Vendor compliance management: Are health care software vendors HIPAA compliant? - Information Security Magazine - Page 1

Vendor compliance management: Are health care software vendors HIPAA compliant?

Your doctor recommends you have an angioplasty to clear the arteries to your heart. At the hospital, you start in the admissions department, giving all your personal information to a stranger who enters it into a computer. What you don't realize is how vulnerable your personal information has just become and how many people who have nothing to do with your health care now have access to it.

Hospitals exist to take care of patients, not to write software, so they typically purchase it from third parties. HIPAA covers only health care and insurance providers but not the companies that produce software used in health care. How can the health care industry comply with HIPAA if the software companies are not accountable for the security of their products? Let's continue with our hypothetical visit to the hospital to uncover other software vulnerabilities and learn more about the importance

    Requires Free Membership to View

    Login

    SearchSecurity.com members gain immediate and unlimited access to breaking industry news, virus alerts, new hacker threats, highly focused security newsletters, and more -- all at no cost. Join me on SearchSecurity.com today!

    Michael S. Mimoso, Editorial Director

    By submitting your registration information to SearchSecurity.com you agree to receive email communications from TechTarget and TechTarget partners. We encourage you to read our Privacy Policy which contains important disclosures about how we collect and use your registration and other information. If you reside outside of the United States, by submitting this registration information you consent to having your personal data transferred to and processed in the United States. Your use of SearchSecurity.com is governed by our Terms of Use. You may contact us at webmaster@TechTarget.com.

HIPAA vendor compliance management.

The doctor runs you through a couple of tests to assess your condition. You are attached to a PC where an electrocardiogram is run. Little do you know that the administrative passwords on these PCs are the same at every hospital that uses them. The doctor then accesses your test results over the Internet using a laptop computer. When the doctor leaves, you notice that your results remain on the laptop screen for all to see.

After the EKG, the doctor orders a chest X-ray to take a closer look at your heart. A contracted radiologist in another country reads the image through the Internet via a Web server that accesses your information from the radiology database with a single administrative password sent in clear text. Although the data is SSL encrypted, the vendor doesn't know about Web server hardening or secure Web application development. The server is also several months behind with critical patches because the vendor has not yet authorized them.

The doctor determines you need an operation, but when you are wheeled into the hospital's heart center for the procedure, you are unaware that the software vendor for the hospital is working on the cardiology treatment application. The vendor uses a VPN that's always on, with a single username for all of its support staffers who have administrative access to the database.

This was first published in October 2007