Reference no: EM133076873

Question: You have recently been hired as the chief information security officer (CISO) for Big Sky Health System, the largest healthcare system in a predominantly rural state. When you were hired, the chief executive told you candidly that you were chosen to bridge the gap between the modern IT infrastructure used by Big Sky and the dated practices of your regional partners. For example, of the 16 critical access hospitals in your network, 20% still primarily chart on paper. Your state does not participate in a health information data exchange, making it difficult to electronically transfer medical information even for those 80% of providers who do use electronic medical records. Big Sky is the only trauma hospital within a 250-mile radius. It is vital for Big Sky to provide medical records back to the referring provider for continuity of care and to ensure referrals continue to come to Big Sky Health System.

After taking the last three months to investigate and assess your new organization's information security posture, you have come to learn the following about Big Sky:
• Outside individuals have access to Big Sky's electronic medical records (EMRs). This has resulted in 25 HIPAA breaches through inappropriate access over the last six months.
• Many records are faxed, including some being faxed to the incorrect fax number.
• Some records are never sent to the referring provider, causing agitation to referring providers who threaten to take their business elsewhere.
• Big Sky currently utilizes the following health information technologies:

o Cerner: This is a cloud hosted EMR that contains all clinical and demographic data.

o Commonwell: This is an electronic health information exchange technology. Commonwell is purchased nationally by organizations attempting to connect EMRs across different organizations. This is a purchased solution that hasn't been adopted by many providers in the state.

o Fairwarning: This is a cloud-hosted system that monitors user access to Cerner and flags for potential inappropriate access.
You are expected to brief the Big Sky executive leadership team, including the CEO and chief compliance officer, with the results of your investigation, including your plan for addressing the primary information availability and security issues facing your organization.

The Information Security Presentation
Craft an effective presentation that informs your audience of the regulatory landscape governing current health IT best practices. Then, propose solutions that assure the availability of information for public health use without compromising the confidentiality, security, and integrity of your organization's EMRs. Your solutions should be informed by and in alignment with the same standards discussed at the top of your presentation. The presentation must be 10 to 15 slides in length, including speaker notes, and cite any references.