CHICAGO, IL, Nov. 3, 2009 (Marketwire) --

CHICAGO, IL -- (Marketwire) -- 11/03/09 -- With the American Recovery and Reinvestment Act underway, healthcare organizations face new challenges to maintain privacy and security of patient health data. However, data gathered from healthcare IT and security professionals indicate that many organizations may not be ready to meet some of the HITECH components of the ARRA legislation and other security challenges, according to the results of the 2009 HIMSS Security Survey, sponsored by Symantec Corp. (NASDAQ: SYMC).

While healthcare organizations recognize that patient data must be protected, the survey results show that:

--  Security budgets remain low
--  Organizations often don't have a response plan for threats or a
    security breach
--  A designated Chief Security Officer or Chief Information Security
    Officer is not in place
    

In addition, the survey reveals that healthcare organizations are not using the current security technologies available to keep patient data safe. Respondents to this survey widely use audit logs with data from firewalls, application logs and server logs as common information sources. Yet, when analyzing the log data, only 25 percent of respondents reported electronic analysis of that data. Respondents indicate they are using firewalls and user access controls, but are not implementing all available technologies to secure data. Only 67 percent of responding organizations use encryption to secure data in transmission, and fewer than half encrypt stored data.

"Healthcare organizations are continually looking for ways to save money," said David Finn, health IT officer, Symantec Corp. "One of the best ways to accomplish these goals is through investing in technologies that will automate and reduce the risks of a security incident and lower the chances of a compliance issue. Although awareness about these issues is high, many providers have not yet made significant moves to the address these concerns."

Other key survey results include:

Security Budget: Approximately 60 percent of respondents reported that their organization spends three percent or less of their organization's IT budget on information security.