---
title: Why in Healthcare, Compliance Does NOT Equal Patient Data Security
description: To keep patient data safe, healthcare organizations must shift from relying solely on compliance to building a secure infrastructure.
image: https://www.resilientiq.com/hubfs/Blog_Images/Compliance-Does-NOT-Equal-Patient_Data-Security.png
---

[![NEW_ResilientLogoShadow_FINALwhite.png](https://www.resilientiq.com/hs-fs/hubfs/Resilient_Logos/NEW_ResilientLogoShadow_FINALwhite.png?width=1210&height=254&name=NEW_ResilientLogoShadow_FINALwhite.png "NEW_ResilientLogoShadow_FINALwhite.png")](http://resilientiq.com)

![Resilient-Advanced-Network-Solutions 4.jpg](https://www.resilientiq.com/hs-fs/hubfs/Blog_Images/Resilient-Advanced-Network-Solutions%204.jpg?width=1920&name=Resilient-Advanced-Network-Solutions%204.jpg "Resilient-Advanced-Network-Solutions 4.jpg")

# Networking Intelligence

August 17, 2016

# Why in Healthcare, Compliance Does NOT Equal Patient Data Security

![authorIcon](http://www.sparkreaction.com/hubfs/Oceania%20Theme%202016/Images/authorIcon.png) By [Resilient Intelligent Networks](https://www.resilientiq.com/blog/author/resilient-intelligent-networks) ![topicIcon](http://www.sparkreaction.com/hubfs/Oceania%20Theme%202016/Images/topicIcon.png) [Patient data security](https://www.resilientiq.com/blog/topic/patient-data-security), [securing the healthcare enterprise](https://www.resilientiq.com/blog/topic/securing-the-healthcare-enterprise)

[![Compliance-Does-NOT-Equal-Patient_Data-Security.png](https://www.resilientiq.com/hubfs/Blog_Images/Compliance-Does-NOT-Equal-Patient_Data-Security.png) ](https://www.resilientiq.com/blog/why-in-healthcare-compliance-does-not-equal-patient-data-security)

![Compliance-Does-NOT-Equal-Patient_Data-Security.png](https://www.resilientiq.com/hs-fs/hubfs/Blog_Images/Compliance-Does-NOT-Equal-Patient_Data-Security.png?width=253&name=Compliance-Does-NOT-Equal-Patient_Data-Security.png)

We all know IT compliance doesn’t equal healthcare data security — believe it or not, even  
Target passed a PCI compliance audit just prior to its infamous breach. With the Ponemon   
Institute finding that nearly 90% of healthcare entities fell victim to data breaches in the last two years, it’s clear that compliance initiatives like HIPAA and PCI are not enough to keep attackers at bay.

 

The healthcare sector is at the forefront of leveraging IT solutions to better engage patients and improve outcomes via initiatives like electronic medical records, mobile technologies and connected medical devices. To truly keep patient data safe, healthcare organizations must shift their focus from relying solely on a culture of compliance to building a secure infrastructure that aligns medical record integrity and secure data access with business strategy.

Ensuring secure and accurate patient data not only helps providers improve the quality of treatment, it also results in better patient trust and engagement. What’s more, it reduces the likelihood of a breach, which ultimately reduces costs over time.

## Compliance-Only Focus Creates Gaps In Security

Unfortunately, healthcare organizations that focus solely on compliance are by definition only doing the bare minimum when it comes to information security. For example, HIPAA requires:

**Regular review of information system activity, such as audit logs, access reports and security incident tracking reports.** While that may seem comprehensive on the surface, the standard does not define what regular means (daily, monthly, yearly?), and fails to specify which logs must be reviewed and how long they must be retained. Can organizations that manually review a handful of logs on a monthly basis possibly be as secure as those who implement security tools to automatically correlate all critical system logs, identify anomalies and alert on potential security events in real time?

**Limiting each employee’s access to only the information systems required to do their job.** While this is a good goal, the rule fails to specify or even mention the importance of implementing role-based access. Can organizations that assign access based on a point in time (once a year) be as secure as those who use automated processes to stay in lock step with how business needs evolve?

**Periodic testing to ensure compliance.** Still, HIPAA sets no standard for the type of testing, frequency or what to test. True security requires testing critical systems during initial implementation and after each and every change, and then remediation to ensure systems remain secure over time.

**Encryption of protected health information (PHI), as a way to limit access and protect data as it traverses open networks like the Internet.** To truly protect patient data, however, encryption must be used on all sensitive data no matter where it resides, at rest and in transit.

