The document discusses the ongoing issue of medical privacy breaches in healthcare, highlighting the significant financial and reputational damage these incidents can cause. It outlines the provisions of the HITECH Act, which provides funding to support electronic health record systems while expanding HIPAA's compliance requirements and enforcement penalties. The document emphasizes the need for healthcare organizations to implement strategic data classification and information management practices to better protect patient information and mitigate breaches.

1. F RENSICS
CORPORATION TM
HITECH for HIPAA
www.forensicscorp.com
info@forensicscorp.com
877.248.DATA
480.747.1732

2. Overview
Medical privacy breaches continue to be a serious problem for healthcare
and life sciences. Some of the most highly respected healthcare
organizations in the country still suffer data breaches, and new breaches
make headlines regularly. 4,479,859
Annual US Medical
Privacy Breaches
2,309,503 Source:
http://datalossdb.org
1,733,786
1,294,105
195,000
2004 2005 2006 2007 2008
“It takes 20 years to build a reputation and 5 minutes to ruin it.”
Warren Buffet
www.forensicscorp.com

3. The Good
• Buried within the Economic Stimulus Bill is the Health Information
Technology for Economic and Clinical Health (HITECH) Act.
• The HITECH Act provides approximately $31.2 billion for healthcare
infrastructure and adoption of electronic health records (EHR). The
Congressional Budget Office assumes that the Act will save federal healthcare
programs an estimated $12 billion from higher EHR use, resulting in a net
cost to the federal government of $19.2 billion.
• The money largely flows from Medicare and Medicaid incentives to
physicians and hospitals for the "meaningful use" of certified EHRs, including
existing systems as well as new installations or upgrades. Non-hospital based
physicians could receive up to $44,000 from Medicare or $64,000 from
Medicaid, and hospitals with high Medicare and Medicaid volumes could
receive up to $11 million. These incentives will be paid out over a 4- to 5-year
period beginning in 2011.
www.forensicscorp.com

4. The Bad
• Medical privacy breaches continue to be a serious problem for healthcare
and life sciences. Some of the most highly respected healthcare
organizations in the country still suffer data breaches, and new breaches
make headlines regularly.
• The HITECH Act expands HIPAA's coverage, increases compliance obligations,
and strengthens enforcement penalties.
• In response to the growing number of privacy breaches, the ARRA expands
the scope of the HIPAA Privacy and Security Rules.2
• Beginning on September 15, 2009, HIPAA-covered entities will be required
to notify individuals when their “unsecured” PHI has been compromised.
The new enforcement provisions will make compliance failure more costly
and visible to the public. These new requirements will require greater
efforts by healthcare-related organizations to protect PHI and increase the
risk of penalties, fines, and litigation.
15 workers fired for accessing Octuplet Mom’s File
Kaiser Permanente spokesman said Monday that this
was a violation of healthcare privacy laws…
Orange Country register UCLA Workers snooped in Spears’ Medical Records
March 30, 2009 The Medical Center is taking steps to fire at least
13 employees and is discipling others, including
doctors, for looking at the pop star’s confidential
files.
Los Angeles Times
March 15, 2008
www.forensicscorp.com

5. and The Ugly
• Medical privacy breaches continue to be a serious problem for healthcare
and life sciences. Some of the most highly respected healthcare
organizations in the country still suffer data breaches, and new breaches
make headlines regularly and consequences can be severe.
• To date, the consequences of health data breaches have fallen into two
categories: financial; and damage to an organization’s image and reputation.
• Monetary losses resulting from privacy breaches are due to fines, penalties,
legal fees, staff time spent responding to the incident, lost business, and in
the case for-profit HCOs, decreased stock valuation.
• Based on a recent Ponemon Institute study, the average cost per lost
healthcare record was projected to be $282 per record in 2008, or nearly $3
million for breach of 10,000 records.
• Across all industries, the average per-incident cost of privacy breaches in
2008 was $6.7 million, up from $6.3 million in 2007.
www.forensicscorp.com

