Medical Data Breach Highlights Need For Encryption

Massachusetts Eye and Ear Infirmary could have avoided a $1.5 million fine with an adequate risk analysis and relatively inexpensive encryption measures, say IT experts.

Uncle Sam Shares 12 Top Health Apps (click image for larger view and for slideshow)
The recent data breach at Massachusetts Eye and Ear Infirmary (MEEI) and Massachusetts Eye and Ear Associates once again screams the message: Encryption, encryption, encryption!
The provider has agreed to pay a $1.5 million fine to the
Department of Health and Human Services (HHS)
, after allegations were made that Mass. Eye and Ear failed to comply with certain requirements of the
Health Insurance Portability and Accountability Act (HIPAA)
standards that govern the security of individually identifiable health information.
Mass. Eye and Ear declined to comment on the breach other than to release a
statement
that mentioned the hospitals proactive self-reporting of a doctors unencrypted laptop being stolen while he was traveling abroad in 2010. The statement went on to say: Given the lack of patient harm discovered in this investigation, Mass. Eye and Ear was disappointed with the size of the fine, especially since the independent specialty hospitals annual revenue is very small compared to other much larger institutions that have received smaller fines.
[ For another point of view on PHRs, see
Why Personal Health Records Have Flopped
. ]
HHS Office for Civil Rights released a
resolution agreement
for the incident. During an interview with
InformationWeek Healthcare,
Mahmood Sher-Jan, vice president of product management at data breach response specialist ID Experts, said the incident was a clear pattern of disregard on behalf of MEEI, as well as a failure to comply with a number of key elements of the HIPAA security rule.
…In one of the first items [in the agreement], they mention the issue is more than portable devices, Sher-Jan said. They concluded the entity didnt perform a risk analysis on an ongoing basis, and this goes all the way back to when the security rule was put into place back in 2005. Consequently, I think portable devices were impacted… [T]hey didnt have good policies and procedures around their own home devices, but also portable devices coming in and out that werent owned by the entity….
Chad Boeckmann, president at security program company Secure Digital Solutions, agreed with Sher-Jan and said in an interview that failure to conduct a risk analysis was the big thing that was highlighted in the agreement. For quite some time, they werent maintaining these requirements or being proactive. Its about maintaining due diligence, he said.
Boeckmann added the organization could have invested in encryption technology, which most likely would have cost them a tenth of the cost of their fine. The technology would have helped MEEI meet HITECH requirements, he said, as well as [help with] an organizational assessment to see their compliance with HIPAA and HITECH requirements, and manage the remediation to that degree.
InformationWeek Healthcare brought together eight top IT execs to discuss BYOD, Meaningful Use, accountable care, and other contentious issues. Also in the new, all-digital
CIO Roundtable
issue: Why use IT systems to help cut medical costs if physicians ignore the cost of the care they provide? (Free with registration.)

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Medical Data Breach Highlights Need For Encryption