A few weeks back it was announced that Health and Human Services was fining Providence Health & Services of Seattle $100,000 for health information privacy and security breaches. Apparently, on five separate occasions in 2005 and 2006, some laptops, disks and tapes containing the HIPAA-protected health information of about 386,000 people were taken from cars parked by Providence employees. In the another case, police and the FBI announced that they had recovered stolen University of Utah patient billing backup tapes that had been missing for about a month. As in the Providence incident, these tapes were also taken from a car — this one owned by Perpetual Storage, Inc., a company the University of Utah uses to store tapes off-site for disaster recovery purposes.
These incidents will no doubt become more fodder for health IT skeptics who will use them to support their argument that moving to an electronic, automated health care system puts personal health care data at risk. Predictably, I have another take.
First, Providence’s HHS fine is a prime example of the type of punishments and deterrents we need to ensure optimal health IT security. In fact, some might argue we could get even tougher. But the bottom line is that enforcing existing rules and laws in this way — and legislating even stronger penalties going forward — is a far more sensible solution to the perceived security issue than impeding health IT’s progress in general. Technology can do far too much good for our health care system and, by extension, our nation, to allow exaggerated security concerns to get in the way of its proliferation.
Also, it’s worth pointing out that each of the reported breaches in Seattle and Utah involved physical items (back-up tapes and other hardware) that were physically stolen from parked cars. The incidents were not the result of some IT security weakness; they were the unfortunate consequence of a series of careless mistakes, not one specific, singular failure. It’s not exaggerating to say that the information on those tapes was much safer when it was in electronic format than it was after it was transferred to a physical “thing.” Electronically, the data would have been protected with layers of security, passwords, user IDs, encryption and any number of other procedures. As it was, the physical items — much like the antiquated paper records still predominantly in use throughout the health care system today — proved much more susceptible to a compromise.
Finally, one of my chief points in making the case that electronic medical data is actually safer than hard copy has been that, even in the off-chance that someone would be able to hack into a system and retrieve sensitive personal health information, they wouldn’t be able to do much with the data anyway. As far as I can tell from the published reports, not one of the patients whose information was contained on the stolen Seattle and Utah hardware met any harm as a result of the thefts. This is in no way meant to diminish the severity of the crimes or the potential damage that could have befallen the victims, it is merely an illustration that, by its nature, medical information is far more difficult to misuse than that which we freely submit, say, in online banking and retail transactions.
Beyond doubt, as health IT efforts progress we must take every conceivable step to ensure that sensitive personal information remains as safe as it can possibly be. As technology evolves, so will our ability to protect data and as health IT becomes more prevalent, so should the laws and penalties governing it. Most importantly, we must take these measures as we make progress, not instead of making progress.
Subscribe