If not already, some recommended steps that I would put into place would be
re-access the Administrative, Technical and Physical Safeguards. In addition,
I would monitor user activity, have a two-step authentication with a 90-day
turnaround in changing the password, training for new staff, and annual
training to ensure everyone is updated with new policies and security
procedures. Also, have a great IT and security staff to ensure your firewalls
and antivirus software are good, so hackers or bugs can't get into the system.
The sad thing is data breaches or attempts at them are more frequent than we
may realize. If we can prevent them from happening in the smallest way, it
can lead to more information staying safe on a daily basis. Organizational
success depends on the privacy and security of the information they hold; if
patients do not think their medical information is safe at that organization,
that may keep them from seeking healthcare when they need it, or they will
find another healthcare organization that will, which could lead to more
patients leaving and the reputation of that organization declining and having
to shut its doors.
Monitoring these types of problems can be costly and take a lot of time from
everyone in that organization, so when we talk about what laws and standards
would apply, I would first say HIPAA should always be applied in every
situation in healthcare. Ethically it is never right to look at the information
that is not being used at the time of a healthcare need. Legally, the
organization could be penalized and/or fined for not preventing the
information from being taken.
