The execution of this task, however, is hindered by another security issue which is that the discipline of information security itself is not a well understood field within the healthcare industry. For one thing, the role of the Healthcare Chief Security Officer or Information Security Manager is a unique discipline charged with addressing organizational information protection issues. As such, the position or responsibilities should not be assigned as an additional duty but rather as a key player in the organization. Further, a realistic concept of an information security infrastructure is unusual in the industry. A week ago, I was told that a particular healthcare organization considered itself to have an information security program because it utilized audit trails.
Audit trails are, of course, one small component in a well structured program.
Finally, the issue of culture should be mentioned. The integration of security measures or technologies in healthcare is often met with resistance due to the level of transparency of the security practice demanded by healthcare practitioners. The technology must be transparent enough such that it in no way encumbers job function. Further complicating integration is the perception that information security practices and technologies will hinder providers. All agree accessing information quickly in emergency circumstances is critical.