How to look behind the curtain of emerging health it technologies for security concerns

Emerging technologies (e.g., mobile devices, cloud computing) have created tremendous opportunities for public health practitioners and researchers to improve health of underserved populations globally. Researchers and practitioners are increasingly being encouraged to use and share data. At the same time, changes to regulations such as HIPAA (announced January 2013) have increased security requirements. Limited resources have made it challenging for institutions to implement 1) sufficient staff training to ensure working knowledge of security best practices, and 2) technologies that protect health information per the regulations and reduce the likelihood of breaches. Using HIPAA as a framework, this session will include: 1) practical everyday requirements for keeping data secure in transmission and storage (e.g., encryption), and avoiding breaches, and 2) US and international examples of uses and risks of using cloud technologies and mobile devices to collect, store and transfer research data. Mobile devices present risks similar to laptops, but lack the mature industry security solutions to protect them, especially in institutions that allow staff to “bring your own device.” Use of mobile devices for data collection and work email have limitations in protecting research data as it travels and when it is stored on the device. The session discussion will include how to identify and balance typical risks, such as weak encryption and “one size fits all” against the regulatory requirements and practical advantages such as global data access and cost savings.