By Neil Versel, contributing editor
June 20, 2006
Women & Infants Hospital of Rhode Island went live with a Cerner Millennium clinical information system Sunday morning. Just last week, the hospital's parent organization, Care New England Health System (Providence, R.I.), introduced secure, online personal health records for patients.
Neither would have happened so soon had Care New England not taken steps to secure its existing health-IT infrastructure across three hospitals, two fitness/wellness centers, and a home-health service, according to IT security manager Larry Pesce. "By us being proactive, it made [the Cerner implementation team's] job a little easier," Pesce says. "It was part of the design process," he adds.
Every quarter, Care New England tests its Internet-facing servers and interfaces as well as all computer equipment behind the organizational firewall for data integrity, viruses, worms, spyware, and susceptibility to hackers, through a technique known as rapid penetration testing. The testing would take several weeks if IT staff had to research vulnerabilities to Windows, Internet Explorer, and other ubiquitous desktop tools, but a little bit of outsourcing cut the process down to a few hours.
Care New England has used Core Impact software from Boston-based Core Security Technologies to run quarterly penetration tests for the past two years as a means of protecting the network and meeting HIPAA security standards.
"HIPAA doesn't say that you have to do pen testing," Pesce notes. The regulations only require healthcare providers to take steps to ensure data security, leaving compliance strategies up to each covered entity. "Our organization determined that penetration testing was one of the ways to do that," says Pesce.
He calls the networkwide penetration testing a "sanity check" to make sure the IT department covers all its bases when it comes to data protection. "It's better for us to find out [vulnerabilities] on our own than to have Joe Hacker find them for us," Pesce says.
According to Pesce, such testing on a regular basis would be prohibitively expensive for the not-for-profit health system without trusted third-party software. "That reduces a good portion of the research time that we would have to pay staff for," Care New England's IT security chief says.
Source: Health It
http://tmlr.net/jump/?c=21060&a=296&m=3863
