A recent client, for instance, had 500 breaches a week of employee records because the human resources department was updating the records and transmitting information to the health insurer in an unsecured manner.
“So, they were breaching their own employees’ data on weekly basis,” Al-Abdulla said.
Malicious behavior accounts for only about 12 percent of breaches. The rest are mostly due to accidents, clueless behavior and technological glitches that are easily fixed, he noted. The first step to solving the problem of non-malicious breaches, he advised, is to identify data stakeholders who feel personal ownership of the information and want it protected.
Next, establish a baseline of where data is, how it’s moving and where it is going. Once that’s known, you’ll find that 30 percent of breaches are small issues or glitches that can be fixed fast. The next 30 percent of breaches are tied to a handful of broken processes, also easily fixable, such as teaching users to click the encryption link before sending. Al-Abdulla also suggested implementing technology that automatically notifies users at the moment a mistake is made, such as sending a message that the email just sent contained PHI and was blocked. “When you do that, people will change,” he said.
So, right off the bat, 60 percent of breaches can be cut without affecting employee work practices, Al-Abdulla said. The remaining 40 percent of non-malicious breaches primarily are accidents and many of these can be prevented with streamlined, effective communication to data users.
Instead of requiring employees to read and sign a long, all-encompassing document on privacy and security – which they won’t read but will sign – Al-Abdulla advised writing a half-page primer that explains what PHI is and how to protect it. The primer takes minute to read, “and each of them can tell their peers.”
This story originally appeared on Health Data Management.
Joseph Goedert is news editor at Health Data Management.
Be the first to comment on this post using the section below.