A recent PwC report suggests that most health organizations are not protecting patient privacy and secure personal health information. As the technology expands at a break neck pace, new uses for digital health data emerge and access to confidential patient information expands, old privacy and security controls no longer work to comply with existing privacy laws and patient consent agreements.
The report outlines how existing privacy and security controls have not kept pace with new realities in healthcare: increased access to information in electronic health records; greater data collaboration with external partners and business associations; the emergence of new uses for digital health information to improve the quality and cost of care; and the rise of social media and mobile technology to better and more efficiently manage patient health.
A recent nationwide survey of 600 executives from US hospitals and physician organizations, health insurers, and pharmaceutical and life sciences companies found:
Theft accounted for 66 percent of total reported health data breaches over the past two years. Also, medical identity theft appears to be on the rise. Over one third (36 percent) of provider organizations (hospitals and physician groups) confirmed that they have experienced patients seeking services using somebody else's name and identification.
More than half (55 percent) of health organizations surveyed have not addressed privacy and security issues associated with the use of mobile devices, and less than one-quarter have addressed privacy and security implications of social media.
More than half (54 percent) of health organizations surveyed reported at least one issue with information privacy and security over the past two years.
The most frequently reported issue among providers was the improper use of protected health information by an internal party. Over the past two years, 40 percent of providers reported an incident of improper internal use of protected health information.
The most frequently reported issue among health insurers and pharmaceutical and life science companies was the improper transfer of files containing personal health information to unauthorized parties. Over the past two years, one in five (21 percent) pharmaceutical and life sciences companies and one in four (25 percent) of health insurers improperly transferred files containing protected health information.
Full PwC report here.