Healthcare organizations need to be especially cognizant of the fact that compliance does not equal security. To truly protect privacy and provide patient data security, a shift in mindset is required, meaning healthcare organizations need to adopt multiple layers of security, including internal segmentation to manage and mitigate the rising threat landscape.

[Fortinet’s broad portfolio of solutions for healthcare](https://www.fortinet.com/solutions/industries/healthcare.html) can seamlessly extend network security to protect sensitive data and resources, comply with regulations and standards such as HIPAA and PCI, and enable secure care delivery for the entire fabric of your infrastructure. A partner of Fortinet, [Resilient Intelligent Networks](https://www.resilientiq.com/) can  help you create and deploy a strategy that’s right for your healthcare organizations.

[![Securing the Healthcare Enterprise](https://hubspot-no-cache-na2-prod.s3.amazonaws.com/cta/default/703198/0ec6cf6e-d8d3-4481-9cf3-7f176e3194cb.png)](https://hubspot-cta-redirect-na2-prod.s3.amazonaws.com/cta/redirect/703198/0ec6cf6e-d8d3-4481-9cf3-7f176e3194cb)

 SHARE THIS STORY [**](https://www.facebook.com/sharer/sharer.php?u=https://www.resilientiq.com/blog/why-in-healthcare-compliance-does-not-equal-patient-data-security&title=Why%20in%20Healthcare,%20Compliance%20Does%20NOT%20Equal%20Patient%20Data%20Security&picture=http://cdn2.hubspot.net/hubfs/703198/Blog_Images/Compliance-Does-NOT-Equal-Patient_Data-Security.png&description=To%20keep%20patient%20data%20safe,%20healthcare%20organizations%20must%20shift%20from%20relying%20solely%20on%20compliance%20to%20building%20a%20secure%20infrastructure.) | [**](https://twitter.com/intent/tweet?source=https://www.resilientiq.com/blog/why-in-healthcare-compliance-does-not-equal-patient-data-security&text=Why%20in%20Healthcare,%20Compliance%20Does%20NOT%20Equal%20Patient%20Data%20Security) | [**](http://www.linkedin.com/shareArticle?mini=true&url=https://www.resilientiq.com/blog/why-in-healthcare-compliance-does-not-equal-patient-data-security&title=Why%20in%20Healthcare,%20Compliance%20Does%20NOT%20Equal%20Patient%20Data%20Security&summary=To%20keep%20patient%20data%20safe,%20healthcare%20organizations%20must%20shift%20from%20relying%20solely%20on%20compliance%20to%20building%20a%20secure%20infrastructure.)

[NEXT POST **](https://www.resilientiq.com/blog/why-your-approach-to-wlan-access-security-may-be-all-wrong)

