Pick up a newspaper or open your news portal and you’ll likely encounter a story detailing a data security incident within the health care industry. One would think that the health care sector wouldn’t need to worry about cybersecurity. Or perhaps these incidents are due to the many cybersecurity jobs going unfilled? Both of those assumptions would be incorrect.

HIPAA

2015 was the year of the health care data breach in the U.S. Like a punch in the nose, the health care sector has been stung and is a bit bloodied, but it is still in the ring.

The Department of Health & Human Services (HHS) Office for Civil Rights (OCR) is working closely with the Department of Justice (DOJ) to address health care security. They are taking a bite out of covered entities with the enforcement of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule.

The OCR noted that since HIPAA was enacted in 2003, the top five areas of investigation are:

• Impermissible uses and disclosures of protected health information (PHI);
• Lack of safeguards of protected health information;
• Lack of patient access to their protected health information;
• Lack of administrative safeguards of electronic protected health information; and
• Use or disclosure of more than the minimum necessary protected health information.

All these topics would fall within the expected purview of a health care entity’s CISO or IT team. Those entities most affected and required to take voluntary corrective action to achieve compliance are:

• Private practices;
• General hospitals;
• Outpatient facilities;
• Pharmacies; and
• Health plans (group health plans and insurance issuers).

When the OCR’s compliance investigation finds that the entity was in gross violation of HIPAA, it refers the case to the DOJ. Since the inception of HIPAA, the OCR has referred more than 560 cases to DOJ.

A number of covered entities found themselves on the receiving end of DOJ-mandated fines or settlements due to deficiencies in their HIPAA compliance programs. Covered entities are learning that to be HIPAA-compliant is not synonymous with being secure. Those who display their unwillingness to be secure will be materially affected.

Cybersecurity Jobs and Infrastructure

One might expect that private practices and pharmacies are of such diminutive size that outsourcing IT infrastructure would be prudent from a cybersecurity perspective. One might also believe that hospitals, outpatient facilities and health plans/insurers would have substantive resources to not only have a CISO, but to also have cybersecurity professionals on hand.

Entities of all sizes are in the hunt for skilled personnel. Reviewing open position requirements, one sees the need for qualified security personnel for the cybersecurity jobs. According to Modern Healthcare, more than 50,000 positions posted in 2014 required applicants have the crown jewel of security certifications: the Certified Information Systems Security Professional (CISSP).

That might be tough, as there are just under 68,000 individuals in the U.S. who have obtained their CISSP certification. The health care sector competes against all other industries for those individuals.

With the need clearly identified, there is no shortage of opportunities or cybersecurity jobs. Indeed, a review of the IT jobs within the Health Information and Management Systems Society (HIMSS) showed that the states of California, Florida, Texas, Pennsylvania, Ohio, New York, Illinois, Massachusetts, Virginia and Michigan were the top 10 centers where HIMSS IT talent is being sought.

The HIMSS predicted sustained growth of IT requirements within the health care sector. However, there is a dearth of qualified personnel. CIO discussed how the talent shortage in cybersecurity is hitting the health care arena hardest. One salient point is that there is a greater demand for IT professionals, including cybersecurity professionals, than budgets permit.

Are You Resourced?

CIO shared a question from Ernie Hood, senior research director for the Advisory Board Co., a large health care consulting firm based in Washington, D.C. He asked: “Is the barrier, ‘I can’t find people with the skills I need,’ or is the barrier, ‘I don’t have the resources from the organization to execute what they’re asking me to do?'”

Those in the health care sector with cybersecurity jobs to fill may want to step back and assess their resource distribution and realign to the reality. Invest now in cybersecurity or continue to be the ignoble poster child when the annual data breaches are tallied.