owns and controls the information collected by companies such as 23andMe, AncestryDNA and GEDmatch?

“I would say consumers should not be worried, but they should be aware,” Robert Green, MD, MPH, a medical geneticist at Brigham and Women’s Hospital and Harvard Medical School, told Time magazine. “It’s not necessarily a reason for concern, because we haven’t seen, to my knowledge, abuses of these databases. We have seen appropriate uses by law enforcement. I think we’re all glad a serial killer was caught.”

Privacy policies for these companies often claim information will not be readily available to law enforcement—and police efforts to obtain personal data will be resisted. But companies may be compelled to share information by a court order.

“Privacy is an important good, but it’s not the only good. We have to decide as a society how we’re going to trade these things off,” Ellen Wright Clayton, a professor of health policy at Vanderbilt University, told tech site Gizmodo. “I, like many people, think it’s probably a pretty good thing that this guy got captured. Bringing people to justice is an important social cause.”

Those who submit to genetic testing, like users of Facebook have recently learned, are willingly giving up some privacy. The industry of consumer-focused genetic testing, though, is still evolving, so policies and procedures will mature over time.

While electronic health records (EHRs) have improved the safety and quality of patient health information, the shift from paper to digital interfaces has introduced a new set of barriers that may contribute to patient harm.

An infographic published by the Pew Charitable Trusts outlines five usability issues that harm patients and two recommendations in making EHR use safer.

Usability issues included:

1. Alert fatigue: Ignoring of alerts, due to the overwhelming number of them, could cause clinicians to overlook important lifesaving alerts.
2. Unintended consequences of customization: Some healthcare systems have implemented a customized version of EHRs to fit workflow, but these customized systems may have missed the proper testing and could harm patients with unnoticed security concerns.
3. Auto refresh mix-up: Sorting patients by last name or bed number gives clinicians a view of the patient’s profile fasters, but auto refreshing can bring back default settings and leave clinicians accidentally making medical decisions for the wrong patient.
4. Unclear default settings: The default settings on medication dosages could lead to clinicians to giving patients the wrong amount of their prescriptions.
5. Incomplete lab results: Lab results in EHRs can be displayed while not all the findings have been sent in, leaving clinicians in the dark about some patient results and making a medical decision without all the facts.

Recommendations for improved EHR usability included:

1. Health information technology safety collaborative: A safety collaboration with stakeholders regarding interoperability and patient data safety could result in solutions for common and complex usability issues.
2. Safety testing during development and after implementation: Continually testing the EHR system, before and after implementation, would ensure a level of safety for developers and clinicians.

Privacy and security concerns are linked to reduced patient access of health records and trust in health information technology (HIT). Findings were published April 11 in the Journal of Medical Internet Research.

In this study, researchers examined the effectiveness of HIT by looking at information assurance issues such as privacy concerns and trust in health information.

“Today, the healthcare industry primarily relies on HITs such as electronic medical record (EMR) systems, patient health record (PHR) systems, and technical devices to deliver patient care services,” wrote first author Victoria Kisekka, PhD, and colleagues. “Despite the continued diffusion of HITs within the health care sector, there is no theory explaining how HIT success influences perceived patient care quality.”

The study included data from 3,677 cancer patients from a public dataset. Researchers examined the data for correlations between information assurance and attitudes toward health information exchange (HIE), patient access to health records and perceived patient care quality.

Results showed increased privacy concerns of HIT reduced the frequency patients accessed their health records, positive attitudes toward the HIE and perceptions of patient care quality. However, the belief in the effectiveness of security increased patient access to health records and positive attitudes toward HIE. Trust in health information also had a positive correlation with perceptions of HIE and care quality.

“Trust in health information and belief in the effectiveness of information security safeguards increases perceptions of patient care quality,” concluded Kisekka and colleagues. “Privacy concerns reduce patients’ frequency of accessing health records, patients’ positive attitudes toward HIE exchange, and overall perceived patient care quality. Health care organizations are encouraged to implement security safeguards to increase trust, the frequency of health record use, and reduce privacy concerns, consequently increasing patient care quality.”

Healthcare cybersecurity insurance claims in 2017 measured 17 percent of total claims but was responsible for 28 percent of total breach costs, $65 million of $229 million, according to the 2017 Cyber Claims Study by NetDiligence.