### Search



### Recent Posts

### Posts by Topic

- [network security (29)](https://www.resilientiq.com/blog/topic/network-security)
- [employee it policy (15)](https://www.resilientiq.com/blog/topic/employee-it-policy)
- [security fabric (13)](https://www.resilientiq.com/blog/topic/security-fabric)
- [ransomware (11)](https://www.resilientiq.com/blog/topic/ransomware)
- [acceptable use policy (8)](https://www.resilientiq.com/blog/topic/acceptable-use-policy)
- [cyber threat analysis (7)](https://www.resilientiq.com/blog/topic/cyber-threat-analysis)
- [IT Security in Education (6)](https://www.resilientiq.com/blog/topic/it-security-in-education)
- [malware (6)](https://www.resilientiq.com/blog/topic/malware)
- [IoT Security (5)](https://www.resilientiq.com/blog/topic/iot-security)
- [Patient data security (5)](https://www.resilientiq.com/blog/topic/patient-data-security)
- [Protecting Student Data (5)](https://www.resilientiq.com/blog/topic/protecting-student-data)
- [network vulnerability (5)](https://www.resilientiq.com/blog/topic/network-vulnerability)
- [wireless networking solutions (5)](https://www.resilientiq.com/blog/topic/wireless-networking-solutions)
- [Cyber Threat Assessment (4)](https://www.resilientiq.com/blog/topic/cyber-threat-assessment)
- [Digital Privacy in Schools (4)](https://www.resilientiq.com/blog/topic/digital-privacy-in-schools)
- [protecting your it network (4)](https://www.resilientiq.com/blog/topic/protecting-your-it-network)
- [DDoS Attacks (3)](https://www.resilientiq.com/blog/topic/ddos-attacks)
- [IT Security in Schools (3)](https://www.resilientiq.com/blog/topic/it-security-in-schools)
- [Protecting Employee Privacy (3)](https://www.resilientiq.com/blog/topic/protecting-employee-privacy)
- [advanced persistent threats (3)](https://www.resilientiq.com/blog/topic/advanced-persistent-threats)
- [cloud security (3)](https://www.resilientiq.com/blog/topic/cloud-security)
- [healthcare cyberattacks (3)](https://www.resilientiq.com/blog/topic/healthcare-cyberattacks)
- [network threats (3)](https://www.resilientiq.com/blog/topic/network-threats)
- [phishing (3)](https://www.resilientiq.com/blog/topic/phishing)
- [secured network services (3)](https://www.resilientiq.com/blog/topic/secured-network-services)
- [securing the healthcare enterprise (3)](https://www.resilientiq.com/blog/topic/securing-the-healthcare-enterprise)
- [traffic shaping (3)](https://www.resilientiq.com/blog/topic/traffic-shaping)
- [Control network traffic (2)](https://www.resilientiq.com/blog/topic/control-network-traffic)
- [Intent-based Security (2)](https://www.resilientiq.com/blog/topic/intent-based-security)
- [K-12 Technology Security (2)](https://www.resilientiq.com/blog/topic/k-12-technology-security)
- [app performance (2)](https://www.resilientiq.com/blog/topic/app-performance)
- [bandwidth management (2)](https://www.resilientiq.com/blog/topic/bandwidth-management)
- [byod policy (2)](https://www.resilientiq.com/blog/topic/byod-policy)
- [cloud (2)](https://www.resilientiq.com/blog/topic/cloud)
- [critical infrastructure threats (2)](https://www.resilientiq.com/blog/topic/critical-infrastructure-threats)
- [cyber secure campus (2)](https://www.resilientiq.com/blog/topic/cyber-secure-campus)
- [cybersecurity strategy (2)](https://www.resilientiq.com/blog/topic/cybersecurity-strategy)
- [mobile device security (2)](https://www.resilientiq.com/blog/topic/mobile-device-security)
- [network optimization (2)](https://www.resilientiq.com/blog/topic/network-optimization)
- [network security in higher education (2)](https://www.resilientiq.com/blog/topic/network-security-in-higher-education)
- [network technology (2)](https://www.resilientiq.com/blog/topic/network-technology)
- [network visibility (2)](https://www.resilientiq.com/blog/topic/network-visibility)
- [oil and gas industry (2)](https://www.resilientiq.com/blog/topic/oil-and-gas-industry)
- [ssl encryption (2)](https://www.resilientiq.com/blog/topic/ssl-encryption)
- [threat intelligence (2)](https://www.resilientiq.com/blog/topic/threat-intelligence)
- [unified threat management (UTM) (2)](https://www.resilientiq.com/blog/topic/unified-threat-management-utm)
- [wan optimization (2)](https://www.resilientiq.com/blog/topic/wan-optimization)
- [wireless LAN access security (2)](https://www.resilientiq.com/blog/topic/wireless-lan-access-security)
- [wireless network best practices (2)](https://www.resilientiq.com/blog/topic/wireless-network-best-practices)
- [802.11ac wave 2 (1)](https://www.resilientiq.com/blog/topic/802-11ac-wave-2)
- [Endpoint Protection (1)](https://www.resilientiq.com/blog/topic/endpoint-protection)
- [Endpoint Security (1)](https://www.resilientiq.com/blog/topic/endpoint-security)
- [IT Security in Government (1)](https://www.resilientiq.com/blog/topic/it-security-in-government)
- [Internal Segmentation Firewalls (1)](https://www.resilientiq.com/blog/topic/internal-segmentation-firewalls)
- [Network Technology Problem Solving (1)](https://www.resilientiq.com/blog/topic/network-technology-problem-solving)
- [Point of sale attacks (1)](https://www.resilientiq.com/blog/topic/point-of-sale-attacks)
- [Public sector IT networks (1)](https://www.resilientiq.com/blog/topic/public-sector-it-networks)
- [Software-defined networking (1)](https://www.resilientiq.com/blog/topic/software-defined-networking)
- [Threat detection (1)](https://www.resilientiq.com/blog/topic/threat-detection)
- [application security (1)](https://www.resilientiq.com/blog/topic/application-security)
- [business critical applications (1)](https://www.resilientiq.com/blog/topic/business-critical-applications)
- [critical learning applications (1)](https://www.resilientiq.com/blog/topic/critical-learning-applications)
- [cybersecurity (1)](https://www.resilientiq.com/blog/topic/cybersecurity)
- [cybersecurity technology (1)](https://www.resilientiq.com/blog/topic/cybersecurity-technology)
- [data protection (1)](https://www.resilientiq.com/blog/topic/data-protection)
- [digital learning (1)](https://www.resilientiq.com/blog/topic/digital-learning)
- [healthcare data security (1)](https://www.resilientiq.com/blog/topic/healthcare-data-security)
- [healthcare mobile networks (1)](https://www.resilientiq.com/blog/topic/healthcare-mobile-networks)
- [high performance network security (1)](https://www.resilientiq.com/blog/topic/high-performance-network-security)
- [higher education (1)](https://www.resilientiq.com/blog/topic/higher-education)
- [hybrid clouds (1)](https://www.resilientiq.com/blog/topic/hybrid-clouds)
- [hyperconnected (1)](https://www.resilientiq.com/blog/topic/hyperconnected)
- [indicators of compromise (1)](https://www.resilientiq.com/blog/topic/indicators-of-compromise)
- [it industry news (1)](https://www.resilientiq.com/blog/topic/it-industry-news)
- [network infrastructure (1)](https://www.resilientiq.com/blog/topic/network-infrastructure)
- [network intrusion (1)](https://www.resilientiq.com/blog/topic/network-intrusion)
- [networking terminology (1)](https://www.resilientiq.com/blog/topic/networking-terminology)
- [next-generation firewal (1)](https://www.resilientiq.com/blog/topic/next-generation-firewal)
- [ngfw (1)](https://www.resilientiq.com/blog/topic/ngfw)
- [reinforce network technology (1)](https://www.resilientiq.com/blog/topic/reinforce-network-technology)
- [retail data security (1)](https://www.resilientiq.com/blog/topic/retail-data-security)
- [sandbox solution (1)](https://www.resilientiq.com/blog/topic/sandbox-solution)
- [sdn (1)](https://www.resilientiq.com/blog/topic/sdn)
- [security operations (1)](https://www.resilientiq.com/blog/topic/security-operations)
- [shadow IT risks (1)](https://www.resilientiq.com/blog/topic/shadow-it-risks)
- [ssl inspection (1)](https://www.resilientiq.com/blog/topic/ssl-inspection)
- [ssl security (1)](https://www.resilientiq.com/blog/topic/ssl-security)
- [university campus cybersecurity (1)](https://www.resilientiq.com/blog/topic/university-campus-cybersecurity)
- [zero-day attacks (1)](https://www.resilientiq.com/blog/topic/zero-day-attacks)

