By JOEL KUPERSMITH, MD
As shown by breaches of personal information on innumerable individuals over the years, our approach to IT security falls short. Recent intrusions at Sony Pictures Entertainment and Anthem Health (80 million individuals) against a backdrop of substantial losses of personal health (PHI) and other IT information previously again brought this deficiency again to public attention. According to one estimate, almost 1 billion records were stolen via 1500 breaches in 2014, a 78% increase from the previous year and a clear indication of an increasing problem. Among personal information, health records are particular targets, bringing in $20 per record versus $1-$2 for a credit card and surveys consistently show considerable public concern about the privacy of PHI.
In a recent commentary, David Brailer proposed that raised security standards for health information be one of four principles underlying new privacy legislation. I strongly agree and would add a specific step to apply this principle – privacy accreditation for health data custodians.
Whether the information is stored for care, insurance or research, the public lacks understanding of the complexity of their stored PHI and the large number of individuals with access to or custodial responsibility for it. There is thus a wide gap and power differential between data providers and those who hold enormous amounts of sensitive health data. This circumstance creates a need for an empowered intermediary to act on the public’s behalf, i.e. an accreditation body.






![healthcare_400x225[1]](https://thehealthcareblog.com/wp-content/uploads/2015/05/healthcare_400x2251.jpg)