Information security policy's impact on reporting security incidents
The New Health Privacy Rule, effective from April 14, 2003, has made it illegal for healthcare providers and insurers to release a patient's medical records without the individual's consent [Cropper, Carol Marie. How to keep prying eyes off your medical records. Business Week November 19, 2001;1302]. Rule provisions dictate that healthcare providers and insurers must have a written information security policy and present it to patients [Cropper, Carol Marie. How to keep prying eyes off your medical records. Business Week November 19, 2001;1302]. This paper evaluated the utility of having such a policy by examining the reporting of computer abuse incidents and the reporting of the seriousness of computer abuse incidents in those hospitals that either have or do not have a written information security policy. The premise of this study is that for an information security policy to be effective, computer abuse incidents and the seriousness of those computer abuse incidents must be reported. For this study, there were two factors that were examined for all respondent hospitals. The first factor was the reporting of computer abuse incidents that occurred the year prior to the study. The second factor was the reporting of the seriousness of computer abuse incidents that occurred the year prior to the study. Survey instruments were distributed to hospitals of various sizes, specialties, ownership, and types. The questionnaire collected information about the reporting of computer abuse incidents and their seriousness level to determine if an information security policy is effective in influencing the reporting of each. In addition, background information was collected from each hospital to aid in the analysis of the survey results.
security policy incidents medical records computer abuse seriousness deterrence