Data security looms large for ONC

Mary Stevens, editor, CMIO magazine

ONC’s Beacon Community program, intended to fund and foster better patient outcomes via integrated health IT and coordinated care, has had quite a first year. Speakers and panelists alike discussed some of the early gains and challenges during an event held this week to mark the one-year anniversary of the program.

However, privacy and security were missing from much of the discussion at the one-year anniversary of the Beach Community programs, as National Health IT Coordinator Farzad Mostashari, MD, pointed out in his closing remarks. “We need to put patients’ interests in the center, including privacy and security. We can’t do this without the public’s trust; we can never compromise on that.”

The two-year anniversary event for the Beacon program might well include more discourse and hopefully success stories about data privacy.

Meanwhile, a pair of reports from the Office of the Inspector General knock HHS agencies’ enforcement of HIPAA’s rule regarding electronic protected health information.

This is just the latest in the parade of cautionary news when it comes to safeguarding data in-house, in transit, and everywhere in between. For example, the HHS Office of Civil Rights’ list of data breaches reached 10 million patients earlier this year. And that’s only the list for reported breaches effecting 500 people or more.

It all adds up to a busy summer for the ONC’ Health IT Standards Committee (HITSC), said John Halamka, MD, CIO and professor at Harvard Medical School in Boston, during his opening remarks at the Massachusetts Governor’s 2011 Health IT Conference earlier this month.

Therefore, HITSC is planning to spend the entire summer in Washington, D.C., working on answers to critical questions, such as “How do you guarantee who is doing the sending and who is doing the receiving of clinical information [in an HIE]?”

User authentication, firewalls and data encryption might not be enough to ensure that public trust. Connectivity among medical devices—mainstays of care management for Beacon Community programs and others—poses a growing security challenge for healthcare organizations as well. In a recent webinar examining the new Medical Device Data Systems rule and its implications, the audience was urged to evaluate devices and systems and create a single source of device information, so that misplaced or stolen devices’ data sensitivity is known quickly and appropriate steps can be taken.

What is your organization doing to secure data on networked devices? Let me know: mstevens@trimedmedia.com.

 

Mary Stevens, editor