Analysis: Cloud-Based EHRs Not Most at Risk of Security Breaches

Although many physicians are concerned about the potential hacking of cloud-based electronic health record systems, a new analysis by consulting firm Software Advice finds that most recent health data breaches involved on-site computers, devices or paper records, Becker’s Hospital Review reports (Herman, Becker’s Hospital Review, 6/21).

Cloud-based EHRs store patient data on the Web in off-site servers rather than on local devices.

For the analysis, Software Advice examined 281 health data breaches affecting more than 500 individuals that were included on a list maintained by HHS’ Office for Civil Rights (Koploy, “The Medical Blog,” Software Advice, 6/20). OCR started posting the breach information in February 2010 (iHealthBeat, 5/3).

Key Findings

According to Software Advice, OCR categorized only seven data breaches as completely or partially involving EHRs, and all of those breaches involved on-site systems (“The Medical Blog,” Software Advice, 6/20).

The analysis noted that 75% of the health data breaches on OCR’s list involved on-site computers, hard drives or paper records. About 63% of the breaches resulted from the physical theft or physical loss of health records, the analysis found (Becker’s Hospital Review, 6/21).

According to Software Advice, the majority of HIPAA violations resulted from insufficient internal security, negligence or theft. Only 6% of the data breaches were related to hacking, the analysis found.

Conclusion

The analysis concludes that although many health care providers have expressed concern about the security of EHRs, the “systems themselves — and certainly cloud-based systems — have a pretty good track record” (“The Medical Blog,” Software Advice, 6/20).

Source: iHealthBeat