Health Care Industry Unprepared for HIPAA Security Provisions, URAC Report Finds
The health care industry is "unprepared to safeguard the confidentiality of patient data" in compliance with security provisions of the Health Insurance Portability and Accountability Act, according to a report released on Wednesday by URAC, a not-for-profit group that accredits health care organizations on quality issues, the Wall Street Journal reports. New HIPAA security provisions will take effect next April, and according to the report, "one year is barely enough time for laggard organizations to get their networks in order" as they shift from paper to electronic medical records, the Journal reports. The report found that only three of 300 health care organizations audited for security accreditation had comprehensive programs to ensure that they meet HIPAA requirements. Lisa Gallagher, a health information security expert and author of the report, said that most health care organizations have "inconsistent and poorly executed risk management strategies" to address security issues. The health care industry faces a number of security issues, such as disagreements over a standard for transmission of electronic medical records, lack of information technology systems at some hospitals and problems with "changing the work habits of health care workers who keep their computer passwords on Post-it notes on their keyboards," the Journal reports. The report includes a monthly schedule to help health care organizations assess their security issues and establish comprehensive programs to address them. Karen Trudel, acting director of HIPAA standards for CMS, which will enforce the HIPAA security provisions, said she "hasn't seen evidence that health care organizations are far away" from HIPAA compliance. She added that "this is a really good time for people to start thinking about HIPAA security if they haven't already" (Landro, Wall Street Journal, 4/29). The report is available online.This is part of the California Healthline Daily Edition, a summary of health policy coverage from major news organizations. Sign up for an email subscription.