• Hospital governing-boards will exert their power to manage data breach risks in order to increase accountability and fiduciary responsibility.

"Patient health information data breaches are one of the most significant legal and public trust risks facing hospital governing boards, which are legally and ethically accountable for the results of a breach.  The board of trustees has a fundamental fiduciary responsibility to ensure that patients' health information is safe and secure at all times," said Larry Walker, president of The Walker Company, a governance consultant to healthcare organizations.

"To do this, boards must establish the prevention of data breaches as a critical organizational priority, ensure that financial resources sufficient to achieve the objective are made available, and require periodic updates from senior management on data breach risks and methods being utilized to close potential breach gaps.  This should be one of the critical agenda items for hospital and health system boards in 2011," said Walker.

• "A significant "data spill" is inevitable and will bring national attention to the issue.

"2011 will be the year that Americans recognize they can't control personal health information in health IT systems and data exchanges," said Deborah Peel, MD, practicing physician and founder of Patient Privacy Rights, a health privacy watchdog. "Will 2011 be the year that data security and privacy are the top of the nation's agenda?  I hope so.  The right to privacy is the essential right of individuals in vibrant Democracies.  If we don't do it right in healthcare, we won't have any privacy in the Digital Age," she said.

• There will be heightened patient awareness and concern over the security of their private medical data.

"I am seeing organizations shift their focus from implementation of electronic health records to a focus on the next phase of "meaningful use," specifically how they are going to share patient records though health information exchanges," said Rick Kam, president and co-founder, ID Experts, a provider of data breach solutions.

 "There will also be more concern over accountability if PHI is breached.  How will a patient know who is responsible when a health information exchange has a data breach? Who will they hold accountable to fix the problem and for the financial, reputational, and other damage they experience?" Kam asked.

• The finalization of data breach notification rules by the Department of Health and Human Services could remove the controversial "harm threshold" provision that determines whether notification is required when an incident occurs.  If removed, this will create a risk of over notification and desensitization of patients.