Heather Nelson hates to receive a call that begins, “So-and-so was at a conference and their laptop got stolen…and we think, maybe, there was some PHI [protected health information] on it.”
As the chief information officer (CIO) for the University of Chicago Medical Center, Nelson knows she’s not alone. “We’ve all been there…and it’s not fun. You hate to have to go to your senior leaders to talk about the potential of a breach.” For this reason, “it’s so important that we have policies and procedures and teams that are looking out for this,” she says.
In addition to worrying about big, sophisticated breaches, CIOs must contend with lost laptops and other more mundane ones that can also do damage. The job of CIO in an academic medical environment has many complexities, Nelson says, and “isn’t for the faint of heart.” In addition to “supporting the medical center’s IT structure, it’s also my responsibility to support the research mission that we have at the university.”
Nelson is part of a team guarding PHI at the University of Chicago Medicine, which is composed of the medical center and a community hospital, the Pritzker School of Medicine and the Biological Sciences Division of the university. This division includes the physician practice group. Three separate chief information security officers (CISOs) operate across facilities, departments and programs.
“We have a medical center/health system CISO, who reports to me, a university CISO, and a school of medicine CISO,” says Nelson, adding that she reports to the president of the medical center. Erik Decker, the medical center’s CISO, also serves as its privacy officer and “supports the clinical research components of the Biological Sciences Division,” she adds.
The three CISOs “meet every other week” to discuss “security items across our enterprise, research requests needing security assessments, and just day-to-day tactics,” Nelson tells RPP.
Nelson made some of her comments at a recent security conference cohosted by the National Institute of Standards and Technology and the HHS Office for Civil Rights; she also spoke to RPP.
For the medical center, an important focus of HIPAA compliance is an emphasis on patient safety and the commitment that “we have to care for the whole of the patient,” says Nelson.
“We want to make sure we don’t have nurses looking up a VIP patient. We want to make sure that in our emergency department, out in the waiting room, we have the right conversations happening,” she says.
