PRIVACY AND SECURITY OF ELECTRONIC INFORM TION A FOR HIPAA COMPLIANCE IN U.S. HOSPITALS

A study of 1,000 randomly selected U.S. hospitals was conducted to identify (1) the perceptions of HIPAA officers regarding the level of compliance attained toward meeting the security standards and (2) the security methods, hardware devices and software systems utilized. Usable surveys were received from 286 hospitals yielding a response rate of 28.6%. The top two security standards in which the respondents indicated the highest level of compliance were in obtaining required business associate agreements and in physical safeguards to limit access to electronic information systems. The two that were the farthest from compliance was policies for addressing security incidents and performing a periodic technical and non-technical evaluation of security practices governed by the Security Rule. The security methods, devices, and tools most commonly used were firewalls (73%), electronic authorization for entry into secure areas (58%), virtual private networks (43%), and secure web servers (37%)