title: Security practices and regulatory compliance in the healthcare industry.
abstract: OBJECTIVE
  Securing protected health information is a critical responsibility of every healthcare organization. We explore information security practices and identify practice patterns that are associated with improved regulatory compliance.
  
  
  METHODS
  We employed Ward's cluster analysis using minimum variance based on the adoption of security practices. Variance between organizations was measured using dichotomous data indicating the presence or absence of each security practice. Using t tests, we identified the relationships between the clusters of security practices and their regulatory compliance.
  
  
  METHODS
  We utilized the results from the Kroll/Healthcare Information and Management Systems Society telephone-based survey of 250 US healthcare organizations including adoption status of security practices, breach incidents, and perceived compliance levels on Health Information Technology for Economic and Clinical Health, Health Insurance Portability and Accountability Act, Red Flags rules, Centers for Medicare and Medicaid Services, and state laws governing patient information security.
  
  
  RESULTS
  Our analysis identified three clusters (which we call leaders, followers, and laggers) based on the variance of security practice patterns. The clusters have significant differences among non-technical practices rather than technical practices, and the highest level of compliance was associated with hospitals that employed a balanced approach between technical and non-technical practices (or between one-off and cultural practices).
  
  
  CONCLUSIONS
  Hospitals in the highest level of compliance were significantly managing third parties' breaches and training. Audit practices were important to those who scored in the middle of the pack on compliance. Our results provide security practice benchmarks for healthcare administrators and can help policy makers in developing strategic and practical guidelines for practice adoption.
authors.affiliation: Tuck School of Business, Dartmouth College, Hanover, NH 03755, USA. juhee.kwon@dartmouth.edu
authors.forename: Juhee
authors.initials: J
authors.lastname: Kwon
authors.forename: M Eric
authors.initials: ME
authors.lastname: Johnson
mesh_terms: D057171:American Recovery and Reinvestment Act; D016000:Cluster Analysis; D016494:Computer Security; D003219:Confidentiality; D016002:Discriminant Analysis; D019983:Guideline Adherence; D019538:Health Care Surveys; D020408:Health Insurance Portability and Accountability Act; D006801:Humans; D008490:Medical Informatics; D014481:United States