IT Debate:HIPAA Internet security advice

The article presents valid concerns regarding the security of confidential health information. HIPAA or no HIPAA, all HCO's must protect such information. There have been numerous documented examples of confidential health information being sharedwith the public; many times for personal or political gain. In addition, the use of Internet-based Electronic Medical Records and Personal Health Records will require more stringent security. Regarding the proposed HIPAA violation fines: the proposed regulations differentiate civil penalties for inadvertent violations, versus more severe criminal penalties for knowingly using protected health information. It seems the proposed penalties "fit the crime".

Many organizations, especially vendors, are claiming that HIPAA compliance is similar to the Y2K initiative. Many technical system changes will be required to comply, especially for the transaction and code set standards. However, the change management effort is just as significant. HCO's will need to establish a "culture of confidentiality", requiring significant policy and procedure changes. This type of initiative must be driven from the top. HIPAA compliance must be an executive management business initiative, not anIS-driven technical initiative.

Also, let's not forget the purpose of the HIPAA regulations: "administrative simplification". I agree that HIPAA compliance will be costly. However, the regulations will hopefully result in standardized communications and improved security and privacy. Also, many HCO's may realize that some of the HIPAA strategic solutions may actually provide a competitive advantage.

I don't feel that the government should levy fines upon organizations that fall victim to malicious attacks from hackers. The loss of customer confidence is going to penalize those organizations more adequately than could a government agency. HCO?s should be sufficiently motivated by the market to maintain a secure environment for their clients.

HIPAA is a very big concern for all healthcare organizations; HIPAA will be setting the standard for security. Healthcare organization should view this as a "minimum" standard and estalish their security practice beyond regulation. Although no system is 100% hacker proof, an organization should be found guilty if they did not (in good faith) implement HIPAA's requirements. HCOs are very sensitive to patient information and don't want to run the risk of breaching patient confidentiality. Giventhat I work at an HCO and involved in electronic distribution over the web...Would I trust mine?...yes Would I trust another's..only after reviewing their security strategy.

This question was closed by the author