Anyone who has needed to schedule an appointment with a new doctor or meet with a specialist knows the hassle of making sure everyone in the health care chain has access to your health records. Digital record-keeping has made that a little easier, but that access still isn’t universal. Digital health care interoperability can still be a challenge.

That should all change in 2022 when the Trusted Exchange Framework and Common Agreement (TEFCA) goes live. The Department of Health and Human Services Office of the National Coordinator for Health IT (ONC) is driving the effort, which will define “a common set of principles, terms and conditions to support the development of a Common Agreement that would help enable nationwide exchange of electronic health information (EHI) across disparate health information networks (HINs).”

On the one hand, this is a much-needed advance. It can make it easier for health care workers and patients to share and access protected health information (PHI). TEFCA will also drive health care interoperability. On the other hand, TEFCA could present major challenges. It affects PHI security, data privacy and overall HIPAA compliance and health care interoperability and cybersecurity overall.

The Overall State of Health Care Cybersecurity

Health care cybersecurity is in a tenuous state. Attacks against the health care industry increased by more than 55% in 2020, according to a study from Bitglass, compromising the PHI of at least 26 million patients across the country. During the pandemic, one in three health care facilities had to deal with a ransomware attack, according to Sophos.

When it comes to data breaches, health care has paid a price beyond any other industry. IBM’s Cost of a Data Breach report found the average total cost of a data breach in 2021 is $9.23 million, almost $2 million more than the cost in 2020. The costs jumped $1 million when remote work was a factor in the breach. One in five breaches involved remote workers.

“Higher data breach costs are yet another added expense for businesses in the wake of rapid technology shifts during the pandemic,” Chris McCurdy, vice president and general manager, IBM Security, told HIPAA Journal.

How Health Care Interoperability Impacts Security

When TEFCA goes into effect, the change will lead to greater data access and a stronger reliance on APIs. It also opens avenues for private vendors to connect with state and local health information exchanges (HIE).

The idea behind health care interoperability is to connect multiple networks with no effort by users. However, this could result in a security nightmare. ONC said TEFCA will “increase secure and appropriate access to data” to help. It will also follow HIPAA-defined payment activities and health care operations. However, there are still a lot of questions surrounding the overall privacy and security surrounding PHI. For example, who will the law hold responsible for data breaches and data privacy compliance violations?

For example, TEFCA use is voluntary. Individual municipalities may decide to forgo TEFCA for another HIE. However, someone will have to be held to account for a widespread data breach caused by a mutual third-party vendor. This interoperability of technology and cybersecurity not only needs to exist across a single organization but now also across HIEs.

Security and Privacy Is a Team Effort

As health care organizations move to adopt TEFCA, it will take a lot of teamwork and a lot of planning ahead to ensure security.

“Privacy and security teams must be involved from the planning and design stages to facilitate the inclusion of privacy and security requirements,” IAPP reported. Protocols must be put in place from the beginning. Third-party vendors and applications must provide full transparency into their security and data privacy compliance. Any steps already in use to apply HIPAA regulations to APIs and other technology infrastructure must continue in HIEs.

Health care interoperability is a logical next step in the digital transformation and as the pandemic crisis continues. Organizations must carefully put security protocols and systems into place before anything goes live, however.

More from Data Protection

Resilient Companies Have a Disaster Recovery Plan

Historically, disaster recovery (DR) planning focused on protection against unlikely events such as fires, floods and natural disasters. Some companies mistakenly view DR as an insurance policy for which the likelihood of a claim is low. With the current financial and economic pressures, cutting or underfunding DR planning is a tempting prospect for many organizations. That impulse could be costly. Unfortunately, many companies have adopted newer technology delivery models without DR in mind, such as Cloud Infrastructure-as-a-Service (IaaS), Software-as-a-Service (SaaS)…

Millions Lost in Minutes — Mitigating Public-Facing Attacks

In recent years, many high-profile companies have suffered destructive cybersecurity breaches. These public-facing assaults cost organizations millions of dollars in minutes, from stock prices to media partnerships. Fast Company, Rockstar, Uber, Apple and more have all been victims of these costly and embarrassing attacks. The total average cost of a data breach has increased by 2.6% since 2021 and is now $4.35 million. Organizations that don't deploy zero trust security models also incur an average of $1 million more in…

How the Mac OS X Trojan Flashback Changed Cybersecurity

Not so long ago, the Mac was thought to be impervious to viruses. In fact, Apple once stated on its website that "it doesn't get PC viruses". But that was before the Mac OS X Trojan Flashback malware appeared in 2012. Since then, Mac and iPhone security issues have changed dramatically — and so has the security of the entire world. In this post, we'll revisit how the Flashback incident unfolded and how it changed the security landscape forever. What…

How Do Data Breaches Impact Economic Instability?

Geopolitical conflict, inflation, job market pressure, rising debt — we've been hearing about economic headwinds for a while now. Could data breaches have anything to do with this? According to a recent IBM report, the average cost of a data breach has reached an all-time high. Like any other business liability, these costs must be absorbed somehow. Given the rising risk and costs, cyberattacks have undoubtedly evolved into market stressors. The magnitude of the problem might surprise you.  Despite the…