Navigation Links
Study Shows Most Healthcare Companies Are Not Ready for New Privacy and Security Compliance Regulations

OAK BROOK, Ill., Nov. 11 /PRNewswire/ -- A recent survey of healthcare organizations found that 94 percent believe they are not ready to comply with the privacy and security provision of the Health Information Technology for Economic and Clinical Health (HITECH) Act. The new provisions take effect in February. The survey of 77 U.S. healthcare organizations was conducted by the Ponemon Institute and sponsored by Crowe Horwath LLP, one of the largest public accounting and consulting firms in the U.S.

The HITECH Act extends the Health Insurance Portability & Accountability Act's (HIPAA) rules for security and privacy safeguards, including increased enforcement, penalties and audits. According to the survey, many current HIPAA compliance programs have deficiencies in the areas of privacy and security, including inadequate program testing and failure to update the programs. Yet only 47 percent of the respondents feel they have the necessary funding and resources to fully comply with the new regulations.

"We believe that most organizations are not ready for HITECH as a result of compliance issues within their existing HIPAA programs," said Raj Chaudhary, a principal in Crowe Horwath's risk consulting group. "Even though most organizations acknowledge that their HIPAA compliance programs are deficient, our survey found that implementing necessary controls or securing third-party assistance to help ensure compliance may be limited due to budgetary restraints."

The study also found that 79 percent of organizations do not regularly have the required independent assessment or audit of their program to determine adequacy. Fifty-seven percent say they have known deficiencies concerning privacy or security, or both. Only 29 percent of respondents report no deficiencies.

Other survey findings include:

  • Most organizations experienced one or more data breach incidents involving the loss or theft of protected health information during the past two years. Ninety percent of respondents had a breach involving at least one protected health record.
  • Lack of management support may slow down compliance goals. Fifty-five percent of respondents report there is no management support for HITECH compliance.
  • Many organizations report significant gaps in their privacy and security programs. Sixty percent say their organizations have only partially implemented a risk-based program for protecting the privacy of protected health information (PHI). Approximately half of respondents say they do not provide adequate staff training for privacy and security. Forty-five percent believe their organizations have not effectively developed a privacy policy that clearly summarizes appropriate use and sharing of PHI.
  • Third-party assistance may be necessary for achieving certain compliance goals. Nearly half of all respondents said they may need assistance from a third party to conduct a detailed risk assessment. Forty-five percent need outside support for staff training, while 42 percent will need assistance in implementing procedures for fielding complaints. Thirty-nine percent will rely on help in developing the privacy program.
  • Responsibility for ensuring HITECH compliance varies considerably among organizations. Security leaders and chief compliance officers are the roles identified as most likely to be responsible for achieving HITECH compliance, according to respondents. Organizations with more than 5,000 employees were much more likely to see the security leader as having primary responsibility than smaller companies.

"It is disappointing, though not surprising, to learn that a majority of companies do not believe they are prepared for the latest in healthcare information security regulations," said Dr. Larry Ponemon, chairman and founder, Ponemon Institute. "Our research consistently finds that a lack of budgetary and moral support from the executive suite is a common barrier to proper data security and management programs, even with the specter of regulatory enforcement looming."

For more information about the survey findings, please visit Crowe Horwath and the Ponemon Institute will also be discussing the findings during a one-hour webinar on Nov. 17 at noon EST. To register, please visit

About the survey

Respondents were categorized by HIPAA classifications of covered entities and business associates. Of the 77 respondents, 45 were covered entities, which have to comply with the new regulations, including private and public healthcare providers and healthcare insurance companies. Thirty-two respondents were business associates, which include companies who handle patient data, such as professional services firms, pharmacies and public health care vendors. The largest number of respondents came from organizations with up to 1,000 full-time employees (37 percent), followed by those with 1,001 to 10,000 full-time employees (35 percent) and those with more than 10,000 full-time employees (28 percent). The most common job titles of those completing the survey were chief security officer, chief risk officer and IT manager.

About Crowe Horwath

Crowe Horwath LLP ( is one of the largest public accounting and consulting firms in the United States. Under its core purpose of "Building Value with Values®," Crowe assists public and private company clients in reaching their goals through audit, tax, risk and consulting services. With 25 offices and 2,500 personnel, Crowe is recognized by many organizations as one of the country's best places to work. Crowe serves clients worldwide as an independent member of Crowe Horwath International, one of the largest networks in the world, consisting of more than 140 independent accounting and management consulting firms with offices in more than 400 cities around the world.

About the Ponemon Institute

The Ponemon Institute© is dedicated to advancing responsible information and privacy management practices in business and government. To achieve this objective, the Institute conducts independent research, educates leaders from the private and public sectors, and verifies the privacy and data protection practices of organizations in a variety of industries.

SOURCE Crowe Horwath LLP

SOURCE Crowe Horwath LLP
Copyright©2009 PR Newswire.
All rights reserved

Related medicine news :

1. Top Five International Pharmaceutical Company Awards Comprehensive Cardiac Safety Study to iCardiac
2. Findings from New Study on Occupational Exposure to BPA of Limited Relevance to Consumers
3. Workplace BPA Exposure Increases Risk of Male Sexual Dysfunction, Kaiser Permanente Study Finds
4. Routine Evaluation of Prostate Size Not as Effective in Cancer Screening, Mayo Study Finds
5. Routine evaluation of prostate size not as effective in cancer screening, Mayo study finds
6. Anisakiasis hazard varies depending on the origin of the fish, according to a study
7. Center for Autism and Related Disorders Study Finds Hyperbaric Oxygen Therapy Ineffective Treatment for Children with Autism
8. Cataract Surgery Doesnt Worsen Macular Degeneration: Study
9. Hospital Financials Have Recovered to Pre-Recession Levels, According to Thomson Reuters Study
10. New Smells Etched in Brain: Study
11. Less than 1 in 3 Toronto bystanders who witness a cardiac arrest try to help: Study
Post Your Comments:
(Date:6/25/2016)... , ... June 25, 2016 , ... ... and non-athletes recover from injury. Recently, he has implemented orthobiologic procedures as a ... area —Johnson is one of the first doctors to perform the treatment. Orthobiologics ...
(Date:6/25/2016)... ... 2016 , ... Conventional wisdom preaches the benefits of moderation, whether it’s a ... the bar too high can result in disappointment, perhaps even self-loathing. However, those who ... , Research from reveals that behind the tendency to set ...
(Date:6/24/2016)... Michigan (PRWEB) , ... June 24, 2016 , ... Those ... deal with these feelings, many turn to unhealthy avenues, such as drug or alcohol ... of Marne, Michigan, has released tools for healthy coping following a traumatic event. , ...
(Date:6/24/2016)... ... , ... Marcy was in a crisis. Her son James, eight, was out of control. Prone ... physically. , “When something upset him, he couldn’t control his emotions,” remembers Marcy. “If ... at my other children and say he was going to kill them. If we ...
(Date:6/24/2016)... , ... June 24, 2016 , ... Global law firm ... 2016 Legal Elite. The attorneys chosen by their peers for this recognition are considered ... Seven Greenberg Traurig Shareholders received special honors as members of this year’s Legal Elite ...
Breaking Medicine News(10 mins):
(Date:6/26/2016)... -- VMS Rehab Systems, Inc. ( ) reported today ... to build a strong and stable market for trading ... the OTC Markets-pink current trading platform. Explains ... seeing an anomaly in market trading activities that may ... Company, but shareholders and market players as well. I ...
(Date:6/24/2016)... FRANCISCO, Calif. , June 24, 2016 /PRNewswire/ ... ), a biopharmaceutical company developing novel therapeutics for ... unmet needs, today announced the closing of its ... of common stock, at the public offering price ... in the offering were offered by GBT. GBT ...
(Date:6/24/2016)... 24, 2016 The Academy of Managed Care ... that would allow biopharmaceutical companies to more easily ... make formulary and coverage decisions, a move that addresses ... medicines. The recommendations address restrictions in the ... the drug label, a prohibition that hinders decision makers ...
Breaking Medicine Technology: