By Brandon Harvath<\/strong><\/p>\n\n\n\n Data security breaches are rampant in today\u2019s complex technological environment. According to the Office of Civil Rights (OCR), healthcare data breach numbers are staggering. In 2015, 253 healthcare breaches affected more than 112 million records. Healthcare industry players are increasingly concerned about their ability to achieve and maintain the highest levels of data security. The sobering truth is that most healthcare organizations, including contact centers, are one data breach away from a catastrophe.<\/p>\n\n\n\n Global data attacks continue to be extremely sophisticated and, faced with a steady stream of hacker headlines, the public is becoming more concerned about its own personal data. Is our industry taking all precautions to safeguard personally identifiable information (PII) and protected health information (PHI)? Progressive contact centers are working diligently to address the challenges.<\/p>\n\n\n\n A Stringent Approach to Protecting PII and PHI: <\/strong>In transacting daily business, consumers share a great deal of personal data with unknown persons who answer the phone as the voice of a trusted business entity. Consider how many times each of us has called a company\u2019s contact center and shared personal information. This practice has become so routine that most of us barely give it a second thought.<\/p>\n\n\n\n The security of PII and PHI is only as strong as the chain\u2019s weakest link. Toward this end organizations spend millions of dollars annually on anti-hacking software and other privacy and security programs. Unfortunately it takes just one click of a spam email for the fragile system of data security to be shattered.<\/p>\n\n\n\n Health insurers and their vendor partners face a tremendous challenge today in complying with the mandates of a multitude of federal and state agencies, including the regulations put forth by the Health Insurance Portability and Accountability Act (HIPAA) and its complex privacy and security rules. Many of today\u2019s privacy and security issues were not even envisioned when HIPAA was enacted in 1996, so it is incumbent upon the industry to be progressive in its achievement of data security. This requires a holistic approach that encompasses not only HIPAA, but also complex standards formulated specifically to mitigate broad-ranging privacy and security risks. One organization has emerged to require healthcare organizations implement this sophisticated set of standards: Health Information Trust Alliance (HITRUST).<\/p>\n\n\n\n At the foundation of HITRUST\u2019s offerings is the common security framework (CSF), a certifiable infrastructure that provides organizations with a comprehensive, flexible, and efficient approach to regulatory compliance and risk management. Developed in collaboration with healthcare and information security professionals, HITRUST CSF merges healthcare-relevant regulations and standards into a single overarching security configuration. HITRUST CSF has become the most widely adopted security framework in our nation\u2019s healthcare industry as it helps organizations via an efficient, prescriptive framework for managing the security requirements fundamental to HIPAA.<\/p>\n\n\n\n Attention is turning toward achievement of the level of security HITRUST CSF demands. In June 2015, for example, HITRUST announced that a growing number of major healthcare organizations, including key health insurance companies, would now require their business associates (BA) to obtain CSF certification within the next twenty-four months.<\/p>\n\n\n\n Those contact centers that have already committed the time, finances, and other resources necessary to earn such a stringent certification are on data security\u2019s leading edge. Those that have not will need to act quickly to remain partner vendors with this growing group of certified healthcare clients.<\/p>\n\n\n\n One Contact Center\u2019s Journey: <\/strong>Achieving what many view as the Holy Grail of world-class healthcare data security does not come without tremendous investment: communicated management commitment, dedicated resources and rigid processes and controls. In our experience, the contact center attempting to reach this goal must adhere to a number of controls that are focused on three mission-critical areas: technology and systems, process, and people. Because a detrimental glitch can occur within any of these areas at any time, compliance within a multitude of data security categories (HITRUST has more than sixty) must be assured.<\/p>\n\n\n\n Access to information systems, for example, is to be role based, in compliance with HIPAA guidelines, and is determined based on an intense evaluation of one\u2019s role within the organization and within a specific program assignment.<\/p>\n\n\n\n Our management evaluates each job function to provide the minimum necessary access to information systems and data needed to satisfactorily perform individual tasks. Monitoring is strict and includes ensurance of procedural compliance in all prescribed areas. With HITRUST certification at the core of our data security program, these are a sampling of best-in-class practices that contribute to our continued compliance:<\/p>\n\n\n\n The proliferation of technology we take for granted today, and which didn\u2019t exist a decade ago, has necessitated the need for stringent controls and data oversight. HITRUST CSF certification and other marketplace compliance certifications will soon become the standard and the price of doing business in the healthcare market. The security of consumers\u2019 data \u2013 and the survival of our healthcare contact centers \u2013 clearly depends upon it.<\/p>\n\n\n\n Brandon Harvath is senior vice president of operations for Corporate Call Center, Inc. (CCC), a customer interaction company specializing in providing complex, high-touch services within the healthcare insurance and other highly regulated markets. CCC, a multi-site contact center, is headquartered in Blue Bell, Pennsylvania. Harvath can be reached via <\/em>email<\/em><\/a> or 215-283-4202. <\/em><\/p>\n","protected":false},"excerpt":{"rendered":"