Marti Arvin (marti.arvin@cynergistek.com) is Vice President of Audit Strategy at CynergisTek in Austin, TX.
-
linkedin.com/in/marti-arvin-7a6a587
In today’s healthcare environment, mobile devices are rampant. Controlling the nature and method of data stored on these devices is not easy in most industries — and mobile devices in the healthcare environment present a unique challenge. What makes securing mobile devices particularly difficult in healthcare and even more difficult in the academic medical center (AMC)? It helps first to understand the environment.
The academic medical center
The old saying is that, “If you have seen one AMC, you have seen one AMC.” The organizational structures, politics, and cultures vary among AMCs. The nature and structure of the legal entities involved can also vary, but there are consistent factors. Usually, there is a healthcare facility, such as a hospital, and an AMC will have faculty members and trainees (i.e., residents and students). The clinical activity of the faculty members will often be performed through one or more faculty practice groups. Clinical research is often also being conducted simultaneously on the university side. Regardless of the structure, controlling the data on mobile devices is difficult, but sometimes the AMC structure can make an already complex proposition even worse.
So, what are some of the variations of the structures? There can be a single legal entity in which the university owns the hospital and faculty members are employed by the university, both as educators and clinicians. All research activity is performed by that legal entity, and most of the training programs are all conducted by the entity.
Another variation is that the university is one legal entity responsible for most of the training programs and research activity, and the health system is another legal entity or a combination of related legal entities. Yet another variation is a combination of the first two (i.e., one or more of the hospitals are a component of the university and the health system owns others) where all entities share common governance and oversight.
There may also be one or multiple affiliated hospitals that are each an independent legal entity with a separate governance structure. One or more faculty practice groups generally employ the physicians. The faculty practice groups may be affiliated but separate from the university. A practice group may be a component of a large health system or completely independent from it. When the practice group is a separate legal entity from the university, the faculty members are generally dual-employed. They are university faculty performing educational and research activities for the university while, as clinicians, they are performing patient care services through the faculty practice group.