Only half of healthcare IT pros use formal risk assessments
Posted on 22 November 2013.
Tripwire and the Ponemon Institute evaluated the attitudes of 1,320 respondents from IT security, IT operations, IT risk management, business operations, compliance/internal audit and enterprise risk management. One hundred seventeen health and pharmaceutical sector respondents from the U.S. and U.K. participated in the healthcare portion of the survey.


The health and pharmaceutical industries have undergone significant information security changes in 2013, and Health Insurance Portability and Accountability Act (HIPAA) fines have grown in both size and frequency. In August, Affinity Health Plan was fined more than $1.2 million for HIPAA violations and insurer WellPoint agreed to pay a $1.7 million penalty in July.

As the final omnibus rule goes into effect, new state healthcare exchanges place additional security and privacy pressures on healthcare organizations. Despite these regulatory pressures, Tripwire’s survey indicates that the healthcare industry lags behind other industries in the implementation of critical security controls.

Key findings include:
  • 70 percent say communicating the state of security risk to senior executives is not effective because communications are contained in one department or line of business.
  • Only 52 percent use formal risk assessments to identify security threats.
  • Only 58 percent have fully or partially deployed change control and security configuration management.
“It is true that healthcare organizations rank better than average in some areas of this survey, but there is still a lot of room for improvement,” said Dwayne Melancon, CTO for Tripwire.

“About half of healthcare and pharmaceutical organizations are not using any kind of formal risk assessments, and they are also far less open to challenging current assumptions. Both of these factors could cause them to be blindsided by the increasing number of cybersecurity threats to their businesses,” Melancon added.





Spotlight

How to talk infosec with kids

Posted on 17 September 2014.  |  It's never too early to talk infosec with kids: you simply need the right story. In fact, as cyber professionals it’s our duty to teach ALL the kids in our life about technology. If we are to make an impact, we must remember that children needed to be taught about technology on their terms.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Fri, Sep 19th
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //