Rick Kam, President and co-founder ID Experts

2013 is the Year of the Snake in Chinese culture. In the healthcare world, I predict 2013 will be the Year of the Data Breach. The numbers back me up: 94 percent of healthcare organizations surveyed suffered data breaches, according to the Third Annual Benchmark Study on Patient Privacy & Data Security, a report recently issued by Ponemon Institute. Given their frequency, data breaches have become what I call an everyday disaster.

Healthcare organizations want and need to protect against organizational and financial stresses of data breaches, but the pervasive nature of electronic protected health information (PHI) makes this a difficult task — an understatement — to be sure.

Nonetheless, I agree with Richard Santalesa, senior counsel at InfoLawGroup LLP: “Resist the urge to ‘skimp’ on security in 2013, thinking ‘we already do enough.’ With fines, penalties and enforcement actions increasing, capable data security personnel, demonstrably solid systems and regular risk reviews should be kept far from the chopping block even in increasingly challenging fiscal environments.”

Data breaches don’t have to be disastrous if organizations take steps to operationalize pre-breach and post-breach processes to better protect patient data and minimize breach impact. With that in mind, a handful of colleagues and I assembled a list of 11 recommendations for a healthier organization in 2013 — and beyond:

1. Establish mobile device and Bring Your Own Device (BYOD) policies that include technical controls and employee and management procedures. I started off with mobile devices for a reason. According to the Ponemon study, 81percent of organizations permit employees and medical staff to use their own mobile devices such as smartphones or tablets to connect to their networks or enterprise systems such as email. This means PHI can travel on unsecured devices in the pockets or purses of well-meaning healthcare employees — devices that are subject to theft or loss.

The Ponemon report listed actions some healthcare organizations are taking to secure mobile devices: limiting access from devices to critical systems, including those that connect to PHI, and requiring users to read and sign an acceptable use policy prior to connecting to these systems. Even the Department of Health and Human Services has issued strategies for managing the use of mobile devices in a healthcare environment.

[Related Article: Annual Study Reveals Reasons Data Breaches On The Rise]

2. Control the cloud or it’ll control you. Make it a point to fully understand what cloud service-level agreements mean in practice and then push for meaningful information on failover and disaster recovery practices used. – Richard Santalesa, senior counsel, InfoLawGroup LLP

3. Have a current breach response plan that is ready and tested. This will help pave the way for a well-executed response that can mitigate the financial, legal and reputational harm caused by a security incident involving patient information. – Marcy Wilder, partner and director of global privacy and information management practice, Hogan Lovellis

4. Conduct small but focused risk assessments. This means rotating control review on a monthly basis to continually understand and measure risk. Most importantly, have a plan to address the risk, through remediation, mitigation or risk transfer activities. – Chad Boeckmann, president and chief strategy officer, Secure Digital Solutions, LLC

5. Immunize mobile devices against viruses that might steal patient data. –Larry Ponemon, PhD, chairman and founder, Ponemon Institute

6. Attack your leadership team with phishing and other social engineering campaigns. Nothing raises awareness like catching people and correcting them on the spot—and it’s a lot more interesting than the annual 30-minute online security training. – Michael Boyd, Director of Information Security Management, Providence Health and Services

7. Use a checklist to evaluate periodically whether covered entities and business associates are in compliance with all privacy and security requirements. Sign and date the checklist to show that your organization is not guilty of “willful neglect” in complying with privacy and security laws. – Jim Pyles, founding partner, Powers, Pyles, Sutter and Verville, P.C.

8. Educate all staff to recognize applications, mobile devices and medical equipment that collect, contain or transmit patient information and/or biometric data. Then train them to communicate the risk to those responsible for information security management. – Christina Thielst, FACHE, vice president, Tower

9. Decide how to handle the residual risk of a data breach. This includes how much risk to accept, and how much, if any, risk to transfer through cyber insurance. – Christine Marciano, president, Cyber Data Risk Managers LLC

10. Boards should ensure their organizations have robust, board-reviewed and approved security policies and procedures. – Larry W. Walker, president, The Walker Company

11. “Big data” is a source of both the disease and the cure for privacy and information security symptoms. Currently, we have to deal with data minimization, but in the future, look for applications that may collect broadly, but protect against unauthorized disclosure or misuse very, very well.  – Jon Neiditz, partner, Nelson Mullins Riley and Scarborough LLP

Patient information is at risk for infection. If healthcare professionals commit to a healthier organization, however, they can prevent what is otherwise a “common cold” data breach from becoming life-threatening pneumonia. These strategies are a good start.

This article was originally published on Government Health IT and is used here with permission. Rick Kam, CIPP, is president and co-founder of ID Experts. Rick is also chairing the “PHI Project,” a research effort to measure financial risk and implications of data breach in healthcare, led by the American National Standards Institute (ANSI), via its Identity Theft Prevention and Identity Management Standards Panel (IDSP), in partnership with the Shared Assessments Program and the Internet Security Alliance (ISA).