Security Issues Are Everywhere

Computerworld - Trouble T1cket

At issue: Letters containing HIPAA-protected health information are being handled laxly.

Action plan: Raise awareness of security issues beyond the confines of this one agency.

Something that arose last week shows that security is a never-ending battle, but it also demonstrates the importance of making everyone security-conscious.

The latest security lapse in my state agency was brought to my attention by the IT program manager in charge of the contract with the vendor that handles the processing of the agencys Medicaid claims. (Most of us at the agency had been blissfully ignorant of it.) Currently, he is working with the accounting department to figure out how to reduce copying and mailing costs. The vendor in question passes those costs on to us to the tune of about $1 million a year. Im all for saving taxpayers money, but why does it always seem that even our cost-cutting initiatives raise our security risks?

This program manager  lets call him Pete  hadnt always been very aware of security issues, but he and I had been working together on ensuring that the appropriate language outlining our security requirements was included in all our vendor contracts and requests for proposals. His new awareness came to the fore when he toured the states copy and distribution center and its mailroom to see whether we could pull the copying and mailing in-house to save some money.

What Pete found was that our agency regularly sends boxes of letters containing protected health information to the state copy center to be stuffed into envelopes and then mailed by the state mailroom.

Pete has spent enough time with me lately that this process triggered security alarm bells inside his head. Were answerable to the strictures of HIPAA. Pete asked his tour guide about the copy centers security procedures and learned that there werent any, really. Although key-code access readers had been installed on all the doors, they had never been activated. Internal doors werent locked, and employees moved about freely.

The boxes of letters are picked up by a state van and delivered to the copy room, where they are stacked with all the other agency requests and processed on a first-come, first-served basis. So they are transported insecurely and then left unattended in a room with lax security. I was starting to get a headache.

The copy room manager told Pete that he would be happy to comply with any security requirements we had and would be open to the idea of us giving his staff security training.