Will HITECH Heal Patient Data Hemorrhages?

Hemorrhages of confidential patient health data create privacy and security concerns. While the US HIPAA legislation on privacy and security went into effect over five years ago, healthcare information security remains a significant concern as organizations migrate to electronic health records. The recent HITECH legislation aimed at accelerating this migration contained mandates for greater security, including the addition of new requirements on breach reporting. We overview this legislation and examine a recently collected sample of inadvertently disclosed files found on internet-based file-sharing networks. We characterize the security risk of these files and also present evidence of the threat by analyzing user-issued searches. Our analysis indicates that the threat and vulnerability for the healthcare sector continued, even as HITECH became effective.