Healthcare cybersecurity insurance claims in 2017 made up 17 percent of total claims—but accounted for 28 percent of costs related to breaches, roughly $65 million of a total $229 million, according to the 2017 Cyber Claims Study by NetDiligence.

The study analyzed 103 cyber liability insurance claims pertaining to healthcare. It aimed to provide risk management professionals with insight into how data insecurity is affecting the industry.

Key findings included:

• The average number of records exposed in a healthcare breach was 1.6 million.
• Healthcare claims comprised 17 percent of claims in the 2017 dataset and 28 percent of total costs.
• Breaches that exposed protected health information (PHI) averaged 386,000 in 2017, while breaches of personally identifiable information (PII) averaged 5.2 million.
• The total average breach cost for PHI was $475,000 in 2017, while average cost for PII was $1.85 million.
• The median per-record cost in healthcare was $28, lower than the $47 in other sectors. However, the amount of large settlements made from very few records increased the average per-record cost for healthcare.
• Costs for average total crisis services were three times higher for healthcare than other sectors.
• Average legal settlement costs were 40 percent of the combined average of all other sectors, $116,00 versus $260,000.
• Criminal acts exposed 80 million PII and 17 million PHI records, leading to healthcare having the highest total notification ($37.1 million) and credit/ID monitoring ($6.6 million) costs.
• Stolen unsecured laptops with unencrypted hard drives averaged $37,000 in costs.

Social network sites (SNSs) facilitate communication between healthcare professionals, but they are limited in protecting data, according to a study published in the Journal of Medical Internet Research.

SNSs can aid physicians in reaching patients, but research into their benefits and limitations in communication between healthcare professionals is lacking. In this study, researchers evaluated the utilization of SNSs for communication between health professionals in frontline clinical practice, professional networks and education and training.

Researchers evaluated literature published within the past 10 years in different databases. Searches were conduct with terms including social media, social network, Facebook, Twitter, WhatsApp, WeChat, health or health profession. Of the 33 works in this study, the majority were surveys (25) with six interviews.

All of the analyzed studies stated SNSs had improved communication and information sharing between professionals. Benefits for SNSs included network building, collaboration and educational interactions. However, limitation in SNSs included technical knowledge, concerns on data protection, privacy and liability and concerns about professionalism.

“As the growth of SNSs is expected to rise, health professions should have a better understanding of how to attain secure and appropriate use of these platforms,” concluded first author Windy Chan, and colleagues. “Formal training should be provided to health professionals for the safe use of SNSs. Although not much mentioned in the included papers, a practical issue that should be given attention is how the SNS companies manage, analyze, repurpose or even disclose the data and content of communication. Health service institutes and providers must consider carefully in using SNSs for communicating confidential data to avoid jeopardizing patient privacy.”

Facebook has been in the news lately, having to explain how millions of users' data have been misused. Now it has announced an end to plans to share user data with several major U.S. hospitals and organizations, including the American College of Cardiology.

“This work has not progressed past the planning phase, and we have not received, shared or analyzed anyone’s data,” Facebook said in a statement to CNBC.

Facebook planned to anonymize the information, so no individuals would be personally identified. The data were intended for use by medical researchers. But in light of the scandal surrounding political research organization Cambridge Analytica, Facebook has faced scrutiny over possible misuse of user data.

According to CNBC, Freddy Abnousi, MD, MBA, MSc, a cardiologist in Stanford, California, led the project out of Facebook’s experiment projects group. The goal was to use patient data along with social media information to improve patient care, focusing primarily on cardiovascular health.

The full story is available at the link below:

Black Book Market Research, a healthcare and public opinion research company, has named Fortified Health Security as the top cybersecurity service vendor in the "medical device and internet of things" category.

Black Book surveyed 2,464 cybersecurity professionals from over 680 organizations to identify vulnerabilities healthcare systems face when it came to cyberattacks. With 96 percent of information technology experts reporting hackers have exploited healthcare’s vulnerability, professionals are hoping to strengthen security.

“We know that many healthcare organizations do not have the staff, or expertise, to prepare for and address cybersecurity issues which is why we offer programs that scale from a technology-enabled service to a fully managed solution depending on the organization’s needs and infrastructure,” said Dan L. Dodson, President of Fortified Health Security. “Our Connected Medical Device & IoT Security Program is in demand by many hospitals and health systems because of the immediate positive impact it provides to their security posture and this recognition by Black Book reflects the importance of this program.”

Read more at the link below: