Commercial electronic health record (EHR) systems are vulnerable to exploitation given existing industry development and disclosure practices, concluded a study by the board of the eHealth Vulnerability Reporting Program, reported on Sept. 17. The 15-month study, which included a survey of more than 850 provider organizations, evaluated current industry information security practices, assessed levels of risk related to EHR systems, and benchmarked healthcare information security practices against other industries.
Among other findings, the study found that EHR vendors either are not disclosing or are inadequately disclosing system vulnerabilities to customers, preventing organizations from appropriately managing risk or implementing compensating controls. Also, the study could not identify any industry organization that has established guidelines or practices to appropriately mitigate and manage risks associated with e-health systems, or that has the responsibility, charter, or mission to address security vulnerabilities. Download the executive briefing.
