How Safe is Your Medical Data? You Don’t Want to Know…

Feb 18, 2012 // by Karen Lopez // Blog, Data, Data Breach // 1 Comment

So you live in a country that has legislation requiring your health data to be protected and you believe it’s all safe. If you live in the US, think again.

According to a study by Ponemon Institute sponsored by MegaPath:

91% of small healthcare organizations (think your local doctor, dentist, optometrist or clinic) had experienced a breach of protected health information (PHI) in the previous 12 months; of those, 29% resulted in medical identity theft
52% of small healthcare providers rated their security technology plans as ineffective
43% had experienced medical identity theft in their organizations
55% of respondents had to notify patients of a data breach in the previous 12 months
On average, less than 10% of the respondents’ IT budgets are spent on security

You can register and download the entire paper at http://www.megapath.com/solutions/industry/healthcare/study/

I found this table the most ~~interesting~~ discouraging:

From a data governance and data protection point of view, I’d really expect to see ALL of those be 100%. My doctor recently moved to mostly electronic health records (as have most in my province), but I’m wondering what his answers to all of these questions would be. When I think about the 91% data breach numbers, I see this table as one of the key reasons that number is so high.

Even if you aren’t in a health-related organization, I’d expect your numbers to be higher. 63% backup and disaster recovery plans? How can we call ourselves professionals when this is life-critical information? Ultimately it is organization leadership who are responsible for protecting data. But I’ve always been concerned about how far we data professionals should go in ensuring that the public is protected from harm when data polices and practices are not sufficient. Should we not move to other projects? Report bad practices? To whom?

This is a US-based study and I’m curious about similar numbers in other countries with and without health data privacy legislation. If you have links to other sources, please provide them in the comments.