For instance, the Health Insurance Portability and Accountability Act of 1996, or HIPAA, did not require notification of a breach of medical information. Under HITECH, a breach is presumed and must be reported after the impermissible use or disclosure of protected health information. The only exception is if a documented risk assessment determines a low probability of a breach.

In addition, although individuals cannot sue under HIPAA, state attorneys general can now bring actions on behalf of their residents. HITECH also increases potential fines and penalties for a breach; the price tag ranges from $50,000 to $1.5 million per violation.

It's not just health care organizations that are affected by HITECH. "Business associates" —third parties with access to patients' medical data—are now also liable for data breaches.

Next page: Risk mitigation

Risk Mitigation: From the Top Down

The potential risks are significant, but the good news is that they can be reduced. Effective risk mitigation begins at the top. If senior managers make data security a priority, employees will likely do the same. Training and awareness programs, required under HITECH, help build a culture of data protection.

One critical, and constantly changing, element of a health care organization's risk profile is mobile technology. Tablets, smart phones and other devices make it easy to access and record medical information on the spot—but they also increase risk. A mobile device security policy communicates how employees are expected to safeguard sensitive data. If providers use their own devices on the job, a bring-your-own-device (BYOD) policy should be included. Encryption, while sometimes overlooked, adds a critical layer of protection for all devices.

Another way to mitigate risk is by reducing contractual liability. Health care providers should develop written indemnification agreements with all vendors and third party service providers and have them reviewed by outside counsel. Third parties should have data breach security controls comparable to those of the health care organization. These providers also should carry data breach or cyber insurance.

In addition, a written network privacy and security incident response plan has been proven to lower breach costs. Having an incident response plan reduces the cost of a data breach by $17 per record, according to the Ponemon Institute.

Given the frequency with which data breaches occur, cyber insurance from a carrier that provides robust risk mitigation and risk management support is also key. Look for a carrier that can provide referrals to qualified vendors and outside counsel with expertise in health care including loss prevention premium reimbursement.

As long as a lucrative market for stolen health care information exists, safeguarding that data will be a challenge. But by understanding the risks and taking steps to address them, health care organizations can keep their patient information safer.

Beth Strapp is a vice president and specialty health care segment manager for the Chubb Group of Insurance Companies. She can be reached at [email protected].