Navigation Links
Study Shows Most Healthcare Companies Are Not Ready for New Privacy and Security Compliance Regulations

OAK BROOK, Ill., Nov. 11 /PRNewswire/ -- A recent survey of healthcare organizations found that 94 percent believe they are not ready to comply with the privacy and security provision of the Health Information Technology for Economic and Clinical Health (HITECH) Act. The new provisions take effect in February. The survey of 77 U.S. healthcare organizations was conducted by the Ponemon Institute and sponsored by Crowe Horwath LLP, one of the largest public accounting and consulting firms in the U.S.

The HITECH Act extends the Health Insurance Portability & Accountability Act's (HIPAA) rules for security and privacy safeguards, including increased enforcement, penalties and audits. According to the survey, many current HIPAA compliance programs have deficiencies in the areas of privacy and security, including inadequate program testing and failure to update the programs. Yet only 47 percent of the respondents feel they have the necessary funding and resources to fully comply with the new regulations.

"We believe that most organizations are not ready for HITECH as a result of compliance issues within their existing HIPAA programs," said Raj Chaudhary, a principal in Crowe Horwath's risk consulting group. "Even though most organizations acknowledge that their HIPAA compliance programs are deficient, our survey found that implementing necessary controls or securing third-party assistance to help ensure compliance may be limited due to budgetary restraints."

The study also found that 79 percent of organizations do not regularly have the required independent assessment or audit of their program to determine adequacy. Fifty-seven percent say they have known deficiencies concerning privacy or security, or both. Only 29 percent of respondents report no deficiencies.

Other survey findings include:

  • Most organizations experienced one or more data breach incidents involving the loss or theft of protected health information during the past two years. Ninety percent of respondents had a breach involving at least one protected health record.
  • Lack of management support may slow down compliance goals. Fifty-five percent of respondents report there is no management support for HITECH compliance.
  • Many organizations report significant gaps in their privacy and security programs. Sixty percent say their organizations have only partially implemented a risk-based program for protecting the privacy of protected health information (PHI). Approximately half of respondents say they do not provide adequate staff training for privacy and security. Forty-five percent believe their organizations have not effectively developed a privacy policy that clearly summarizes appropriate use and sharing of PHI.
  • Third-party assistance may be necessary for achieving certain compliance goals. Nearly half of all respondents said they may need assistance from a third party to conduct a detailed risk assessment. Forty-five percent need outside support for staff training, while 42 percent will need assistance in implementing procedures for fielding complaints. Thirty-nine percent will rely on help in developing the privacy program.
  • Responsibility for ensuring HITECH compliance varies considerably among organizations. Security leaders and chief compliance officers are the roles identified as most likely to be responsible for achieving HITECH compliance, according to respondents. Organizations with more than 5,000 employees were much more likely to see the security leader as having primary responsibility than smaller companies.

"It is disappointing, though not surprising, to learn that a majority of companies do not believe they are prepared for the latest in healthcare information security regulations," said Dr. Larry Ponemon, chairman and founder, Ponemon Institute. "Our research consistently finds that a lack of budgetary and moral support from the executive suite is a common barrier to proper data security and management programs, even with the specter of regulatory enforcement looming."

For more information about the survey findings, please visit Crowe Horwath and the Ponemon Institute will also be discussing the findings during a one-hour webinar on Nov. 17 at noon EST. To register, please visit

About the survey

Respondents were categorized by HIPAA classifications of covered entities and business associates. Of the 77 respondents, 45 were covered entities, which have to comply with the new regulations, including private and public healthcare providers and healthcare insurance companies. Thirty-two respondents were business associates, which include companies who handle patient data, such as professional services firms, pharmacies and public health care vendors. The largest number of respondents came from organizations with up to 1,000 full-time employees (37 percent), followed by those with 1,001 to 10,000 full-time employees (35 percent) and those with more than 10,000 full-time employees (28 percent). The most common job titles of those completing the survey were chief security officer, chief risk officer and IT manager.

