Healthcare Security Pros Need To Speak The Language Of Finance

[InfoSec News <alerts () infosecnews org>]

http://www.darkreading.com/database-security/167901020/security/news/232602213/healthcare-security-pros-need-to-speak-the-language-of-finance.html

By Ericka Chickowski
Contributing Editor
Dark Reading
March 07, 2012

As the number of healthcare data breaches continues to snowball, 
executives put in charge of safeguarding protected health information 
(PHI) can’t keep up with the risks inherent with increased deployment of 
electronic health records (EHR) without enough financial backing to get 
the job done. And the only way that these PHI protectors can squeeze 
that juice from the C-suite is if they make themselves fluent in the 
language of financial justification, say authors of a new report out 
this week on healthcare IT security.

A collaboration between the American National Standards Institute 
(ANSI), via its Identity Theft Prevention and Identity Management 
Standards Panel (IDSP), in partnership with The Santa Fe Group/Shared 
Assessments Program Healthcare Working Group, and the Internet Security 
Alliance (ISA), the free report took input from 100 healthcare leaders 
from 70 organizations. It was the culmination of a yearlong initiative 
called the PHI Project. According to Rick Kam, president and co-founder 
of ID Experts and chair of the PHI Project, the team hopes to establish 
the document as the go-to resource for security and privacy officers 
taking a disciplined approach at assessing and mitigating risk of 
healthcare data breaches. He says that the state of the industry is such 
that those in charge of securing PHI are crying out for guidance.

“Because of the move toward electronic health records and the number of 
stakeholders that are now involved in handling our sensitive patient 
information, the PHI protectors are literally being outpaced in terms of 
their ability to protect our information,” Kam says. “The magnitude and 
the frequency of healthcare breaches has increased rapidly because of 
the number of stakeholders and the move to electronic health records. 
These individuals need help.”

One of the biggest ways they need help is in simply how to package PHI 
security issues in a way that makes sense to CEOs and CFOs. He and his 
co-authors found that these healthcare security initiatives are 
drastically underfunded and one of the main reasons is no one knows how 
to make a case for the cash.

[...]

______________________________________________________________________________
Certified Ethical Hacker and CISSP training with Expanding Security gives
the best training and support.  Get a free live class invite weekly.  Best
program, best price. http://www.ExpandingSecurity.com/PainPill