IT departments in health care organizations put a lot of effort into developing policies to protect patients’ protected health information and other sensitive data. But they often face one obstacle preventing those rules from being effective: 

Executives often ask to be granted exceptions to IT policies. When IT gives in to those demands, not only does that increase the risks that the information those execs handle will be compromised, but it also sets a bad example for others in the company and makes it more difficult to get them to follow the rules.

Making exceptions to some policies for executives is fairly widespread, according to a recent survey from IT staffing firm Modis regarding companies actions regarding online streaming of the annual NCAA college basketball tournament.

With the games available online — and many played during work hours in the early rounds — some organizations decided to limit users’ access to the games. Among the 502 IT pros surveyed by Modis, 34% had planned to either block or throttle access to the video streams. That was in addition to 48% that were already placing restrictions on viewing non-work content.

However, policies exceptions are often made, according to survey respondents. Two-thirds of IT pros said they would allow access for the company’s CEO or president, while 52% would do the same for senior employees.

Talk to execs about IT policies

Here are some steps IT managers can take if they’re asked to grant a policy exception:

• Consider how serious the impact of the policy loopholes could be. Granting a few people access to streaming video likely won’t cause security issues, but it could affect network performance, depending on the organization’s bandwidth. IT should consider the likely impact of granting policy exceptions before they decide whether to say yes or put up a fight.
• Explain the reason for the policy. In some cases, the exec or manager might just not understand why a rule is important and may back off after it’s properly explained.
• Describe the impact the exception will have the organization’s performance. Execs will be more likely to understand IT’s position if it’s clear how violating policies could threaten the security of patient information, or harm productivity and make it harder to get others to follow the rules.

The post How to respond when health execs won’t follow IT policies appeared first on Healthcare Tech Review.

Healthcare employees are bringing personal devices to work – whether their employers say it’s OK or not. That’s why security experts say it’s critical to create an effective BYOD policy. 

In the past year, nearly all (89%) of healthcare workers have used a personal smartphone for work, according to a recent survey from Cisco.

That’s good news for healthcare organizations in some ways. There are a few benefits providers get from employees working on their own smartphones and tablets, such as higher productivity and morale.

But those personal devices introduce several security, legal and other risks, too. For healthcare organizations, the biggest scare is that a smartphone or tablet holding sensitive patient information will be lost or stolen, leading to a serious data breach.

In addition, information could be stolen via mobile malware or other types of security attacks.

To take advantage of the benefits of Bring Your Own Device (BYOD) programs while managing the risks, healthcare organizations must create a clear and effective BYOD policy that limits what devices employees may use and how they may use them.

When writing a BYOD policy, these are some of the most common mistakes organizations make that can increase information security risks:

1. Not having a BYOD policy

Unfortunately, one of the most common BYOD policy mistakes that organizations make is not having a policy at all. Despite the fact that the majority of employees are doing work on personal smartphones and tablets, many organizations in all industries have not yet issued formal policies and procedures regarding those devices.

In fact, among 650 IT pros surveyed last year by the SANS Institute, only 38% said their organization had a BYOD policy in place.

Other alarming stats from the survey:

• More than 50% of respondents rely on users to protect their devices from potentially hostile applications
• 40% don’t track mobile devices on their network, and
• Only 20% use mobile device management software as a way to control devices.

Most experts agree that employees will bring their own devices to work whether IT has a policy or not — therefore its’ better for companies to control BYOD as best as they can, rather than ignore the issue.

The first step is to create a policy outlining key elements such as:

• What devices and mobile operating systems are approved for use on the network
• What security features and settings must be enabled for a device to have access
• What types of data the employee is allowed to store on a personal device
• What apps employees can and cannot install, and
• What actions the organization is allowed to take in terms of managing and monitoring a personal device.

2. Not enforcing security controls

Part of a healthcare organization’s BYOD policy should state that only smartphones and tablets that meet minimum security requirements should be allowed to be used for work. However, there’s a second important part of the process many organizations neglect: enforcing that those security controls are being used.

The most popular way of doing that is to use mobile device management (MDM) software to prevent devices that don’t satisfy IT’s requirements for security controls onto the network.

It seems many organizations aren’t taking enough steps to enforce the BYOD policy. According to Cisco’s survey, many employees who work on their own devices fail to take some pretty basic steps to protect mobile security. For example:

• 40% don’t use password protection on their devices
• 48% have kept their devices discoverable over Bluetooth, which means a near-by hacker could scan for the device and download sensitive data
• 52% access unsecured wireless networks with their devices, and
• 86% say their employer wouldn’t be able to remotely wipe a device if it were lost or stolen.

3. Not having employees sign off on the policy

Once a clear, effective BYOD policy it’s written, organizations must make sure employees read and sign off on the policy before they bring a personal smartphone or tablet to work. That’s critical for two big reasons.

The first is that it will make sure employees know what the policy is. Employees often claim ignorance when it comes to IT’s rules, and when it comes to their own personal devices, many might assume that there’s no BYOD policy at all.

The second reading is that having employees sign the policy could help avoid some legal trouble or other complaints down the road based on actions IT may have to take with a personal smartphone or tablet. For example, if a device containing sensitive patient data is lost or stolen, the organization will likely want to remotely wipe it.

Since the device will also contain the employee’s own personal data and media, it’s important the employee is aware of the risk and gives IT the right to do so before participating in the BYOD program.

The post Top 3 BYOD policy mistakes healthcare organizations make appeared first on Healthcare Tech Review.

Click here to read the free whitepaper!  

The post Strategy Guide for Cost-Effective Storage for Healthcare appeared first on Healthcare Tech Review.

Click here to learn more!  

The post Compare Free Price Quotes on Medical Billing Services appeared first on Healthcare Tech Review.

As electronic health records become more commonplace, doctors, nurses and other people that use EHRs on a daily basis are becomingly increasingly frustrated with those systems. Many users report that the EHR systems their organizations have in place are difficult to use, decrease rather than improve efficiency, and come with sub-par technical support from vendors.

Overall satisfaction with EHR systems dropped by 12% in 2012 compared to 2010, according to a  study presented by the American College of Physicians and AmericanEHR Partners at the recent Healthcare Information Management Systems Society Annual Conference in New Orleans. In addition, among the 4,200 physicians surveyed, 39% said they would not recommend their current EHR system to a colleague — an increase from 24% who said the same thing in 2010.

That kind of dissatisfaction is leading doctors to find workarounds for poorly designed EHR systems, according to a recent from two VA medical centers published in the Journal of the American Medical Informatics Association.

Researchers observed 120 doctors and other clinical staff members using EHRs at 11 primary care clinics. What they found was that users often resorted to using workarounds when an EHR system made it difficult to perform a necessary task. Often, that included using a paper-based process.

For example, some employees found it difficult enter patients’ answers to health screening questions into the EHR when the staff member who usually handled that task was absent. In those cases, the answers were written down on paper to be entered later.

In other cases, doctors and employees used handwritten notes to quickly pass along information to each other, because their EHR system didn’t have any capabilities for easy internal messaging.

And finally, for some of the clinics, paper records were kept because doctors didn’t trust the EHRs would always be available.

That prevalence for finding workarounds is bad news for healthcare organizations. If doctors and other staff aren’t using EHRs to their full capabilities, that means organizations aren’t getting the maximum value out of their health IT investments.

Part of the reason may be that doctors aren’t trained enough in the benefits of EHRs. But a large part of the problem is also likely that EHR systems aren’t easy enough to use. That’s why healthcare organizations need to get clinicians involved in the process of selecting EHRs, so the organization can be sure it’s getting a system its doctors will use.

The post Report: Doctors switch to paper records when EHRs don’t get the job done appeared first on Healthcare Tech Review.

It’s important to learn from prior mistakes to prevent similar incidents in the future.

That’s one of the reasons Oregon Health and Science University (OHSU) made headlines after experiencing two breaches of sensitive data in less than a year.

Both incidents even had a similar cause, which was the theft of a computing device after an employee took it off of the hospital’s premises.

Last July, OSHU announced that information about 14,000 patients may have been compromised after a USB drive was stolen from an employee’s home. The drive was used in the hospital for the purposes of moving data from one computer to another. However, officials said the employee had mistakenly taken the storage device home in a briefcase.

Fortunately, according to OSHU, the drive was encrypted and the data was password protected.

New data breach caused by unencrypted laptop

However, that wasn’t the case in the second incident announced recently by the hospital. In that breach, a laptop containing information about 4,022 patients was stolen from a surgeon’s vacation home.

The computer’s desktop and folders didn’t contain any sensitive information, but the patient data was contained within an email system used for scheduling operations.

While the laptop was password protected, OSHU said, it was not encrypted. The hospital’s policy requires all machines to be encrypted, but the stolen laptop was purchased to be used for research purposes and didn’t fall under that policy. The doctor who took the computer on vacation mistakenly believed that emails wouldn’t be stored locally on the machine.

However, to prevent incidents like this in the future, officials said the hospital has made its encryption policy more strict.

As these and other recent breaches show, many healthcare organizations have policies about encrypting drives and computers and banning doctors and employees from taking sensitive data home with them — but often, those policies aren’t enforced.

To protect data, health IT departments can not only develop strong policies and train doctors and other staff members about them, but also take steps to make sure they’re followed, such as encrypting all devices that are distributed and disabling USB ports to prevent people from loading data onto portable drives without authorization.

The post Hospital suffers two data breaches due to stolen computing devices appeared first on Healthcare Tech Review.

In some cases, that includes taking a patient to court because of negative online reviews.

Dr. David McKee of Minnesota recently lost a court battle in which he sued a patient’s son who had written negative comments about McKee on several doctor rating websites.

The negative reviews were related to comments McKee had made to the patient and his family. Though McKee claimed the online reviews hurt his reputation and his business, the court threw out the case on the grounds that the comments were true and therefore not defamatory.

