When it comes to an awareness of what data they have and where it resides, health care organizations may suffer from overconfidence, despite experiencing the second-largest amount of cybersecurity breaches, suggests a new study on data privacy management within the industry.

Seventy percent of the survey respondents—made up of 258 top business executives and information technology decision makers within mid- to large-size U.S. companies—reported that they were “very confident” or “extremely confident” in knowing exactly where sensitive data resides. However, only half of the respondents said they update their inventory of personal data once a year or less.

“Because of the massive volume of data that people are dealing with, you really need to use technology to crawl that data to understand what's there,” Kristina Bergman, CEO and founder of data privacy automation provider Integris Software Inc., said in an interview. Then “companies can actively assess their risk and proactively make decisions about how to manage the data.”

The Seattle-based company conducted the survey, which it dubbed the Integris Software 2019 Healthcare Data and Privacy Maturity study.

The issue of not knowing what data a company has often arises in the context of mergers and acquisitions, particularly among those businesses that acquire smaller ones, and in the case of data transfer agreements, especially with credit card processors or third parties, Bergman said, adding that the oversight generally is not negligent. 

“The reality is that the people who are negotiating those agreements, the lawyers and [business representatives], are not the same people who are opening up the pipes and transferring the data,” she said. “The IT people aren't reading and checking the contract.”

To help remedy this unawareness, Bergman suggests continuously and automatically monitoring and mapping the sensitive data that companies collect and store across locations.   

“It is good to know immediately, which will catch things before they become issues,” she said.

Other findings from the survey include:

• Respondents were much more confident in their own ability to respect data-sharing agreements than their partners' ability to reciprocate in kind, with a nearly 61% increase in “very confident” and “extremely confident” levels in their own compliance efforts versus their partners.
• The health care industry is better prepared for security compliance mandates than other industries, with 35% scoring themselves as “fully prepared” for the European Union's General Data Protection Regulation, though only 16% said they were “fully prepared” for the California Consumer Privacy Act.
• Organizations are using several types of tools to discover and track the location of personal information, including surveys and spreadsheets, metadata management and data catalog.