About Crowe Horwath

Crowe Horwath LLP ( is one of the largest public accounting and consulting firms in the United States. Under its core purpose of "Building Value with Values®," Crowe assists public and private company clients in reaching their goals through audit, tax, risk and consulting services. With 25 offices and 2,500 personnel, Crowe is recognized by many organizations as one of the country's best places to work. Crowe serves clients worldwide as an independent member of Crowe Horwath International, one of the largest networks in the world, consisting of more than 140 independent accounting and management consulting firms with offices in more than 400 cities around the world.

About the Ponemon Institute

The Ponemon Institute© is dedicated to advancing responsible information and privacy management practices in business and government. To achieve this objective, the Institute conducts independent research, educates leaders from the private and public sectors, and verifies the privacy and data protection practices of organizations in a variety of industries.

SOURCE Crowe Horwath LLP

SOURCE Crowe Horwath LLP
Copyright©2009 PR Newswire.
All rights reserved

Related medicine news :

1. Top Five International Pharmaceutical Company Awards Comprehensive Cardiac Safety Study to iCardiac
2. Findings from New Study on Occupational Exposure to BPA of Limited Relevance to Consumers
3. Workplace BPA Exposure Increases Risk of Male Sexual Dysfunction, Kaiser Permanente Study Finds
4. Routine Evaluation of Prostate Size Not as Effective in Cancer Screening, Mayo Study Finds
5. Routine evaluation of prostate size not as effective in cancer screening, Mayo study finds
6. Anisakiasis hazard varies depending on the origin of the fish, according to a study
7. Center for Autism and Related Disorders Study Finds Hyperbaric Oxygen Therapy Ineffective Treatment for Children with Autism
8. Cataract Surgery Doesnt Worsen Macular Degeneration: Study
9. Hospital Financials Have Recovered to Pre-Recession Levels, According to Thomson Reuters Study
10. New Smells Etched in Brain: Study
11. Less than 1 in 3 Toronto bystanders who witness a cardiac arrest try to help: Study
Post Your Comments:
(Date:11/26/2015)... ... November 26, 2015 , ... ... wellness consultation, has collaborated with Women’s Web – an online resource for ... topics on mental and emotional well-being relationship, life balance, stress, professional development, ...
(Date:11/25/2015)... (PRWEB) , ... November 25, 2015 , ... ... potentially more aggressive than those found on mammography, according to a study published ... of additional cancers not seen on mammography may necessitate a change in treatment. ...
(Date:11/25/2015)... ... November 25, 2015 , ... ... preparing the perfect dish and pleasing the palates of attendees is of the ... a dish to a seasonal get-together, give these recipes a try this holiday ...
(Date:11/25/2015)... ... November 25, 2015 , ... Medical Solutions, ... again for its stellar workplace culture with the company’s Cincinnati office being named ... Solutions’ Cincinnati office was named a finalist in Cincinnati Business Courier’s 13th annual ...
(Date:11/25/2015)... (PRWEB) , ... November 25, 2015 , ... Dr. John ... to learn more about hair loss treatment with the Capillus272™ Pro laser therapy cap. ... solution for thicker and fuller hair, without the need for surgery, prescription pills, or ...
Breaking Medicine News(10 mins):
(Date:11/26/2015)... 2015 ... the  "2016 Future Horizons and Growth ... Monitoring (TDM) Market: Supplier Shares, Country ...  report to their offering.  --> ... addition of the  "2016 Future Horizons ...
(Date:11/26/2015)... 2015 ) ... "Radioimmunoassay Market by Type (Reagents & Kits, ... Clinical Diagnostic Labs), Application (Research, Clinical Diagnostics), ... report to their offering. --> ... of the "Radioimmunoassay Market by Type ...
(Date:11/25/2015)... OAKS, Calif. , Nov. 25, 2015  Amgen ... a Biologics License Application (BLA) with the ... (FDA) for ABP 501, a biosimilar candidate to Humira ... first adalimumab biosimilar application submitted to the FDA and ... pathway. Sean E. Harper , M.D., executive ...
Breaking Medicine Technology: