Case Study: Information Security Issue Macro-view of the Problem

The hospital faces a problem of end-user security: sensitive data is vulnerable to exposure in the workplace as the end-user methods of using computers in the hospital are ineffective to safeguard the data from theft. Personal health records are important for patients, but if privacy of data cannot be guaranteed, these records are more of a risk to personal privacy than a benefit with regards to having access to information. Nurses, on the other hand, require access to health information and they often need it quickly because of the amount of work they have to deal with routinely on their shift. While end-user security should be a top priority among nurses using facility computers and databases, it routinely is not—as Koppel, Smith, Blythe and Kothari (2015) point out: “a significant gap exists between cybersecurity as taught by textbooks and experts, and cybersecurity as practiced by actual end users” (p. 215). This gap is evidence that in the real world of health care, nurses and care providers are less concerned about systems security than they are about providing timely quality care to patients and quick access to information. Ideally, they would be concerned about both—but the real world often falls short of the ideal.

Conaty-Buck (2017) notes that “all healthcare employees should learn about cybersecurity risks and work to protect patient privacy and safety” (p. 62)—and that education should take place at school and carry over into the facilities where nurses work. In this case, both nursing department and the systems themselves need to be addressed. The nurses and care professionals (even the physicians) need re-education on what it means to safely use information systems and why it is important to follow the guidelines. The systems,...

The Privacy Rule has set national standards in terms of when personal health information (PHI) may be shared. In the case scenario, it is unknown who gained access to the HIV patient list or how it was shared—but someone who knew what to look for and where to look for it broke this privacy rule under HIPAA.
However, the Privacy Rule would not have been broken most likely had the Security Rule been better enforced. The Security rule provides a standard of safeguards to protect hospitals like this one so as to ensure the “confidentiality, integrity, and availability of electronic PHI” (HIPAA, 2016, p. 1). The Breach Notification Rule requires hospitals like this one to alert affected individuals that their personal health information has been stolen. The Rule also requires the care provider to alert the U.S. Department of Health & Human Services (HHS) and even the media if it is particularly expedient—though of course in this case the media needed no alerting. The problem is that it is unknown whether the hospital even knew about the breach before it was made public. If so, then the hospital also broke this rule regarding alerting the proper authorities and the individuals involved.

Two Similar Situations

On March 20, 2017, UNC Health Care—the University of North Carolina Health Care System sent out 1,300 letters to prenatal patients regarding a data…