Southshore Health has inpatient and outpatient facilities, home health care services, and other services that your patient population needs. The health system also has a world-renowned diabetes treatment center that has been considered by many to be a model for the rest of the country. The health system has always enjoyed an excellent reputation and the quality of care is known to be excellent. You are the administrative director of the Diabetes Care Treatment Center (DCTC).

Last week it was discovered that over 1000 patient records may have been compromised. Your IT department's Security Team detected malware on a server that may have been used to access private patient information. They conducted a preliminary audit but as the team dug into the possible causes for the breach, it became apparent that there were many possibilities.

The CIO assigns a team from IT Security to do a full audit. After a week, the team reports the following:

Many PCs on the units had a password taped near the monitor

Some IT closets were locked but many were not

The anti-virus on many PCs was not updated

Mobile phones do not have Remote Management Software on them (allowing for remote wiping)

There are no programs reminding staff to change their passwords on a regular basis

When I requested sensitive patient files, people rarely questioned me

Write a memo to the CEO outlining the issues and what you plan on doing to address them