Network Security News

Cyber Secure Institute calls for health IT security certification

Wednesday, May 27, 2009

A web security advocacy group has issued a call for better tools against the hacking of private health records, in response to high profile health data breaches at the University of California Berkeley and the Virginia Prescription Monitoring Program.

The Cyber Secure Institute - a Washington, DC-based nonprofit - said the Obama administration's proposals to vastly expand the use of electronic health records risk exposing more Americans to a loss of privacy.

"Any eHealth system must be built upon only certified secure, best available IT technologies," the group said Tuesday, citing two technologies certified by the NSA as secure against cyberattacks.

"Only systems like these that are tested, proven and certified at these high levels of security robustness should be trusted with the nation's private healthcare information," it said.

The institute issued recommendations for providing health data privacy and security as well as policy initiatives including establishing a trust fund to compensate victims of eHealth data breaches and the creation of a national data integrity oversight office charged with ensuring healthcare IT systems are sufficiently secure.

The group also called for statutory protections allowing victims of health data breaches to recover damages for potential fallout from leaked health information, including loss of employment, loss of insurance or harm to reputation.