2020 State HIT Connect

HIPAA requires healthcare providers to perform a thorough and comprehensive risk analysis. Many times, these risk analyses turn up insufficient because the provider fails to identify every place where electronically protected health information (ePHI) is stored in their organizations thus putting patients and their data at risk.

One major and common blind spot are medical devices that capture, store and transmit patient data
on a regular basis and yet are not considered as “IT equipment” within many organizations. This leads to the classic “Who Owns the Data?” problem.

Failure to secure medical devices presents two main threats:
1. You can’t assess and secure ePHI if you don’t know where it resides.
2. Patient safety may be compromised by corrupted data or the compromise of unsecured medical devices.

The roundtable will focus on strategies to conduct a comprehensive risk identification and assessment exercise that covers all connected devices including medical devices.