Obama's Support for Digital Health Records May Increase Identity Theft
President Obama has proposed sweeping reform of the nation's health care system and said he believes all medical records should be computerized and standardized within five years. The president hopes this will result in increased quality of care, decreased costs and the creation of thousands of new jobs.
Todd Feinman, a published security expert and CEO of Identity Finder, cautioned, however, that electronic medical records add higher risk of identity theft unless they are carefully protected. "The HIPAA Privacy rules have only been around for a couple of years. Many health care providers are still unprepared to protect patients' personally identifiable information (PII), which if stolen could lead to identity fraud."
Feinman discussed the special HIPAA compliance initiative his firm has enacted to ensure electronic patient health information (ePHI) is protected.
In 2006, the Health and Human Services issued final ruling regarding HIPAA enforcement and set civil money penalties for violating HIPAA rules. These regulatory requirements call for organizations to proactively protect patient health information, but still too often PHI ends up unprotected in a spreadsheet on a nurse's computer.
"If health care providers have a security breach, not only would that be a violation of patients' privacy, but also the associated costs would be dramatically higher than implementing some simple, preventive measures," said Feinman. The upcoming changes by the Obama administration could make organizations' exposure of PHI even worse.
Feinman's company has developed software that searches for and secures PHI, the type of sensitive information specifically referred to by HIPAA privacy legislation. Many health care providers and health care payers are now cleaning PHI from computers using Identity Finder.
Wayne Martin, information security officer at University of Virginia's Health System, said, "Identity Finder helps us locate patient health information so that we can protect it at the source and educate users on the proper handling of information in accordance with university, state, and federal policies."
Identity Finder has taken a ground-breaking approach by giving organizations insight into the root cause of the problem. Most organizations don't even know where their PHI is. "Not only do we help organizations find and protect PHI, but we also give them the ability to monitor how much exposure the organization has to unsecured PHI so they can prevent data leakage issues," said Feinman.
Identity Finder’s engineers have spent years developing proprietary search algorithms to find confidential personal information quickly and accurately. The software automatically finds PHI such as Social Security numbers, medical record numbers, dates of birth, driver’s licenses, personal addresses and other private data within files, e-mails, databases, Web sites and system areas. Once found, the software makes it simple for users or administrators to permanently shred, scrub or secure the information. Their recently released management console aggregates the data and provides a report card for organizations to see how their policies are performing.
Identity Finder can be run centrally by administrators or stand-alone on a PC or Mac by data owners. For this reason, Identity Finder is an ideal fit for both smaller and larger health care providers and payers, as well as other organizations that want to minimize their risks and prevent confidential data loss.