6. Notable Breaches
HCO Date Exposed Records Exploit
Aetna 5/28/2009 65,000 Web
Kaiser Permanente 2/6/2009 29,500 Unknown
Baylor Health Care System 11/4/2008 100,000 Stolen Laptop
University of Utah Hospitals & Clinics 6/10/2008 2,200,000 Stolen Tape
NY – Presbyterian Hospital 4/11/2008 49,841 Internet Fraud
WellPoint 4/8/2008 128,000 Web
United Healthcare 6/25/2007 17,000 Internet Fraud
John Hopkins Hospital 2/7/07 52,000 Lost Tape
St. Francis Hospital 10/23/2006 260,000 Lost Media
Kaiser Permanente 7/27/2006 160,000 Stolen Laptop
Humana Medicare 6/3/2006 17,000 Web
Aetna 4/26/2006 39,000 Stolen Laptop
Source: http://datalossdb.org
http://www.privacyrights.org/ar/ChronDataBreaches.htm
www.forensicscorp.com

7. The Need for New Approach
• Electronic PHI (protected health information) can reside anywhere, which
means that healthcare organizations need to focus their efforts on protecting
sensitive information wherever it is stored. The aggressive promotion of HIT
systems, coupled with the exponential growth of digital storage, increases the
potential number and severity of data breaches and other security issues.
• Whether a result of hackers or employees, companies remain at risk of losing
or compromising information assets. In this difficult economic environment
with increasing regulatory demands, HCOs need to consider a more holistic
and efficient approach to information management based on a strategic
data classification program that discovers and controls PHI wherever it is
stored.
www.forensicscorp.com

8. The Challenge
• The fragmented approach to healthcare delivery also hinders efforts to
systematically and comprehensively manage PHI, resulting in inconsistent
approaches involving the use of ineffective methods and variable application
of methods known to be effective, and yielding unpredictable results.
• Most healthcare providers place a high priority on protecting the privacy of
PHI. However, with so many people from so many entities accessing PHI in so
many ways, their understanding of both the importance of this protection and
how to effectively facilitate it will inevitably vary. Something will undoubtedly
fall through.
• “Most companies do not have adequate processes or technologies to manage
their unstructured data. 75 percent said they were concerned that their
unstructured data was growing too rapidly. 63 percent said they did not have
adequate systems to manage it.” Computerworld survey of 250 large
companies
In 25 percent of reported data breaches, the organization did not
know how many records were compromised by the breach.
www.forensicscorp.com

9. The Solution
• Most data and privacy breaches are avoidable. Traditionally, organizations
have applied a networkcentric focus to securing systems, based on defined
confidentiality levels for storing and processing data.
• While still a necessary component, a more informationcentric approach is
needed today. Better control and protection of confidential and sensitive
information requires first an awareness of where data are stored and how it is
protected.
• Enterprises should implement a strategic information management program
by classifying data to help reduce their corporate risk exposure, decrease
information discovery times, improve compliance status, and potentially
realize significant cost savings through an effective data disposal program.
www.forensicscorp.com

10. The Solution
• Forensics Corp derives its strategic approach to building and executing a data
classification program from a logical and comprehensive workflow.
Analyze Realign
Define Data Discover Data
Security Practice with
Classification Schema Storage Areas
Deficiencies Policies
• With a successfully implemented data classification strategy, an HCO can focus
more heavily on where it must provide additional efforts and resources to
mature its information management program to a more strategic level
www.forensicscorp.com

11. The Solution
Because PHI can now be stored in digital form in myriad locations, healthcare-
related organizations must intensify their efforts to know where patient-
sensitive information is located and ensure that it is protected wherever it is
stored. The aggressive promotion of HIT systems, coupled with the exponential
growth of digital storage, exacerbates the number and severity of data breaches
and other security issues. Whether a privacy breach is caused by hackers or well-
intentioned employees, the damages and other consequences are the same. To
achieve the goals of the new legal requirements, healthcare-related
organizations will need to execute a strategic data classification program and
utilize a more holistic approach to information security management to better
safeguard protected health information.
www.forensicscorp.com

12. Forensics Corporation
Partnering Together To:
• Review, assess and update policies and processes.
• Establish a Data Classification / HITECH Team.
• Discover Data Storage areas.
• Analyze Risk.
• Realign Practice with Policy.
• Leverage technology to enforce policy.
• Provide training and good communication policies for
employees.
www.forensicscorp.com

13. Contact Us
Email: info@forensicscorp.com
Tel.: +1.480.747.1732 or
Tel.: 1.877.248.DATA (3282)
Or for more information visit us at:
www.forensicscorp.com
www.forensicscorp.com