title: When it comes to securing patient health information from breaches, your best medicine is a dose of prevention: A cybersecurity risk assessment checklist.
abstract: BACKGROUND
  Health care stakeholders are concerned about the growing risk of protecting sensitive patient health information from breaches. The Federal Emergency Management Agency (FEMA) has identified cyber attacks as an emerging concern, and regulations such as the Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health Act (HITECH) have increased security requirements and are enforcing compliance through stiff financial penalties.
  
  
  OBJECTIVE
  The purpose of this study is to describe health care breaches of protected information, analyze the hazards and vulnerabilities of reported breach cases, and prescribe best practices of managing risk through security controls and countermeasures. Prescriptive findings were used to construct a checklist tool to assess and monitor common risks.
  
  
  METHODS
  This research uses a case methodology to describe specific examples of the 3 major types of cyber breach hazards: portable device, insider, and physical breaches. We utilize a risk management framework to prescribe preventative actions that organizations can take to assess, analyze, and mitigate these risks.
  
  
  RESULTS
  The health care sector has the largest number of reported breaches, with 3 major types: portable device, insider, and physical breaches. Analysis of actual cases indicates security gaps requiring prescriptive fixes based on "best practices."
  
  
  CONCLUSIONS
  Our research culminates in a 25-item checklist that organizations can use to assess existing practices and identify security gaps requiring improvement.
authors.affiliation: University of Dallas.
authors.forename: Sandra J
authors.initials: SJ
authors.lastname: Blanke
authors.affiliation: Appalachian State University in Boone, North Carolina.
authors.forename: Elizabeth
authors.initials: E
authors.lastname: McGrady
mesh_terms: D057189:Checklist; D016494:Computer Security; D003219:Confidentiality; D057286:Electronic Health Records; D020408:Health Insurance Portability and Accountability Act; D012308:Risk Management / Q000379:methods; D014481:United States