Docs rarely win those cases

McKee isn’t the only doctor who’s gone to court recently because of negative online reviews, says a story in the Boston Globe. According to the Digital Media Project at Harvard University, there have at least seven court cases over the past five years or so related to online reviews of doctors.

Those lawsuits show how difficult it is for doctors to win. In all of those cases, patients either agreed to take down their comments to avoid a suit, or the court threw out the case.

In one of the incidents, a neurosurgery patient posted several negative comments about a surgeon online, including insinuations that the doctor was responsible for creating an unusually high risk of death for patients. But when the surgeon sued, the court threw out the case on the grounds that the patient was engaging in free speech about a public issue. The doctor was ordered to pay $50,000 in legal fees.

Most experts warn doctors against taking legal action because of negative online reviews. In addition to the potential for losing a costly legal battle, they warn that in many cases, filing a suit only brings attention to the patient’s complaints.

On top of that, the majority of doctors believe that online ratings have no impact on their business and don’t believe patients give them much weight when they make health care decisions.

What’s the best way to deal with those ratings? See our earlier post on the most effective ways to respond to negative online reviews.

The post More doctors sue over bad online reviews appeared first on Healthcare Tech Review.

Click here to learn more!  

The post iPad EMR & Tablet PC EMR Software Buyer’s Guide appeared first on Healthcare Tech Review.

Click here to learn more!  

The post Get Free Price Quotes on Healthcare CRM Software appeared first on Healthcare Tech Review.

Many hospitals are concerned about finding qualified job applicants with the right health IT skills. Here’s how they’re changing their recruiting approaches to land top talent. 

In part due to government pressure, healthcare organizations are tackling some important health IT projects right now. In addition to the transition to electronic health records and the adoption of health information exchanges (HIEs), providers are also being tasked with converting to the new ICD-10 code set.

That requires some big changes to health IT systems, as well as general changes to hospitals’ and practices’ workflows. Concern from providers about being able to make the transition forced the government to delay the deadline multiple times, before settling — seemingly for good — on October, 2014.

While some observers still worry about whether that gives providers and other organizations enough time, especially consider many are making the switch to EHRs at the same time, there was some good news to be found in a recent report released by the Healthcare Information and Management Systems Society (HIMSS).

Among the 298 hospitals surveyed by HIMSS, most (87%) said they expected to be ready for the ICD-10 transition before next year’s deadline.

In addition, the survey found:

• 66% of hospitals have already quality for Stage 1 of meaningful use to receive EHR incentive payments
• 75% expect to quality for Stage 2 meaningful use in 2014, and
• 51% are already participating in at least one health information exchange.

More than half of hospitals looking for health IT skills

That good news doesn’t mean that hospitals aren’t facing any obstacles as they carry out their health IT plans. The biggest challenge providers will need to overcome to keep those projects on schedule: a health IT skills shortage and a lack of qualified applicants for health IT jobs.

EHRs, ICD-10 and HIEs all require a lot work from IT staff, and as a result more than half (51%) of survey respondents said their organization plans to add staff to the IT department over the next year. The greatest area of need is clinical application support, followed by network architecture and support and clinical informatics.

That was down a little bit from the 61% who said the same thing a year ago. However, as more health IT jobs have been created over the past few years, applicants with health IT skills have been harder to come by, and 21% of hospitals are worried that projects could be jeopardized due to the difficulty finding qualified staff.

A health IT skills shortage was cited as the biggest barrier to health IT adoption for the second year in a row, beating out other concerns, including:

• A lack of financial support (cited by 15% of respondents), and
• An inability to find vendors and products that satisfy their needs (13%).

Improve recruiting and retention: 3 keys

The findings in the HIMSS report are consistent with other research that has highlighted the fact that employees with the right health IT skills are difficult to find right now. For example, a recent CareerBuilder survey found that 23% of healthcare providers currently have open health IT jobs they’re struggling to fill.

In addition to difficulty finding new staff members, the demand for health IT skills means hospitals are also having a more difficult time hanging on to current members of the IT staff.

As a result, healthcare organizations are being forced to change their approach to recruiting and retention when it comes to health IT jobs, according to a recent ComputerWorld article. These are some examples of the steps providers are taking now to find and keep top health IT talent:

1. Increasing workplace flexibility — Salary of course is important for recruiting and retention, but so are many low- or no-cost benefits. For health IT pros, one of the best benefits to offer is a flexible working environment — including the chance to work from home when possible. ComputerWorld cited the example of one hospital that took a survey of its staff and found that IT employees who were allowed to telecommute were more satisfied with their jobs than those that weren’t permitted to do so.
2. Offer project management opportunities — Room to advance in a career is also a key benefit for health IT workers. While hospitals won’t be able to offer promotions to every valued employee, they can increase their top staff members’ responsibilities and give them valuable experience by letting them manage a project.
3. Reach out to local schools — As health IT skills have become more valuable, colleges and universities have started to respond by offering degree programs in health IT. Hospitals can reach out to those schools and offer internships and schedule recruiting events in order to get access to the emerging talent pool as soon as possible.

The post Health IT skills shortage threatening important projects appeared first on Healthcare Tech Review.