[see all](https://www.resilientiq.com/blog/why-in-healthcare-compliance-does-not-equal-patient-data-security#)

### Subscribe to Blog

[![Resilient-Advanced-Networking-Solutions.png](https://www.resilientiq.com/hs-fs/hubfs/Resilient_Logos/Resilient-Advanced-Networking-Solutions.png?width=496&height=105&name=Resilient-Advanced-Networking-Solutions.png "Resilient-Advanced-Networking-Solutions.png")](http://resilientiq.com)

Contact

 2921 Country Club Road  
 Denton, Texas 76210  
 940-535-7500

#### Keep in Touch

### Subscribe to Our Blog

## [![social-1834007_960_720](https://www.resilientiq.com/hs-fs/hubfs/Social%20Media%20Icons/social-1834007_960_720.png?width=40&name=social-1834007_960_720.png "social-1834007_960_720")](https://www.facebook.com/ResilientIntelligentNetworks)[![social-1834011_1280](https://www.resilientiq.com/hs-fs/hubfs/Social%20Media%20Icons/social-1834011_1280.png?width=40&name=social-1834011_1280.png "social-1834011_1280")](https://www.linkedin.com/company/resilient-intelligent-networks)[![social-1834013_1280](https://www.resilientiq.com/hs-fs/hubfs/Social%20Media%20Icons/social-1834013_1280.png?width=40&name=social-1834013_1280.png "social-1834013_1280")](https://twitter.com/resilientiq)[![social-1834014_960_720](https://www.resilientiq.com/hs-fs/hubfs/Social%20Media%20Icons/social-1834014_960_720.png?width=40&name=social-1834014_960_720.png "social-1834014_960_720")](https://www.resilientiq.com/blog/rss.xml)[![](https://www.resilientiq.com/hs-fs/hubfs/Social%20Media%20Icons/social-1834016_960_720.png?width=40&name=social-1834016_960_720.png "social-1834016_960_720.png")](https://www.youtube.com/channel/UCIuShF1pL6Ekv2JTOnXuz-Q)

Search the Resilient Blog on Google