Industry Focus: Assessing Client Risk in Health Care

November 7, 2005

While companies in every market segment will need to address their level of exposure to technology and information risk, health care organizations, in particular, have an elevated level of exposure. As health care risk managers assess the risks associated with technology and the digitization of information, they should be considering the following key areas:

Is the organization digitizing health records?

Is the organization implementing a Health Insurance Portability and Accountability Act (data security and privacy plan)?

Is the organization automating information responses (e.g., e-mails for billing, applications, scheduling, appointment reminders)?

Is the organization aggregating an increasing amount of third-party data?

Is the organization regularly changing content on its Web site?

Is the organization offering any information-based services to its patients and business partners (e.g., newsletters, reports, e-mails, etc.)?

Does the organization provide any online transactions (for prescriptions, payment of services, etc.)?

Does the organization rely on subcontractors to help it implement and maintain its information technology systems?