Anyone who has needed to schedule an appointment with a new doctor or meet with a specialist knows the hassle of making sure everyone in the health care chain has access to your health records. Digital record-keeping has made that a little easier, but that access still isn’t universal. Digital health care interoperability can still be a challenge.

That should all change in 2022 when the Trusted Exchange Framework and Common Agreement (TEFCA) goes live. The Department of Health and Human Services Office of the National Coordinator for Health IT (ONC) is driving the effort, which will define “a common set of principles, terms and conditions to support the development of a Common Agreement that would help enable nationwide exchange of electronic health information (EHI) across disparate health information networks (HINs).”

On the one hand, this is a much-needed advance. It can make it easier for health care workers and patients to share and access protected health information (PHI). TEFCA will also drive health care interoperability. On the other hand, TEFCA could present major challenges. It affects PHI security, data privacy and overall HIPAA compliance and health care interoperability and cybersecurity overall.

The Overall State of Health Care Cybersecurity

Health care cybersecurity is in a tenuous state. Attacks against the health care industry increased by more than 55% in 2020, according to a study from Bitglass, compromising the PHI of at least 26 million patients across the country. During the pandemic, one in three health care facilities had to deal with a ransomware attack, according to Sophos.

When it comes to data breaches, health care has paid a price beyond any other industry. IBM’s Cost of a Data Breach report found the average total cost of a data breach in 2021 is $9.23 million, almost $2 million more than the cost in 2020. The costs jumped $1 million when remote work was a factor in the breach. One in five breaches involved remote workers.

“Higher data breach costs are yet another added expense for businesses in the wake of rapid technology shifts during the pandemic,” Chris McCurdy, vice president and general manager, IBM Security, told HIPAA Journal.

How Health Care Interoperability Impacts Security

When TEFCA goes into effect, the change will lead to greater data access and a stronger reliance on APIs. It also opens avenues for private vendors to connect with state and local health information exchanges (HIE).

The idea behind health care interoperability is to connect multiple networks with no effort by users. However, this could result in a security nightmare. ONC said TEFCA will “increase secure and appropriate access to data” to help. It will also follow HIPAA-defined payment activities and health care operations. However, there are still a lot of questions surrounding the overall privacy and security surrounding PHI. For example, who will the law hold responsible for data breaches and data privacy compliance violations?

For example, TEFCA use is voluntary. Individual municipalities may decide to forgo TEFCA for another HIE. However, someone will have to be held to account for a widespread data breach caused by a mutual third-party vendor. This interoperability of technology and cybersecurity not only needs to exist across a single organization but now also across HIEs.

Security and Privacy Is a Team Effort

As health care organizations move to adopt TEFCA, it will take a lot of teamwork and a lot of planning ahead to ensure security.

“Privacy and security teams must be involved from the planning and design stages to facilitate the inclusion of privacy and security requirements,” IAPP reported. Protocols must be put in place from the beginning. Third-party vendors and applications must provide full transparency into their security and data privacy compliance. Any steps already in use to apply HIPAA regulations to APIs and other technology infrastructure must continue in HIEs.

Health care interoperability is a logical next step in the digital transformation and as the pandemic crisis continues. Organizations must carefully put security protocols and systems into place before anything goes live, however.

More from Data Protection

3 Strategies to overcome data security challenges in 2024

3 min read - There are over 17 billion internet-connected devices in the world — and experts expect that number will surge to almost 30 billion by 2030.This rapidly growing digital ecosystem makes it increasingly challenging to protect people’s privacy. Attackers only need to be right once to seize databases of personally identifiable information (PII), including payment card information, addresses, phone numbers and Social Security numbers.In addition to the ever-present cybersecurity threats, data security teams must consider the growing list of data compliance laws…

How data residency impacts security and compliance

3 min read - Every piece of your organization’s data is stored in a physical location. Even data stored in a cloud environment lives in a physical location on the virtual server. However, the data may not be in the location you expect, especially if your company uses multiple cloud providers. The data you are trying to protect may be stored literally across the world from where you sit right now or even in multiple locations at the same time. And if you don’t…

From federation to fabric: IAM’s evolution

15 min read - In the modern day, we’ve come to expect that our various applications can share our identity information with one another. Most of our core systems federate seamlessly and bi-directionally. This means that you can quite easily register and log in to a given service with the user account from another service or even invert that process (technically possible, not always advisable). But what is the next step in our evolution towards greater interoperability between our applications, services and systems?Identity and…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today