HIMSS Privacy and Security director discusses ‘Hidden Pitfalls with Cloud, Mobile Technology and Mobile Data’ at HIMSS14

February 24th, 2014 by admin Leave a reply »


Lee Kim will review practices of healthcare organization examining vendor contracts, such as business associate agreements (BAAs) with cloud vendors maintaining HIPAA compliance. Kim assists HIMSS with government relations, federal affairs, and state affairs in terms of evaluating privacy and security laws and regulations.


She believes that organizations have been doing risk assessments to find holes in their information systems.
They’re definitely going through risk assessments for their systems and I’m predicting that organizations, including providers will be more focused on risk remediation. Its one thing to assess risk, determining high-level vulnerabilities, but the real value you get out of a risk assessment is what you do about it and take action. Providers can do this by actually mitigating those risks both inside and outside of their organizations.
Kim believes that there must be strong program to have processes in place. Kim mentioned that health industry is unique as it’s trusted with patient information and can affect patients’ lives.
Ensuring the patient information is both private as well as secure is certainly paramount. Not only do organizations need to comply with HIPAA, they need to have a holistic approach to keeping bad actors away from patient data. Unfortunately, these bad actors can be inside or outside an organization. Or it may even be an individual who doesn’t have bad intent but is exceeding the scope of their authorized access and cause a breach out of negligence.
Kim also stated that there are many cloud users who are not completely aware of it.
In terms of where we’re going with information technology, it just seems as though there’s more of a dependence on cloud-based solutions. For example, a provider may contract with a cloud provider or use a hosted EHR solution. More health IT stakeholders are seeking these outsourced solutions such as cloud.
Organizations, especially corporate giants, have to have an information security policy in place that proves they have taken necessary steps and measures to safeguard the information they gathered. If these policies are not adhered to, the regulators may prosecute.

Alertsec Xpress is used by organizations that have recognized the need to protect their information. Customers range from single-user sole traders and consultants to multinational companies with a large number of offices around the globe. Over 4 million users worldwide use Alertsec Xpress’s Check Point Full Disk Encryption.

Enhanced by Zemanta

Leave a Reply