Breaches affected 50% of hospitals in 2009.

• Position: HEALTH RECORDS

[ILLUSTRATION OMITTED]

A new survey reveals that business associates who handle private patient information for healthcare organizations--including billing, credit bureaus, legal services, claims processing, insurance brokers, data processing firms, pharmacy chains, and offshore transcription vendors--are not ready to meet the new data breach-related obligations included in the Health Information Technology for Economic and Clinical Health (HITECH) Act.

Healthcare Information and Management Systems Society (HIMSS) analytics national survey of hospitals and business associates revealed that about one-third of business associates surveyed were not aware that they need to follow federal Health Insurance Portability and Accountability Act (HIPAA) privacy and security requirements.

Of the hospitals and health providers surveyed, 85% said they would take steps to ensure that data held by business associates will not be breached. Nearly half of hospitals (47%) said they would actually terminate their contracts with their business associates for violations.

The survey also found that:

* Of large hospitals, 50% experienced at least one data breach in 2009.

* Of all hospitals, 68% indicated the HITECH Act's expanded breach notification requirements will result in the discovery and reporting of more incidents.

* Of all hospitals, 57% reported they now have a greater level of awareness of data breaches and breach risk.

* Of hospitals, 90% have changed or plan to change policies and procedures to prevent and detect data breaches.

Businesses that...