Wednesday, 14. September 2005
Progress Dragging on HIPAA Security Rules
Almost five months after the data security rules mandated by the Health Insurance Portability and Accountability Act went into effect, many health care companies still aren't fully compliant with them, according to IT managers and analysts. They said technology, process and budgetary issues continue to delay compliance efforts, along with what is seen as a weak enforcement component that has many health care organizations feeling that they can take a wait-and-see attitude toward the rules.
Tim Harrison, information security officer at Cincinnati-based Catholic Healthcare Partners, said the USD 3.2 billion not-for-profit company doesn't expect to be fully compliant with the security mandates for another two years. CHP, which operates 29 hospitals, has implemented many of the requirements but still needs to address the disaster recovery component, Harrison said. That part of the process has been put off because of a lack of IT staffers to dedicate to the task, he said, noting that CHP's security team has just two workers who are responsible for securing more than 2,000 servers across two data centres.