3 ms·

Does HIPAA motivate hospitals to take security seriously? The recent outbreaks in cryto-ransomware seem to suggest the answer is 'no.'

• lliw 9y ago
  Yes--HIPAA provides a mechanism for fines to be levied against (most) healthcare organizations that suffer data breaches through the office of civil rights (OCR), with a public reporting of organizations that have been penalized. https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/data/index.html https://www.hhs.gov/hipaa/for-professionals/compliance-enfor...
  • chimeracoder 9y ago
    > Yes--HIPAA provides a mechanism for fines to be levied against (most) healthcare organizations that suffer data breaches through the office of civil rights (OCR), with a public reporting of organizations that have been penalized. Unfortunately, HIPAA is an incredibly rigid, incredibly broad law, and it's applied to a field in which security practices are incredibly inconsistent. As a result, HIPAA violations are pretty commonplace, and the vast majority are never reported to HHS, let alone penalized.
• ef4 9y ago
  They take HIPAA seriously (because there are fines), but that is definitely not the same thing as taking security seriously.
  • freehunter 9y ago
    That's a big thing that many don't seem to understand: there is a massive gulf between compliance and security.
• dragonwriter 9y ago
  Having experience with hospital IT working for an outside vendor before HIPAA had much impacted practice (though after it was adopted), yes, I think it's made them take it much more seriously. That's not to say it's good now, but if you hadn't experienced it you probably can't imagine how bad it used to be.