Earlier this week I had to opportunity to have coffee with a colleague. While we discussed a variety of items, one in particular was concerning.
He told me about a client his company has which is in the process of upgrading their software. His client is a dental office and they are about to install a new program which will store patient records. So far, everything seems to be OK.
The dental office additionally wants to be able to use notebooks throughout the office to enter and access patient records. The issue is none of the rooms are equipped with network connections, so they will need to use wireless. Now it starts to get a little tricky as there are a lot of security issues with wireless connections and the data being transmitted is medical records.
Here is where his client takes a turn for the worse. Instead of having my colleague work directly with the software provider, one of the dentists decides to have one of the staff be the conduit. The information the software provider gave does not come anywhere close to meeting HIPAA compliance.
While my colleague will have to deal with the issues created by not being directly involved with the software purchase, the dental practice will be the one on the hook if there is a security breach. Perhaps they wanted to save a few bucks by not paying a professional for help, but the downside is potentially hundreds of thousands of dollars in law suits, fines, and loss of revenue from bad press.
